Edit tour

Windows Analysis Report
geosetter_setup.exe

Overview

General Information

Sample name:	geosetter_setup.exe
Analysis ID:	1546439
MD5:	6c8aac98ac0f743037c412b513a6a3a6
SHA1:	e9b08b023e456bb39a20209e4a288cab1740b0a5
SHA256:	64d508b33c50c5a9fd695c0b328dab5519703db96c6e4580b8934c39431876ab
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Found API chain indicative of debugger detection

Queries Google from non browser process on port 80

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Classes Autorun Keys Modification

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

geosetter_setup.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\geosetter_setup.exe" MD5: 6C8AAC98AC0F743037C412B513A6A3A6)

geosetter_setup.tmp (PID: 5284 cmdline: "C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp" /SL5="$20442,24249229,57856,C:\Users\user\Desktop\geosetter_setup.exe" MD5: 832DAB307E54AA08F4B6CDD9B9720361)

regsvr32.exe (PID: 3944 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 1576 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 1272 cmdline: /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

GeoSetter.exe (PID: 2300 cmdline: "C:\Program Files (x86)\GeoSetter\GeoSetter.exe" MD5: 010F18D793587CEB5E31D53455F461A1)

exiftool.exe (PID: 2352 cmdline: "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -listx MD5: CB2157B42F3AB50ED1A1977F995223E4)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

exiftool.exe (PID: 1968 cmdline: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -listx MD5: 44D73F3664153A38A9CD02F9DE9C3E69)

exiftool.exe (PID: 2232 cmdline: "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -lang MD5: CB2157B42F3AB50ED1A1977F995223E4)

conhost.exe (PID: 2260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

exiftool.exe (PID: 7056 cmdline: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -lang MD5: 44D73F3664153A38A9CD02F9DE9C3E69)

exiftool.exe (PID: 6004 cmdline: "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -ver MD5: CB2157B42F3AB50ED1A1977F995223E4)

conhost.exe (PID: 4052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

exiftool.exe (PID: 2140 cmdline: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -ver MD5: 44D73F3664153A38A9CD02F9DE9C3E69)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\GeoSetter\is-07QKO.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.GeoSetter.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {7506374C-A693-427B-8DDD-99DAFB79433D}, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\regsvr32.exe, ProcessId: 3944, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\GeoSetterShellExt\(Default)

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T22:22:30.938036+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.5	49705	TCP
2024-10-31T22:23:10.163143+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.5	49918	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Code function: 15_2_6DC0DD40 win32_crypt,Perl_get_context,

15_2_6DC0DD40

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION GeoSetter.exe

Jump to behavior

Source: geosetter_setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.DisclaimerThis software is provided "as-is". No warranty of any kind is expressed or implied. You use at your own risk. The author will not be liable for data loss damages loss of profits or any other kind of loss while using or misusing this software.FreewareThis program is freeware - that means you can download and copy it. You can even use it for commercial purposes however the sale of this software is prohibited.If you are an editor and wish to include GeoSetter on a magazine's CD or DVD please contact me.I &accept the agreementI &do not accept the agreement&Next >Cancel
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.DisclaimerThis software is provided "as-is". No warranty of any kind is expressed or implied. You use at your own risk. The author will not be liable for data loss damages loss of profits or any other kind of loss while using or misusing this software.FreewareThis program is freeware - that means you can download and copy it. You can even use it for commercial purposes however the sale of this software is prohibited.If you are an editor and wish to include GeoSetter on a magazine's CD or DVD please contact me.I &accept the agreementI &do not accept the agreement&Next >Cancel

Source: unknown

HTTPS traffic detected: 130.15.24.27:443 -> 192.168.2.5:49980 version: TLS 1.2

Source: geosetter_setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00476120 FindFirstFileA,FindNextFileA,FindClose,	1_2_00476120
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004531A4 FindFirstFileA,GetLastError,	1_2_004531A4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004648D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004648D0
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00464D4C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464D4C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00463344 FindFirstFileA,FindNextFileA,FindClose,	1_2_00463344
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0049998C FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0049998C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC0AEB0 win32_opendir,strlen,Perl_safesyscalloc,strcpy,MultiByteToWideChar,Perl_get_context,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,strlen,Perl_safesysmalloc,strcpy,GetLastError,_errno,WideCharToMultiByte,_errno,_errno,Perl_safesysfree,_errno,_errno,	15_2_6DC0AEB0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC0BB70 win32_longpath,strcpy,FindFirstFileA,strcpy,FindClose,_errno,FindClose,_errno,	15_2_6DC0BB70
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_70845F80 PL_charclass,wcscpy,FindFirstFileW,wcslen,wcscpy,FindClose,_errno,FindClose,_errno,toupper,	15_2_70845F80
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_70845BA0 PL_charclass,_mbscpy,FindFirstFileA,_mbscpy,FindClose,toupper,_errno,FindClose,_errno,	15_2_70845BA0

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Code function: 15_2_6560A76C Perl_get_context,Perl_get_context,Perl_get_context,GetLogicalDriveStringsA,Perl_get_context,Perl_get_context,Perl_get_context,Perl_get_context,Perl_get_context,Perl_sv_newmortal,Perl_get_context,Perl_sv_setuv,Perl_get_context,Perl_get_context,Perl_get_context,Perl_get_context,Perl_get_context,

15_2_6560A76C

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Code function: 4x nop then mov eax, dword ptr [esp+04h]

15_2_6DC22F60

Networking

Queries Google from non browser process on port 80

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	HTTP traffic: GET /v3/map_google.html HTTP/1.1 Accept: / Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	HTTP traffic: GET /v3/json3.js HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	HTTP traffic: GET /v3/leaflet/leaflet.css HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	HTTP traffic: GET /v3/leaflet/leaflet.js HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Origin: http://map.geosetter.de Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	HTTP traffic: GET /v3/img/crosshair.gif HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: DE-WEBGOwwwwebgodeDE DE-WEBGOwwwwebgodeDE

Source: Joe Sandbox View

JA3 fingerprint: b22b3950835f7eba2f3be0917e4f949e

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.5:49918

Source: global traffic	HTTP traffic detected: GET /~phil/exiftool/rss.xml HTTP/1.1Pragma: no-cacheHost: owl.phy.queensu.caAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)
Source: global traffic	HTTP traffic detected: GET /v3/map_google.html HTTP/1.1Accept: /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/json3.js HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/leaflet/leaflet.css HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/leaflet/leaflet.js HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Origin: http://map.geosetter.deAccept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/img/crosshair.gif HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Code function: 15_2_6DC12390 win32_recvfrom,_get_osfhandle,recvfrom,win32_getpeername,WSAGetLastError,_errno,SetLastError,

15_2_6DC12390

Source: global traffic	HTTP traffic detected: GET /~phil/exiftool/rss.xml HTTP/1.1Pragma: no-cacheHost: owl.phy.queensu.caAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)
Source: global traffic	HTTP traffic detected: GET /v3/map_google.html HTTP/1.1Accept: /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/json3.js HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/leaflet/leaflet.css HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/leaflet/leaflet.js HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Origin: http://map.geosetter.deAccept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/img/crosshair.gif HTTP/1.1Accept: /Referer: http://map.geosetter.de/v3/map_google.htmlAccept-Language: en-CHUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)Accept-Encoding: gzip, deflateHost: map.geosetter.deConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: map.geosetter.de
Source: global traffic	DNS traffic detected: DNS query: owl.phy.queensu.ca

Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://abc.net.au/local/news/olympics/1999/07/item19990728112314_1.ht
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://abc.net.au/news/olympics/1999/06/item19990601114608_1.htm
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://abc.net.au/news/olympics/1999/07/item19990719151754_1.htm
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://abc.net.au/news/regionals/brokenh/monthly/regbrok-21jul1999-6.htm
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://abc.net.au/news/regionals/neweng/monthly/regeng-22jul1999-1.ht
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://actualidad.terra.es/sociedad/articulo/cuba_llama_ahorrar_energia_cambio_1957044.htm
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aif.az/docs/daylight_res.pdf
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://allafrica.com/stories/200703300178.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://almanakka.helsinki.fi/aikakirja/Aikakirja2007kokonaan.pdf
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://api.geonames.org
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ar.clarin.com/diario/2001-06-06/e-01701.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ar.clarin.com/diario/2001-06-06/e-01701.htmZ
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ar.clarin.com/diario/2001-06-12/s-03501.htm
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://arabic.pnn.ps/index.php?option=com_content&task=view&id=508
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://arabic.pnn.ps/index.php?option=com_content&task=view&id=50850
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bdnews24.com/details.php?id=85889&cid=2
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bdnews24.com/details.php?id=85889&cid=H
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bdnews24.com/details.php?id=85889&cid=H#
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bmockbe.ru/events/?ID=7583
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://bsalsa.com/
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=4150
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cl.invertia.com/noticias/noticia.aspx?idNoticia=200801171849_EFE_ET4373&idtel
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://club.telepolis.com/silverpointdev/sptbxlib/
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dailymailnews.com/200808/28/news/dmbrn03.htH
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dailymailnews.com/200808/28/news/dmbrn03.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://diario.elmercurio.com/2011/03/28/_portada/_portada/noticias/7565897A-CA86-49E6-9E03-660B21A48
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dir.gis.nsw.gov.au/cgi-bin/genobject/document/other/daylightsaving/tigGmZ
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://earth.google.com/kml/2.1
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://eng.gateway.kg/cgi-bin/page.pl?id=1&story_name=doc9979.shtml
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://english.pnn.ps/index.php?option=com_content&task=view&id=596&Itemid
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://english.pnn.ps/index.php?option=com_content&task=view&id=596&Itemid=5
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://english.pnn.ps/index.php?option=com_content&task=view&id=596&Itemid=5Z
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://eros.usgs.gov/#/Find_Data/Products_and_Data_Available/gtopo30_info
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://etan.org/et99c/december/26-31/30ETMAY.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000L0084:EN:NOT
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://g1.globo.com/bahia/noticia/2011/10/governador-jaques-wagner-confirma-horario-de-verao-na-bahi
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.no.net/janmayen/history.htm
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://in.reuters.com/article/southAsiaNews/idINIndia-40017620090601
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://in.reuters.com/article/southAsiaNews/idINIndia-400176200906d
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://inms-ienm.nrc-cnrc.gc.ca/images/time_services/TZ01SSE.j
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://inms-ienm.nrc-cnrc.gc.ca/images/time_services/TZ01SWE.j
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jornale.com.br/index.php?option=com_content&task=view&id=13530&Itemid=54
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jornale.com.br/index.php?option=com_content&task=view&id=13530&Itemid=5t%
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://madExcept.com
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://madExcept.comU
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://map.geosetter.de/v3/map_google.html
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://map.geosetter.de/v3/map_google.htmlSV
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://maps.google.com
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://media.enet.cu/radioreloj
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://media.enet.cu/radiorelot
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://met.no/met/met_lex/q_u/sommertid.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://midena.gov.ec/content/view/1261/208/
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://naviny.by/rubrics/society/2011/09/16/ic_articles_116_175144/
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://news.mail.ru/politics/6861560/
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://news.sinhalaya.com/wmview.php?ArtID=11002
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://news.tut.by/society/250578.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://newspot.byegm.gov.tr/arsiv/1996/21/N4.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://noticias.terra.com.br/brasil/noticias/0
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://palvoice.org/forums/showthread.php?t=245697
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DEC3592.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/Dec3630.jpg
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/Dec3632.jpg
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DecHV.h$#
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DecHV.html
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DecHV5539.gif
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DecHV5920.gif
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DecHV6212.gif
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/DecHV99.gif
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/Fusbr.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/Fusbrhv.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HISTHV.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV1252.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV1636.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV1674.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV1991.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV1992.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV2000.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV20466.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV21896.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV23195.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV27496.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV27998.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV32308.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV34724.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV52700.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV53071.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV53604.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV55639.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV57303.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV57843.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV63429.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV91698.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV942.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV94922.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV96676.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV98077.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/HV99530.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/figuras/HV2495.JPG
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/figuras/HV3150.gif
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/figuras/HV3916.gif
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/figuras/Hv98.jpg
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcdsh01.on.br/verao1.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petra.gov.jo/Artical.aspx?Lng=2&Section=8&Artical=95279
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://portal.rada.gov.ua/rada/control/en/publish/article/info_left?art_id=287324&cat_id=105995
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rega.basbakanlik.gov.tr/eskiler/2007/03/20070307-7.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ru.publika.md/link_317061.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sana.sy/ara/2/2008/10/07/195459.htm
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sns.sy/sns/?path=news/read/11421
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://star.arabia.com/990701/JO9.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://star.arabia.com/990930/JO9.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://story.philippinetimes.com/p.x/ct/9/id/145be20cc6b121c0/cid/3e5bbccc730d258c/
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://student.cusu.cam.ac.uk/~jsm28/british-time/
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://student.cusu.cam.ac.uk/~jsm28/british-time/bbc-19410418.png
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://student.cusu.cam.ac.uk/~jsm28/british-time/ho-19410421.
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://student.cusu.cam.ac.uk/~jsm28/british-time/ho-19410421.png
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://student.cusu.cam.ac.uk/~jsm28/british-timeT
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://thawra.alwehda.gov.sy/_View_news2.asp?FileName=94459258720090318012209
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://tile.stamen.com/terrain-background
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://tile.stamen.com/terrain-backgroundSVW
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://today.reuters.co.uk/news/newsArticle.aspx?type=scienceNews&storyID=2006-04-12T172228Z_01_COL2
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://toi.iriti.cnr.it/uk/ienitlt.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://trip.rk.ee/cgi-bin/thw?$
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ubpost.mongolnews.mn/index.php?subaction=showcomments&id=1111634894&archive=&start_from=&ucat
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483542296.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://uk.reuters.com/article/oilRpt/idUKBLA65048420070916
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://w1.c1.rada.gov.ua/pls/zweb_n/webproc4_1?id=&pf3511=41484
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wehda.alwehda.gov.sy/_print_veiw.asp?FileName=12521710520070926111247
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ws.geonames.net
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ws.geonames.net/viewAccount?username=%s&token=%s
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ws.geonames.net/viewAccount?username=%s&token=%sSV
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.abc.com.pl/serwis/mp/1995/0162.hp)
Source: GeoSetter.exe, 00000007.00000003.2485048789.0000000009610000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.abc.com.pl/serwis/mp/1995/0162.htm
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.abcnews.go.com/International/wireStory?id=56760
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.abcnews.go.com/International/wireStory?id=5676087
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.aljeeran.net/wesima_articles/news-20080305-98602.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.allmoldova.com/moldova-news/1249064116.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.alomaliye.com/bkk_2002_3769.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apakistannews.com/govt-withdraws-plan-to-advance-clocks-172041
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apakistannews.com/govt-withdraws-plan-to-advance-clocks-172T6
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=73043&Itemid=
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=73043&Itemid=1
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=73043&Itemid=1P%
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=86715&Itemid=
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=86715&Itemid=2
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=86715&Itemid=2x
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=99374&Itemid=
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.app.com.pk/en_/index.php?option=com_content&task=view&id=99374&Itemid=2
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.arabtimesonline.com/arabtimes/kuwait/Viewdet.asp?ID=9950
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.argentina.gob.ar/argentina/portal/paginas.dhtml?pagina=356
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.asiantribune.com/?q=node/17288
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.astro.com/atlas
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.astro.uni.torun.pl/~kb/Artykuly/U-PA/Czas2.htm#tth_tAb
Source: GeoSetter.exe, 00000007.00000003.2485048789.0000000009610000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.astro.uni.torun.pl/~kb/Artykuly/U-PA/Czas2.htm#tth_tAb1
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.aswataliraq.info/look/article.tpl?id=2047&IdLanguage=17&IdPublication=4&NrArticle=71743&N
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baltictimes.com/
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.bartleby.com/65/sv/Svalbard.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.belta.by/ru/all_news/society/V-Belarusi-otmenjaetsja-perexod-na-sezonnoe-vremja_i_572952.
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.boletinoficial.gov.ar/Bora.Portal/CustomControls/PdfContent.aspx?fp=16102008&pi=3&pf=4&s=
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.boletinoficial.gov.ar/Bora.Portal/CustomControls/PdfContent.aspx?fp=17102008&pi=1&pf=1&s=
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.bom.gov.au/climate/averages/tables/dst_times.shtml
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.bom.gov.au/faq/faqgen.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.byegm.gov.tr/YAYINLARIMIZ/CHR/ING2000/03/00X03X06.HTM#%2021
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.byegm.gov.tr/YAYINLARIMIZ/CHR/ING2001/03/23x03x01.HTM#%2027
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.byegm.gov.tr/YAYINLARIMIZ/CHR/ING97/03/97X03X25.TXT
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.byegm.gov.tr/YAYINLARIMIZ/CHR/ING98/03/98X03X02.HTM
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.byegm.gov.tr/YAYINLARIMIZ/CHR/ING99/10/99X10X26.HTM#%2016
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.canadiangeographic.ca/Magazine/SO98/geomap.
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cddhcu.gob.mx/bibliot/publica/inveyana/polisoc/horver/(
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.clarin.com.ar/diario/2001-06-22/s-03601.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.clarin.com.ar/diario/2001-06-22/s-03601.htmV
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cwb.gov.tw/V6/astronomy/cdata/summert.h
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cwb.gov.tw/V6/astronomy/cdata/summert.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dailytimes.com.pk/default.asp?page=2008%5C05%5C15%5Cstory_15-5-2008_pg1
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dailytimes.com.pk/default.asp?page=2008%5C05%5C15%5Cstory_15-5-2008_pg1_4
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dawn.com/2002/10/06/top13.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dawn.com/2003/03/07/top15.T
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dawn.com/2003/03/07/top15.htm
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.delphizip.org
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dhm.de/lemo/html/biografien/BersarinNikolai/
Source: GeoSetter.exe, 00000007.00000003.2484591039.0000000009613000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dia.govt.nz/diawebsite.nsf/wpg_URL/Services-Daylight-Saving-Daylight-saving-to-be-exten
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.diariocolatino.com/internacionales/detalles.asp?NewsID=8079
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.diarionoticias.com.py/011000/nacional/naciona1.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.diputadossanluis.gov.ar/diputadosasp/paginas/verNorma.asp?NormaID=276
Source: geosetter_setup.tmp, 00000001.00000003.2459216915.00000000021E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dlapr.lib.az.us/links/daylight.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.eldiariodelarepublica.com/index.php?option=com_content&task=view&id=29383&Itemid=9
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elnuevodiario.com.ni/2006/05/01/nacionales/1841
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.elta.lt/
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.emol.com/noticias/nacional/detalle/detallenoticias.asp?idnoticia=467651
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.eznis.com/Container.jsp?id=
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.eznis.com/Container.jsp?id=112
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2487531261.0000000009612000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.falklandnews.com/public/story.cfm?get=5914&source=3
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.famfamfam.com
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fiji.gov.fj/index.php?option=com_content&view=article&id=1096:3310-cabinet-approves-chang
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fjysgl.gov.cn/show.aspx?id=2379&cid
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fjysgl.gov.cn/show.aspx?id=2379&cid=39
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fjysgl.gov.cn/show.aspx?id=2379&cid=39t
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.friedemann-schmidt.com/geosetter/gmap21.html
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geonames.org
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geonames.org/account
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geonames.org/login
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geonames.org/services.html
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de
Source: geosetter_setup.exe, 00000000.00000003.2053065082.00000000020A4000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.exe, 00000000.00000003.2461969425.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.tmp, 00000001.00000003.2054977128.00000000021CC000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.tmp, 00000001.00000003.2458860762.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.tmp, 00000001.00000003.2459808738.00000000021D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.geosetter.de&
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de/donation-de/
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de/donation-de/openhttp://www.geosetter.de/en/donation-en/S
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de/en/donation-en/
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de/geosetter_beta.exeU
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de/languages/
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.de4http://www.geosetter.de/en
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.deDhttp://www.geosetter.de/changes-de4http://www.geosetter.de/enJhttp://www.geo
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.geosetter.deTPF0
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.globovision.com/news.php?nid=72208
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gobernac.mendoza.gov.ar/boletin/pdf/20040521-27158-normas.pdf
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gobernac.mendoza.gov.ar/boletin/pdf/20040924-27244-normas.pdf
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gobiernodechile.cl/viewNoticia.aspx?idArticulo=3009
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gobiernodechile.cl/viewNoticia.aspx?idArticulo=30098
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.google.com/kml/ext/2.2
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gov.mu/portal/goc/assemblysite/file/bill2708.pd
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2482907104.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gov.mu/portal/goc/assemblysite/file/bill2708.pdf
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2482907104.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gov.mu/portal/site/pmosite/menuitem.4ca0efdee47462e7440a600248a521ca/?content_id=4728ca68
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gov.on.ca/MBS/english/publications/statregs/conttext.html
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gov.yk.ca/legislation/regs/oic1987_056.0
Source: GeoSetter.exe, 00000007.00000003.2485171150.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486091069.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.government.ru/content/governmentactivity/rfgovernmentdecisions/archiv
Source: GeoSetter.exe, 00000007.00000003.2485171150.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486091069.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.government.ru/content/governmentactivity/rfgovernmentdecisions/archive/2009/09/14/991633.
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.gpsbabel.org
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.granma.cu/espanol/2005/noviembre/mier9/horario.html
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.granma.cu/ingles/2004/septiembre/juev30/41medid-i.h
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.granma.cu/ingles/2006/octubre/lun16/43horario.h
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.granma.cubaweb.cu/2007/10/24/nacional/artic07.h
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.granma.cubaweb.cu/english/news/art89.html
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.guardian.co.uk/world/feedarticle/775900
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.guardian.co.uk/world/feedarticle/7759001
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hko.gov.hk/gts/time/Summertime.
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hko.gov.hk/gts/time/Summertime.htm
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hko.gov.hk/gts/time/Summertime.htmH
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hko.gov.hk/gts/time/Summertime.htmH7
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.horaoficial.cl/cambio.h
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.horaoficial.cl/cambio.hP
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.horaoficial.cl/cambio.hp
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.horaoficial.cl/cambio.htm
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.horaoficial.cl/horaof.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hoy.com.ec/NoticiaNue.asp?row_id=249856
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hri.org/news/world/undh/last/00-08-16.undh.htmD
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hri.org/news/world/undh/last/00-08-16.undh.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hum.aau.dk/~poe/tid/tine/DanskTid.htm
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hup.harvard.edu/catalog/HEISUN.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hurriyet.com.tr/ekonomi/17230464.asp?gid=373
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iht.com/articles/ap/2007/03/29/africa/ME-GEN-Syria-Time-Change.php
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.in.gov.br/visualiza/index.jsp?data=13/10/2011&jornal=1000&pagina=6&totalArquivos=6
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.in.gov.br/visualiza/index.jsp?data=13/10/2011&jornal=1000&pagina=6&totalArquivos=60
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: geosetter_setup.tmp, geosetter_setup.tmp, 00000001.00000000.2054211311.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.irishstatutebook.ie/ZZA13Y1923.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483542296.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.irna.ir/en/news/view/line-17/0603193812164948.h
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.irna.ir/en/news/view/line-17/0603193812164948.htm
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.japantimes.co.jp/cgi-bin/getarticle.pl5?nn20050810f2.htm
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jonesbahamas.com/?c=45&a=10
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jpost.com/MiddleEast/Article.aspx?id=235650
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jpost.com/com/Archive/22.Apr.1999/Opinion/Article-2.html
Source: geosetter_setup.exe, geosetter_setup.exe, 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: geosetter_setup.exe, 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.jrsoftware.org/isinfo.php
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jujuy.gov.ar/index2/partes_prensa/18_10_08/235-181008.doc
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kazsociety.org.uk/news/2005/03/30.htm
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.koreaherald.co.kr/SITE/data/html_dir/2006/07/10/200607100012.asp
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kyivpost.ua/russia/news/pridnestrove-otkazalos-ot-perehoda-na-zimnee-vremya-30954.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lagaceta.com.ar/vernotae.asp?id_nota=253414
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lanacion.com.ar/04/05/27/de_604825.asp
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lanacion.com.ar/04/05/28/de_605203.asp
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lanacion.com.ar/04/06/10/de_609078.asp
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lanacion.com.ar/nota.asp?nota_id=1107912
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lapalmainteractivo.com/guias/content/gen/ap/America_Latina/AMC_GEN_NICARAGUA_HORA.h
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2482907104.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lexpress.mu/display_article.php?news_id=111216
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lexpress.mu/display_article.php?news_id=111X
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.com
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.com/api
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.com/photo/album/albums.php?album_id=%s
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.com/user/my_page/my_photos_edit.php
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.com/user/my_page/my_photos_edit.phpopen
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.com/user_create.php
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.locr.comTPF0
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lovdata.no/all/nl-18940629-001.html
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lovdata.no/all/nl-19250717-011.html
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lovdata.no/all/nl-19300227-002.html).
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lrvk.lt/nut/11/n1749.ht
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lrvk.lt/nut/11/n1749.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lv-laiks.lv/wwwraksti/2000/071072/vd4.htm
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.maannews.net/eng/ViewDetails.aspx?ID=271178
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.maannews.net/eng/ViewDetails.aspx?ID=306795
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.maannews.net/eng/ViewDetails.aspx?ID=416217
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.maannews.net/eng/ViewDetails.aspx?ID=424808
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.madshi.net
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.manilastandardtoday.com/?page=politics02_april26_2006
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.math.nus.edu.sg/aslaksen/teaching/timezone.html
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mcil.gov.ws/mcil_publications.h
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mme.gov.br/firs
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mme.gov.br/first
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mme.gov.br/site/news/detail.do;jsessionid=BBA06811AFCAAC28F0285210913513DA?newsId=13975
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mme.gov.br/site/news/detail.do;jsessionid=BBA06811AFCAAC28F0285210913513DA?newsId=139750
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mme.gov.br/site/news/detail.do?newsId=1672
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mme.gov.br/site/news/detail.do?newsId=16722
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.moi.gov.ps/en/?page=633167343250594025&nid=11505
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mongoliatourism.gov.mn/general.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mongolnews.mn/index.php?module=unuudur&sec=view&id=1574$
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mongolnews.mn/index.php?module=unuudur&sec=view&id=15742
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.morningstar.co.uk/uk/markets/newsfeeditem.aspx?id=1385019583479
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.mustangpeak.net
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.mytopo.com
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.news.lk/
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nineoclock.ro/POL/1778pol.html
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nnc.cubaweb.cu/marzo-2008/cien-1-11-3-08.ht
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nnc.cubaweb.cu/marzo-2008/cien-1-11-3-08.htm
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nnsl.com/frames/newspapers/2006-11/nov13_06none.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ntvmsnbc.com/news/402029.asp
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nunatsiaq.com/archives/nunavut001130/nvt21110_02.html
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nunatsiaq.com/archives/nunavut991130/nvt91119_17.html
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nunatsiaq.com/nunavut/nvt10309_06.html
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nunatsiaq.com/nunavut/nvt90903_13.html
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nunavut.com/basicfacts/english/basicfacts_1territory.html
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openstreetmap.org
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pak.gov.pk/public/news/app/app06_dec.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pak.gov.pk/public/news/app/app06_dec.htp
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.parlament-berlin.de/pds-fraktion.nsf/727459127c8b66ee8525662300459099/defc77cb784f180ac12
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.parliament.the-stationery-office.co.uk/pa/ld199697/ldhansrd/pdvn/lds97/text/70611-20.htm#
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.petranews.gov.jo/nepras/2006/Sep/05/4000.htm
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.petranews.gov.jo/nepras/2006/Sep/05/4000.htmN
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pettswoodvillage.co.uk/Daylight_Savings_William_Willett.pdf
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/idl/idl.htm
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/wettijd/wettijd.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.planalto.gov.br/ccivil_03/_Ato2004-2006/2004/Decreto/D5223.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.planalto.gov.br/ccivil_03/_Ato2007-2010/2008/Decreto/D6558.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pravda.com.ua/rus/news/2011/09/20/6600616/
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.prensalatina.com.mx/article.asp?ID=%7B4CC32C1B-A9F7-42FB-8A07-8631AFC923AF%7D&language=D)
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gob.ni/Presidencia/Files_index/Secretaria/Notas%20de%20Prensa/Presidente/2005
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gob.ni/buscador_gaceta/BD/DECRETOS/2005/Decreto%2023-2005%20Se%20adelanta%20e
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gob.ni/presidencia/files_index/secretaria/comunicados/2005/septiembre/26septi
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gov.br/CCIVIL/decreto/2002/D4399.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gov.br/CCIVIL/decreto/2003/D4844.htm
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gov.py/decretos/D1867.pdf
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gov.py/v1/wp-content/uploads/2010/02/decreto3958.pd
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gov.py/v1/wp-content/uploads/2010/02/decreto3958.pdf
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gub.uy/_Web/decretos/2005/09/CM%20119_09%2009%202005_00001.PDF
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gub.uy/_Web/noticias/2005/03/2005031005.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gub.uy/_web/decretos/2006/09/CM%20210_08%2006%202006_00001.PDF
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.presidencia.gub.uy/decretos/2004091502.htm
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ptb.de/de/org/4/44/441/salt.htm
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.qp.gov.sk.ca/documents/English/Statutes/Statutes/T14.pd
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.radiohc.cu/espanol/noticias/mar07/11mar/hor.htD2
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.radiohc.cu/espanol/noticias/mar07/11mar/hor.htD2O
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.radiohc.cu/espanol/noticias/mar07/11mar/hor.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.regnum.ru/news/polit/1413906.html
Source: geosetter_setup.exe, 00000000.00000003.2053379279.0000000002470000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.exe, 00000000.00000003.2053568971.00000000020EC000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.tmp, geosetter_setup.tmp, 00000001.00000000.2054211311.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: geosetter_setup.exe, 00000000.00000003.2053379279.0000000002470000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.exe, 00000000.00000003.2053568971.00000000020EC000.00000004.00001000.00020000.00000000.sdmp, geosetter_setup.tmp, 00000001.00000000.2054211311.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.retsinfo.dk/_GETDOCI_/ACCN/A18930008330-REGL
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.retsinfo.dk/_GETDOCI_/ACCN/A19722110030-REGL
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.retsinfo.dk/_GETDOCI_/ACCN/A19740022330-REGL
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.retsinfo.dk/_GETDOCI_/ACCN/C19801120554-REGL
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.rferl.org/newsline/2001/01/3-CEE/cee-030101.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.riksdagen.se/english/work/sfst.asp
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.safa.ps/ara/?action=showdetail&seid=4158
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sana.sy/ara/2/2009/09/29/247012.htm
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sana.sy/eng/21/2008/03/11/165173.htm
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sana.sy/eng/21/2008/03/11/165173.htmZ
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sana.sy/eng/21/2009/03/17/217563.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanjuan.gov.ar/prensa/archivo/000329.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanjuan.gov.ar/prensa/archivo/000426.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanjuan.gov.ar/prensa/archivo/000441.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanluis.gov.ar
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanluis.gov.ar/SL/Paginas/NoticiaDetalle.asp?TemaId=1&InfoPrensaId=3102
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanluis.gov.ar/notas.asp?idCanal=0&id=22812
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sanluis.gov.ar/notas.asp?idCanal=8141&id=22834
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.segodnya.ua/news/14290482.html
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.senat.gov.pl/k5/dok/sejm/053/2180.pdf
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.shoa.cl/noticias/2008/04hora/hora.hp
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.shoa.cl/noticias/2008/04hora/hora.htm
Source: GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.shoa.cl/servicios/supremo316.pd
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.shoa.cl/servicios/supremo316.pdf
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.shrine.org.
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sieca.org.gt/Sitio_publico/Energeticos/Doc/Medidas/Cambio_Horario_Nac_190406.pdf
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.smh.com.au/news/9905/26/pageone/pageone4.html
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.sno.phy.queensu.ca/~phil/exiftool/
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spicasc.net/horvera.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.statkart.no/efs/efshefter/2001/efs5-2001.pdf
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sumatera-inc.com/go_to_invest/about_indonesia.asp#standtim
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sumatera-inc.com/go_to_invest/about_indonesia.asp#standtime
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.svalbard.com/SvalbardFAQ.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thaindian.com/newsportal/business/bangladesh-to-continue-indefinitely-with-advanced-time_
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.thany.org/
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.theage.com.au/news/national/daylight-savings-to-span-six-months/2007/06/27/1182623966703.
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/latest_news.php?nid=2281
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/latest_news.php?nid=22817
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/news-details.php?nid=107021
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/news-details.php?nid=107P
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/news-details.php?nid=107P_M#
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/news-details.php?nid=119228
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedailystar.net/newDesign/news-details.php?nid=119P
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thelaw.tas.gov.au/fragview/42
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/daily_detail.asp?id=17120#
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/daily_detail.asp?id=171280
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/top_story_detail.asp?Id=2474
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/top_story_detail.asp?Id=24742
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/updates.asp?id=8716
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/updates.asp?id=87168
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thenews.com.pk/updates.asp?id=87168L)
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.theroyalgazette.com/apps/pbcs.dll/article?AID=/20060529/NEWS/105290P0
Source: GeoSetter.exe, 00000007.00000003.2486867873.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.theroyalgazette.com/apps/pbcs.dll/article?AID=/20060529/NEWS/105290P0;(#
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/bangladesh-daylight-saving-2009.h
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/bangladesh-daylight-saving-2009.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/bangladesh-daylight-saving-2009.htmld
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/brazil-dst-2008-2009.htm
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/brazil-dst-2008-2009.html
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/cuba-starts-dst-march-16.html
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/cuba-starts-dst-march-16.htmt/
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/cuba-starts-dst-march-16.htmt/WD#
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/fiji-dst-ends-march-2010.htm
Source: GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/fiji-dst-ends-march-2010.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/iraq-dumps-daylight-saving.html
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/pakistan-ends-dst09.h
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/pakistan-ends-dst09.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/palestine-dst-2011.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/syria-dst-starts-march-27-2009.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/westbank-gaza-dst-2009.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/news/time/westbank-gaza-end-dst-2010.html
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/worldclock/city.html?n=102
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/worldclock/city.html?n=1026
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/worldclock/timezone.html?n=107
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/worldclock/timezone.html?n=11
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.timeanddate.com/worldclock/timezone.html?n=116
Source: GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tongatapu.net.to/tonga/homeland/timebegins.htm
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tourism.lt/informa/ff.htm
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.turksandcaicos.tc/calendar/index.htm
Source: GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ucalgary.ca/UofC/departments/UP/1-55238/1-55238-110-2.html
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.uphere.ca/node/4938R
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.uphere.ca/node/4938R/
Source: GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.uphere.ca/node/dR
Source: GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winstonchurchill.org/fh114willett.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldbulletin.net/?aType=haber&ArticleID=70872
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimeserver.com/current_time_in_MN.aspL
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimeserver.com/current_time_in_MN.aspx
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.c.
Source: GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/brazil-time-new-old.p
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/brazil-time-new-old.php
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_argentina08.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh02.htP
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh02.htP_L#
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh02.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh04.ht
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh04.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh05.ht$
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh05.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh06.ht
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_bangladesh06.html
Source: GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_cuba03.html8
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_gazastrip01.htm
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_gazastrip01.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_gazastrip02.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_gazastrip05.html
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_mauritius02.htm
Source: GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2482907104.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_mauritius02.html
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_pakistan02.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_pakistan02.html
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_pakistan05.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_pakistan05.html
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_pakistan07.D
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_pakistan07.htm
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486091069.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_russia03.html
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_westbank01.htmX3
Source: GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_westbank01.htmX3K9#
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_westbank01.html
Source: GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.com/dst_news/dst_news_westbank03.html
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.net/dst_news/dst_news_argentina02.html
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.net/dst_news/dst_news_pakistan01.htm
Source: GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.worldtimezone.net/dst_news/dst_news_pakistan01.html
Source: GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.yle.fi/elavaarkisto/?s=s&g=1&ag=5&t=&a=3401
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zoomin.de
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zoomin.de/hilfe/spezielle-funktionen/geosetter/
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zoomin.de/hilfe/spezielle-funktionen/geosetter/openU
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zoomin.de/registrieren
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zoomin.deopen
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.zoomin.deopenU
Source: GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www2.jpl.nasa.gov/srtm/
Source: GeoSetter.exe, 00000007.00000003.2517124090.0000000008D6F000.00000004.00000020.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2549685981.000000000A5D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://leafletjs.com
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://owl.phy.queensu.ca/~phil/exiftool/rss.xml
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/proxytest.dat
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/proxytest.datU
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/languages/
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/languages/versions
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_beta
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_beta_release_date
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_locr
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_locr_release_date
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_release_date
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_release_dateU
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_zoomin
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.geosetter.de/update/version_zoomin_release_date
Source: GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.in.gov.br/imprensa/visualiza/index.jsp?jornal=do&secao=1&pagina=1&data=25/04/2008

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443

Source: unknown

HTTPS traffic detected: 130.15.24.27:443 -> 192.168.2.5:49980 version: TLS 1.2

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00423FD4 NtdllDefWindowProc_A,	1_2_00423FD4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00412A28 NtdllDefWindowProc_A,	1_2_00412A28
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0042F9C0 NtdllDefWindowProc_A,	1_2_0042F9C0
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00479D08 NtdllDefWindowProc_A,	1_2_00479D08
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00457D90 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00457D90

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_0042ED84: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042ED84

Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_004098E8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_004098E8
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00455D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_00455D80

Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_00408888	0_2_00408888
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00468034	1_2_00468034
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00471688	1_2_00471688
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00488030	1_2_00488030
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0046A088	1_2_0046A088
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00452100	1_2_00452100
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0043E1F0	1_2_0043E1F0
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004307FC	1_2_004307FC
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00444968	1_2_00444968
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00434A64	1_2_00434A64
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00444F10	1_2_00444F10
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00488F90	1_2_00488F90
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00431388	1_2_00431388
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00445608	1_2_00445608
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0048F6BC	1_2_0048F6BC
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00435768	1_2_00435768
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0045F8C0	1_2_0045F8C0
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0045B970	1_2_0045B970
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00445A14	1_2_00445A14
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Code function: 9_2_00402C00	9_2_00402C00
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Code function: 9_2_00401560	9_2_00401560
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_00404580	15_2_00404580
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62D841C0	15_2_62D841C0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62D89890	15_2_62D89890
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62D84DAC	15_2_62D84DAC
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_65601B39	15_2_65601B39
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A0E690	15_2_66A0E690
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A014C0	15_2_66A014C0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A100D9	15_2_66A100D9
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A0F868	15_2_66A0F868
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A0D475	15_2_66A0D475
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A0A5C0	15_2_66A0A5C0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A06F21	15_2_66A06F21
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAEEDC0	15_2_6DAEEDC0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBAAD50	15_2_6DBAAD50
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB86CF2	15_2_6DB86CF2
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAF4CF0	15_2_6DAF4CF0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DACAC25	15_2_6DACAC25
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAF2C6B	15_2_6DAF2C6B
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DADAC7B	15_2_6DADAC7B
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB14F89	15_2_6DB14F89
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC0CF20	15_2_6DC0CF20
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC1CF30	15_2_6DC1CF30
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE6F5C	15_2_6DAE6F5C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE2E70	15_2_6DAE2E70
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB8A91D	15_2_6DB8A91D
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB148B3	15_2_6DB148B3
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBBE870	15_2_6DBBE870
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBC2BA0	15_2_6DBC2BA0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBBCBE0	15_2_6DBBCBE0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE6B20	15_2_6DAE6B20
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAF2AB3	15_2_6DAF2AB3
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB04A95	15_2_6DB04A95
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBCC5A0	15_2_6DBCC5A0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBC2590	15_2_6DBC2590
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB1452B	15_2_6DB1452B
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAF849C	15_2_6DAF849C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB7C4F0	15_2_6DB7C4F0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAFE4E0	15_2_6DAFE4E0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAF24FA	15_2_6DAF24FA
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC164B0	15_2_6DC164B0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC12460	15_2_6DC12460
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB9A41B	15_2_6DB9A41B
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB3C36C	15_2_6DB3C36C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAF8693	15_2_6DAF8693
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAEC1D1	15_2_6DAEC1D1
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBCA130	15_2_6DBCA130
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB2C120	15_2_6DB2C120
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB0A100	15_2_6DB0A100
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE8140	15_2_6DAE8140
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB58142	15_2_6DB58142
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB3E0BC	15_2_6DB3E0BC
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBBE3C0	15_2_6DBBE3C0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB3C36C	15_2_6DB3C36C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBAC340	15_2_6DBAC340
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE42EC	15_2_6DAE42EC
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB082E0	15_2_6DB082E0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB32260	15_2_6DB32260
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB68260	15_2_6DB68260
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB3824C	15_2_6DB3824C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB2FC99	15_2_6DB2FC99
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB0BCD0	15_2_6DB0BCD0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBC5C00	15_2_6DBC5C00
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAEBF23	15_2_6DAEBF23
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB43EF0	15_2_6DB43EF0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAEBE30	15_2_6DAEBE30
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE5921	15_2_6DAE5921
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE794C	15_2_6DAE794C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE5952	15_2_6DAE5952
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE58BF	15_2_6DAE58BF
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE588E	15_2_6DAE588E
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAC98EC	15_2_6DAC98EC
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB518F0	15_2_6DB518F0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE58F0	15_2_6DAE58F0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBAF870	15_2_6DBAF870
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC13810	15_2_6DC13810
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE585D	15_2_6DAE585D
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB37B80	15_2_6DB37B80
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE9A90	15_2_6DAE9A90
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB43A50	15_2_6DB43A50
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAEF4BC	15_2_6DAEF4BC
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE74D0	15_2_6DAE74D0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE57AA	15_2_6DAE57AA
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAE57E9	15_2_6DAE57E9
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB3D7FA	15_2_6DB3D7FA
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB577C9	15_2_6DB577C9
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBB56F0	15_2_6DBB56F0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB35630	15_2_6DB35630
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB99600	15_2_6DB99600
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DACB18E	15_2_6DACB18E
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC25099	15_2_6DC25099
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DAFB0D8	15_2_6DAFB0D8
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC1D060	15_2_6DC1D060
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DB57069	15_2_6DB57069
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DBCD050	15_2_6DBCD050
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC152C0	15_2_6DC152C0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DACD22B	15_2_6DACD22B

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00446274 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 0040596C appears 114 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00453AAC appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 0043497C appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00458718 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00403400 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 0040905C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00407D44 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00446544 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 0045850C appears 100 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 0040357C appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00406F14 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: String function: 00403684 appears 229 times
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: String function: 6DC137D0 appears 35 times

Source: geosetter_setup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: geosetter_setup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: geosetter_setup.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-1BDNO.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-1BDNO.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-1BDNO.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-07QKO.tmp.1.dr	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped

Source: is-5LPT9.tmp.1.dr	Static PE information: Number of sections : 14 > 10
Source: is-LEN5V.tmp.1.dr	Static PE information: Number of sections : 11 > 10

Source: geosetter_setup.exe, 00000000.00000003.2053379279.0000000002470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs geosetter_setup.exe
Source: geosetter_setup.exe, 00000000.00000003.2053568971.00000000020EC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs geosetter_setup.exe

Source: geosetter_setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus24.evad.winEXE@26/1166@2/2

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Code function: 15_2_6DC0E060 win32_str_os_error,FormatMessageA,LocalAlloc,GetLastError,sprintf,Perl_get_context,Perl_sv_setpvn,LocalFree,

15_2_6DC0E060

Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_004098E8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_004098E8
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00455D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_00455D80
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_70843DEC Perl_sv_2pv_flags,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,LookupPrivilegeValueA,AdjustTokenPrivileges,AbortSystemShutdownA,AdjustTokenPrivileges,CloseHandle,Perl_newSViv,Perl_sv_2mortal,Perl_croak_nocontext,Perl_sv_2pv_flags,GetCurrentProcess,OpenProcessToken,Perl_sv_2pv_flags,Perl_sv_2iv_flags,Perl_sv_2iv_flags,Perl_sv_2iv_flags,InitiateSystemShutdownA,AdjustTokenPrivileges,CloseHandle,Perl_newSViv,Perl_sv_2mortal,LookupPrivilegeValueA,AdjustTokenPrivileges,Perl_croak_nocontext,Perl_sv_2pv_flags,IsValidSid,LookupAccountSidA,Perl_sv_2pv_flags,Perl_sv_setpv,Perl_sv_setpv,Perl_sv_setpv,Perl_sv_setiv,Perl_croak_nocontext,Perl_sv_2pv_flags,Perl_sv_2pv_flags,LookupAccountNameA,Perl_sv_setpv,Perl_sv_setpvn,Perl_sv_setiv,Perl_croak_nocontext,LoadLibraryA,GetProcAddress,Perl_stack_grow,Perl_newSViv,Perl_sv_2mortal,FreeLibrary,FreeLibrary,GetProcAddress,Perl_warn_nocontext,FreeLibrary,GetCurrentThread,GetCurrentProcess,Perl_safesysmalloc,Perl_safesysfree,CloseHandle,FreeLibrary,Perl_newSViv,Perl_sv_2mortal,Perl_warn_nocontext,Perl_warn_nocontext,Perl_safesysfree,CloseHandle,FreeLibrary,Perl_stack_grow,Perl_warn_nocontext,FreeLibrary,Perl_warn_nocontext,Perl_croak_nocontext,	15_2_70843DEC
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_708441EC InitiateSystemShutdownA,AdjustTokenPrivileges,CloseHandle,Perl_newSViv,Perl_sv_2mortal,	15_2_708441EC

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_004565A8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_004565A8

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_00456DD4 CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,

1_2_00456DD4

Source: C:\Users\user\Desktop\geosetter_setup.exe

Code function: 0_2_0040A0D4 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_0040A0D4

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

File created: C:\Program Files (x86)\GeoSetter

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4052:120:WilError_03
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$8fc
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Mutant created: NULL
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$8fc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_03
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Mutant created: \Sessions\1\BaseNamedObjects\GeoSetterStartOnlyOnce

Source: C:\Users\user\Desktop\geosetter_setup.exe

File created: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp

Jump to behavior

Source: Yara match	File source: 7.0.GeoSetter.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\GeoSetter\is-07QKO.tmp, type: DROPPED

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\geosetter_setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: geosetter_setup.exe

String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t

Source: C:\Users\user\Desktop\geosetter_setup.exe

File read: C:\Users\user\Desktop\geosetter_setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\geosetter_setup.exe "C:\Users\user\Desktop\geosetter_setup.exe"
Source: C:\Users\user\Desktop\geosetter_setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp "C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp" /SL5="$20442,24249229,57856,C:\Users\user\Desktop\geosetter_setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll"
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll"
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process created: C:\Program Files (x86)\GeoSetter\GeoSetter.exe "C:\Program Files (x86)\GeoSetter\GeoSetter.exe"
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -listx
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -listx
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -lang
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -lang
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -ver
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -ver
Source: C:\Users\user\Desktop\geosetter_setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp "C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp" /SL5="$20442,24249229,57856,C:\Users\user\Desktop\geosetter_setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process created: C:\Program Files (x86)\GeoSetter\GeoSetter.exe "C:\Program Files (x86)\GeoSetter\GeoSetter.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll"	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -listx	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -lang	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -ver	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -listx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -lang
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -ver

Source: C:\Users\user\Desktop\geosetter_setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\geosetter_setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: shunimpl.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: c_is2022.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: c_g18030.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: c_gsm7.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: c_iscii.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dcrawlib.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: perl524.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: perl524.dll
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: perl524.dll
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Section loaded: version.dll

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: GeoSetter.lnk.1.dr

LNK file: ..\..\..\..\..\..\Program Files (x86)\GeoSetter\GeoSetter.exe

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

File written: C:\Users\user\AppData\Roaming\GeoSetter\config.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Automated click: I accept the agreement
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Automated click: OK

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.DisclaimerThis software is provided "as-is". No warranty of any kind is expressed or implied. You use at your own risk. The author will not be liable for data loss damages loss of profits or any other kind of loss while using or misusing this software.FreewareThis program is freeware - that means you can download and copy it. You can even use it for commercial purposes however the sale of this software is prohibited.If you are an editor and wish to include GeoSetter on a magazine's CD or DVD please contact me.I &accept the agreementI &do not accept the agreement&Next >Cancel
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.DisclaimerThis software is provided "as-is". No warranty of any kind is expressed or implied. You use at your own risk. The author will not be liable for data loss damages loss of profits or any other kind of loss while using or misusing this software.FreewareThis program is freeware - that means you can download and copy it. You can even use it for commercial purposes however the sale of this software is prohibited.If you are an editor and wish to include GeoSetter on a magazine's CD or DVD please contact me.I &accept the agreementI &do not accept the agreement&Next >Cancel

Source: geosetter_setup.exe

Static file information: File size 24564453 > 1048576

Source: geosetter_setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_00450994 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450994

Source: is-5LPT9.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xbf086
Source: is-QSPTB.tmp.1.dr	Static PE information: real checksum: 0x1f64a3 should be: 0x8013a0
Source: is-V94I6.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x1dd75
Source: exiftool.exe.7.dr	Static PE information: real checksum: 0x1f64a3 should be: 0x8013a0
Source: is-KONM9.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x536fb
Source: geosetter_setup.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0xb33d1
Source: is-LEN5V.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x87192
Source: is-1BDNO.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0xbcd2a

Source: is-LEN5V.tmp.1.dr	Static PE information: section name: .stab
Source: is-LEN5V.tmp.1.dr	Static PE information: section name: .stabstr
Source: is-5LPT9.tmp.1.dr	Static PE information: section name: /4
Source: is-5LPT9.tmp.1.dr	Static PE information: section name: /16
Source: is-5LPT9.tmp.1.dr	Static PE information: section name: /30
Source: is-5LPT9.tmp.1.dr	Static PE information: section name: /42

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll"

Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_00406A18 push 00406A55h; ret	0_2_00406A4D
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_004093B4 push 004093E7h; ret	0_2_004093DF
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: 0_2_00408580 push ecx; mov dword ptr [esp], eax	0_2_00408585
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00409D9C push 00409DD9h; ret	1_2_00409DD1
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0041A078 push ecx; mov dword ptr [esp], ecx	1_2_0041A07D
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00452100 push ecx; mov dword ptr [esp], eax	1_2_00452105
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040A273 push ds; ret	1_2_0040A29D
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040A29F push ds; ret	1_2_0040A2A0
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00460518 push ecx; mov dword ptr [esp], ecx	1_2_0046051C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00496594 push ecx; mov dword ptr [esp], ecx	1_2_00496599
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004587B4 push 004587ECh; ret	1_2_004587E4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00410930 push ecx; mov dword ptr [esp], edx	1_2_00410935
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00486A94 push ecx; mov dword ptr [esp], ecx	1_2_00486A99
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00478D50 push ecx; mov dword ptr [esp], edx	1_2_00478D51
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00412D78 push 00412DDBh; ret	1_2_00412DD3
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040D288 push ecx; mov dword ptr [esp], edx	1_2_0040D28A
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0040F7E8 push ecx; mov dword ptr [esp], edx	1_2_0040F7EA
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004438E0 push ecx; mov dword ptr [esp], ecx	1_2_004438E4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00459ACC push 00459B10h; ret	1_2_00459B08
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0049BD44 pushad ; retf	1_2_0049BD53

Source: is-P21BL.tmp.1.dr

Static PE information: section name: .text entropy: 6.807704201137633

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-KONM9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\8b4e2b00.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bc3918b8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\IO\IO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\MD5\MD5.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\SHA\SHA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\ielib32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-07QKO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\Piece\Piece.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\mro\mro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-HJO89.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-OMIVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Socket\Socket.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Cwd\Cwd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Bzip2\Bzip2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e8ce9e63.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\perl524.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\DelZip190.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\0b174c5f.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9e2b3cdd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e5acedbf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-5LPT9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\FindFile\FindFile.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\30e95417.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\HiRes\HiRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\API\API.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\54f7af00.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\GMP\GMP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\a09139d7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\tools\exiftool.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Win32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\File\Glob\Glob.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-1BDNO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\tools\consoleStartHelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-B0F3I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6b9bcbc1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\MIME\Base64\Base64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Console\Console.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\List\Util\Util.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\72279688.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\tools\is-QSPTB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32API\File\File.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-LEN5V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\FastCalc\FastCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\dcrawlib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Fcntl\Fcntl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\re\re.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\GeoSetter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\is-P21BL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Program Files (x86)\GeoSetter\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\7f720997.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\25bbf886.dll	Jump to dropped file
Source: C:\Users\user\Desktop\geosetter_setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Encode\Encode.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\POSIX\POSIX.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	File created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Zlib\Zlib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BDALQ.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoSetter			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoSetter\GeoSetter.lnk			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0042405C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_0042405C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0042405C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_0042405C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00422CAC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_00422CAC
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0041811E IsIconic,SetWindowPos,	1_2_0041811E
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00418120 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00418120
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004245E4 IsIconic,SetActiveWindow,	1_2_004245E4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0042462C IsIconic,SetActiveWindow,SetFocus,	1_2_0042462C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004187D4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_004187D4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00484D28 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_00484D28
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0042F71C IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	1_2_0042F71C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004179E8 IsIconic,GetCapture,	1_2_004179E8

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_0041F568 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F568

Source: C:\Users\user\Desktop\geosetter_setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: A5F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: A9A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: AB20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: AB40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BC20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BCE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BD80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BDE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BE00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BE60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BE80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BEA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Memory allocated: BEC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Window / User API: threadDelayed 1920			Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Window / User API: threadDelayed 7634			Jump to behavior

Source: C:\Users\user\Desktop\geosetter_setup.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-6073

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

API coverage: 0.1 %

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe TID: 5144

Thread sleep time: -76340s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Thread sleep count: Count: 1920 delay: -10			Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Thread sleep count: Count: 7634 delay: -10			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00476120 FindFirstFileA,FindNextFileA,FindClose,	1_2_00476120
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004531A4 FindFirstFileA,GetLastError,	1_2_004531A4
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_004648D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004648D0
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00464D4C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464D4C
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_00463344 FindFirstFileA,FindNextFileA,FindClose,	1_2_00463344
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: 1_2_0049998C FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0049998C
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC0AEB0 win32_opendir,strlen,Perl_safesyscalloc,strcpy,MultiByteToWideChar,Perl_get_context,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,strlen,Perl_safesysmalloc,strcpy,GetLastError,_errno,WideCharToMultiByte,_errno,_errno,Perl_safesysfree,_errno,_errno,	15_2_6DC0AEB0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC0BB70 win32_longpath,strcpy,FindFirstFileA,strcpy,FindClose,_errno,FindClose,_errno,	15_2_6DC0BB70
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_70845F80 PL_charclass,wcscpy,FindFirstFileW,wcslen,wcscpy,FindClose,_errno,FindClose,_errno,toupper,	15_2_70845F80
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_70845BA0 PL_charclass,_mbscpy,FindFirstFileA,_mbscpy,FindClose,toupper,_errno,FindClose,_errno,	15_2_70845BA0

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

15_2_6560A76C

Source: C:\Users\user\Desktop\geosetter_setup.exe

Code function: 0_2_0040A018 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_0040A018

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior

Source: geosetter_setup.tmp, 00000001.00000003.2458983625.000000000076D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: geosetter_setup.tmp, 00000001.00000003.2458983625.000000000076D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep			graph_9-1716
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep			graph_15-242634

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Code function: 15_2_62103C50 IsDebuggerPresent,Perl_croak_nocontext,

15_2_62103C50

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_00450994 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450994

Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Code function: 9_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,GetProcAddress,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	9_2_00401180
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Code function: 9_2_00404700 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	9_2_00404700
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,GetProcAddress,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	15_2_00401180
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_004064F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_004064F0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62104560 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_62104560
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62583410 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_62583410
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62AC27C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_62AC27C0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_62D89200 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_62D89200
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_64FC2E30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_64FC2E30
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6560FC30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_6560FC30
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66A140E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_66A140E0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_66E02810 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_66E02810
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_674C3960 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_674C3960
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6A5466D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_6A5466D0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC1BB70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,EnterCriticalSection,TlsGetValue,GetLastError,TlsGetValue,GetLastError,LeaveCriticalSection,	15_2_6DC1BB70
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_707C48D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_707C48D0
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_70848340 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_70848340

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_0047974C ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_0047974C

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -listx	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -lang	Jump to behavior
Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe	Process created: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe "C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -ver	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -listx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -lang
Source: C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	Process created: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -ver

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_0042F254 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,

1_2_0042F254

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_0042E4EC AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E4EC

Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWnd
Source: GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWndS

Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: GetLocaleInfoA,	0_2_0040565C
Source: C:\Users\user\Desktop\geosetter_setup.exe	Code function: GetLocaleInfoA,	0_2_004056A8
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: GetLocaleInfoA,	1_2_004089B8
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Code function: GetLocaleInfoA,	1_2_00408A04

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_00458DC4 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458DC4

Source: C:\Users\user\Desktop\geosetter_setup.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Code function: 1_2_00455D38 GetUserNameA,

1_2_00455D38

Source: C:\Users\user\Desktop\geosetter_setup.exe

Code function: 0_2_00404654 GetModuleHandleA,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy,

0_2_00404654

Source: C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC12260 win32_listen,_get_osfhandle,listen,WSAGetLastError,_errno,SetLastError,		15_2_6DC12260
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Code function: 15_2_6DC11EF0 win32_bind,_get_osfhandle,bind,WSAGetLastError,_errno,SetLastError,		15_2_6DC11EF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	4 Obfuscated Files or Information	Security Account Manager	5 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	13 Process Injection	1 Software Packing	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Masquerading	Cached Domain Credentials	13 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Regsvr32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
geosetter_setup.exe	2%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\GeoSetter\DelZip190.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\GeoSetter.exe (copy)	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\dcrawlib.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\ielib32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-07QKO.tmp	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-1BDNO.tmp	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-5LPT9.tmp	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-B0F3I.tmp	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-HJO89.tmp	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-KONM9.tmp	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-LEN5V.tmp	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-OMIVA.tmp	4%	ReversingLabs
C:\Program Files (x86)\GeoSetter\is-P21BL.tmp	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\libeay32.dll (copy)	4%	ReversingLabs
C:\Program Files (x86)\GeoSetter\ssleay32.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\GeoSetter\tools\consoleStartHelper.exe (copy)	3%	ReversingLabs
C:\Program Files (x86)\GeoSetter\tools\exiftool.exe (copy)	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\tools\is-QSPTB.tmp	2%	ReversingLabs
C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp	3%	ReversingLabs
C:\Program Files (x86)\GeoSetter\unins000.exe (copy)	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BDALQ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\0b174c5f.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\25bbf886.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\30e95417.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\54f7af00.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6b9bcbc1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\72279688.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\7f720997.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\8b4e2b00.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9e2b3cdd.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\a09139d7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bc3918b8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e5acedbf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e8ce9e63.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Bzip2\Bzip2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Zlib\Zlib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Cwd\Cwd.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\MD5\MD5.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\SHA\SHA.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Encode\Encode.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Fcntl\Fcntl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\File\Glob\Glob.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\IO\IO.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\List\Util\Util.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\MIME\Base64\Base64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\FastCalc\FastCalc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\GMP\GMP.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\POSIX\POSIX.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Socket\Socket.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\HiRes\HiRes.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\Piece\Piece.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32API\File\File.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\API\API.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Console\Console.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\FindFile\FindFile.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Win32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\mro\mro.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\re\re.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\script\exiftool	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\perl524.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe	2%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.indyproject.org/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
map.geosetter.de	185.30.32.197	true	true		unknown
owl.phy.queensu.ca	130.15.24.27	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://map.geosetter.de/v3/leaflet/leaflet.js	false		unknown
http://map.geosetter.de/v3/map_google.html	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.locr.com/api	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.hri.org/news/world/undh/last/00-08-16.undh.html	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.smh.com.au/news/9905/26/pageone/pageone4.html	GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2484059778.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.worldtimezone.com/brazil-time-new-old.php	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.worldtimezone.com/dst_news/dst_news_gazastrip05.html	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://media.enet.cu/radioreloj	GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.worldtimezone.com/dst_news/dst_news_bangladesh02.htP	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://abc.net.au/local/news/olympics/1999/07/item19990728112314_1.ht	GeoSetter.exe, 00000007.00000003.2484591039.000000000960C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://g1.globo.com/bahia/noticia/2011/10/governador-jaques-wagner-confirma-horario-de-verao-na-bahi	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://news.mail.ru/politics/6861560/	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.horaoficial.cl/cambio.h	GeoSetter.exe, 00000007.00000003.2487461434.00000000095F3000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://home.no.net/janmayen/history.htm	GeoSetter.exe, 00000007.00000003.2486000379.0000000009614000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.arabtimesonline.com/arabtimes/kuwait/Viewdet.asp?ID=9950	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.indyproject.org/	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
http://www.dawn.com/2003/03/07/top15.htm	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://pcdsh01.on.br/HV27998.htm	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.lagaceta.com.ar/vernotae.asp?id_nota=253414	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.japantimes.co.jp/cgi-bin/getarticle.pl5?nn20050810f2.htm	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.sumatera-inc.com/go_to_invest/about_indonesia.asp#standtim	GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.thedailystar.net/newDesign/latest_news.php?nid=2281	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.openstreetmap.org	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://www.mme.gov.br/site/news/detail.do;jsessionid=BBA06811AFCAAC28F0285210913513DA?newsId=13975	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.geosetter.de4http://www.geosetter.de/en	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.hko.gov.hk/gts/time/Summertime.	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://api.geonames.org	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://pcdsh01.on.br/HISTHV.htm	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://w1.c1.rada.gov.ua/pls/zweb_n/webproc4_1?id=&pf3511=41484	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://media.enet.cu/radiorelot	GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.geonames.org/login	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://www.worldtimezone.com/dst_news/dst_news_westbank01.htmX3K9#	GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.worldtimeserver.com/current_time_in_MN.aspx	GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://rega.basbakanlik.gov.tr/eskiler/2007/03/20070307-7.htm	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.locr.com	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://www.locr.com/user/my_page/my_photos_edit.phpopen	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.nnc.cubaweb.cu/marzo-2008/cien-1-11-3-08.htm	GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mongoliatourism.gov.mn/general.htm	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.delphizip.org	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	geosetter_setup.exe, geosetter_setup.exe, 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		unknown
http://www.pettswoodvillage.co.uk/Daylight_Savings_William_Willett.pdf	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486362486.0000000009648000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.thenews.com.pk/daily_detail.asp?id=171280	GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.geosetter.de/update/version_beta_release_date	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
https://www.geosetter.de/update/version_locr	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://inms-ienm.nrc-cnrc.gc.ca/images/time_services/TZ01SWE.j	GeoSetter.exe, 00000007.00000003.2486841143.0000000009614000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.ptb.de/de/org/4/44/441/salt.htm	GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.worldtimezone.com/dst_news/dst_news_westbank01.htmX3	GeoSetter.exe, 00000007.00000003.2483666998.000000000960C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mme.gov.br/firs	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.gobernac.mendoza.gov.ar/boletin/pdf/20040924-27244-normas.pdf	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.geosetter.de/update/version_release_date	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.zoomin.de/registrieren	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://www.sumatera-inc.com/go_to_invest/about_indonesia.asp#standtime	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.winstonchurchill.org/fh114willett.htm	GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://pcdsh01.on.br/DecHV.h$#	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://uk.reuters.com/article/oilRpt/idUKBLA65048420070916	GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483542296.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.timeanddate.com/news/time/iraq-dumps-daylight-saving.html	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483607874.0000000009604000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.guardian.co.uk/world/feedarticle/7759001	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.hri.org/news/world/undh/last/00-08-16.undh.htmD	GeoSetter.exe, 00000007.00000003.2483444097.00000000095C8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.geosetter.deDhttp://www.geosetter.de/changes-de4http://www.geosetter.de/enJhttp://www.geo	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.worldtimezone.com/dst_news/dst_news_bangladesh06.html	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.hurriyet.com.tr/ekonomi/17230464.asp?gid=373	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://map.geosetter.de/v3/map_google.htmlSV	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.jpost.com/MiddleEast/Article.aspx?id=235650	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.google.com/kml/ext/2.2	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.worldtimezone.com/dst_news/dst_news_gazastrip01.html	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.worldtimeserver.com/current_time_in_MN.aspL	GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.horaoficial.cl/cambio.htm	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.locr.com/photo/album/albums.php?album_id=%s	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://pcdsh01.on.br/HV1674.htm	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.cddhcu.gob.mx/bibliot/publica/inveyana/polisoc/horver/(	GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.segodnya.ua/news/14290482.html	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://news.tut.by/society/250578.html	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.prensalatina.com.mx/article.asp?ID=%7B4CC32C1B-A9F7-42FB-8A07-8631AFC923AF%7D&language=D)	GeoSetter.exe, 00000007.00000003.2486925654.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.presidencia.gub.uy/decretos/2004091502.htm	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://ar.clarin.com/diario/2001-06-12/s-03501.htm	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mcil.gov.ws/mcil_publications.h	GeoSetter.exe, 00000007.00000003.2484745468.0000000009620000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.geosetter.de/proxytest.datU	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://jornale.com.br/index.php?option=com_content&task=view&id=13530&Itemid=5t%	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://bdnews24.com/details.php?id=85889&cid=H#	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.nineoclock.ro/POL/1778pol.html	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://tile.stamen.com/terrain-background	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.astro.uni.torun.pl/~kb/Artykuly/U-PA/Czas2.htm#tth_tAb1	GeoSetter.exe, 00000007.00000003.2485048789.0000000009610000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.pak.gov.pk/public/news/app/app06_dec.htm	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483058159.0000000009610000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://almanakka.helsinki.fi/aikakirja/Aikakirja2007kokonaan.pdf	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486117127.00000000095CE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://student.cusu.cam.ac.uk/~jsm28/british-timeT	GeoSetter.exe, 00000007.00000003.2485959928.0000000009620000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.pak.gov.pk/public/news/app/app06_dec.htp	GeoSetter.exe, 00000007.00000003.2483691540.0000000009614000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.thedailystar.net/newDesign/news-details.php?nid=119P	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.thedailystar.net/newDesign/news-details.php?nid=107P	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.shoa.cl/noticias/2008/04hora/hora.htm	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://pcdsh01.on.br/HV1636.htm	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://story.philippinetimes.com/p.x/ct/9/id/145be20cc6b121c0/cid/3e5bbccc730d258c/	GeoSetter.exe, 00000007.00000003.2483199614.00000000095E8000.00000004.00001000.00020000.00000000.sdmp, GeoSetter.exe, 00000007.00000003.2483123371.000000000961C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mytopo.com	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://www.geosetter.de/geosetter_beta.exeU	GeoSetter.exe, 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://petra.gov.jo/Artical.aspx?Lng=2&Section=8&Artical=95279	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.sana.sy/ara/2/2009/09/29/247012.htm	GeoSetter.exe, 00000007.00000003.2483444097.00000000095D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.lapalmainteractivo.com/guias/content/gen/ap/America_Latina/AMC_GEN_NICARAGUA_HORA.h	GeoSetter.exe, 00000007.00000003.2487377772.00000000095EC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.presidencia.gub.uy/_Web/decretos/2005/09/CM%20119_09%2009%202005_00001.PDF	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.locr.com/user_create.php	GeoSetter.exe, 00000007.00000000.2455770204.0000000000D10000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://student.cusu.cam.ac.uk/~jsm28/british-time/	GeoSetter.exe, 00000007.00000003.2485467240.0000000009628000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.gobernac.mendoza.gov.ar/boletin/pdf/20040521-27158-normas.pdf	GeoSetter.exe, 00000007.00000003.2486990828.0000000009630000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.30.32.197	map.geosetter.de	Germany		48324	DE-WEBGOwwwwebgodeDE	true
130.15.24.27	owl.phy.queensu.ca	Canada		31983	QUEENSU-KINGSTONCA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546439
Start date and time:	2024-10-31 22:21:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	geosetter_setup.exe
Detection:	SUS
Classification:	sus24.evad.winEXE@26/1166@2/2
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 92% Number of executed functions: 203 Number of non-executed functions: 254
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target exiftool.exe, PID 2140 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: geosetter_setup.exe

Simulations

Behavior and APIs

Time	Type	Description
17:23:28	API Interceptor	11352648x Sleep call for process: GeoSetter.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QUEENSU-KINGSTONCA	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	130.15.151.129
	arm5-20240706-0316.elf	Get hash	malicious	Mirai	Browse	130.15.5.203
	HOdRDgUXqH.elf	Get hash	malicious	Mirai	Browse	130.15.5.203
	syms.arm.elf	Get hash	malicious	Mirai	Browse	130.15.5.205
	1JRhF9Wecw.elf	Get hash	malicious	Mirai, Moobot	Browse	130.15.133.115
	Q0ckwyWEJ4	Get hash	malicious	Mirai	Browse	130.15.133.115
	Y8spWI11i7.dll	Get hash	malicious	Wannacry	Browse	130.15.222.111
	djWXcpcbUl	Get hash	malicious	Mirai	Browse	130.15.63.220
	sora.x86	Get hash	malicious	Mirai	Browse	130.15.5.216
	LxZtt8te4n	Get hash	malicious	Mirai	Browse	130.15.16.121
DE-WEBGOwwwwebgodeDE	mfyPnr7Rxa.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	185.30.32.74
	27i42a6Qag.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	185.30.32.136
	WpPPx8yVOV.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.30.32.206
	iMapU.xlsm	Get hash	malicious	Unknown	Browse	185.30.32.84
	SecuriteInfo.com.Variant.Jaik.72878.26519.exe	Get hash	malicious	FormBook	Browse	185.30.35.35
	ANTIMETHODIC.exe	Get hash	malicious	FormBook GuLoader	Browse	185.30.34.153
	doc04932620220119130914.exe	Get hash	malicious	FormBook	Browse	185.30.32.154
	S3JoEcfrv6.exe	Get hash	malicious	FormBook	Browse	185.30.35.34
	quotation New Order I5117.exe	Get hash	malicious	FormBook	Browse	185.30.32.154
	Txbu8gCsuV.exe	Get hash	malicious	Dridex	Browse	185.30.32.33

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
b22b3950835f7eba2f3be0917e4f949e	Estimado_1546359641.155196.msi	Get hash	malicious	VMdetect	Browse	130.15.24.27
	PyCZ044s6O.exe	Get hash	malicious	Unknown	Browse	130.15.24.27
	83Beigy1jC.msi	Get hash	malicious	Unknown	Browse	130.15.24.27
	ContratoAprovado+002336.msi	Get hash	malicious	Unknown	Browse	130.15.24.27
	bs3sO7r4K4.msi	Get hash	malicious	Unknown	Browse	130.15.24.27
	iUyzvEVVxL.msi	Get hash	malicious	Unknown	Browse	130.15.24.27
	yQA3ACsxlm.msi	Get hash	malicious	Unknown	Browse	130.15.24.27

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	299520
Entropy (8bit):	6.185961311364828
Encrypted:	false
SSDEEP:	6144:yE2eKJePDxNrdidrV/6dn/rvDvjsyOAKSM2sT6Agjbh:nxKMbhyrV/6dn/zsyOAM6A
MD5:	1FA0B840106D39602894E5C5FFE49951
SHA1:	1B727C746E4C40DCF20D029938480156935C8CB0
SHA-256:	27DDF78ECEB8DB8449A6210E19CAFD5A785B494DF997990093E5AA56409078E6
SHA-512:	06F6D2E7937F8EC50232900A35509D26AA7011A152ACA1ED9D1691F0E2CEE999CECA289635B5F655F6CB995A357ADD76C345F38C88E5DE896A8273D69D7A0DC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....}L...........#.....P...p...............`....@..........................@..................................................~...............................,$...................................................................................text....P.......B.................. ..`.data....p...`.......H..............@....tls.................N..............@....idata...............P..............@..@.edata...............\..............@..@.rsrc................^..............@..@

C:\Program Files (x86)\GeoSetter\GeoSetter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11988480
Entropy (8bit):	6.782456664381823
Encrypted:	false
SSDEEP:	196608:dCgvRDIl33ZuLNT3vK7FhsrKz01uJR+0Jqwlm0PQp5hEMvsE:dC2RQ33oLNT3aFhsrKggWvwl34p5uo
MD5:	010F18D793587CEB5E31D53455F461A1
SHA1:	D06F6B0073AA89F495A4CF2A9337DFF3E4F489CE
SHA-256:	E5DB556D7DEE0B5B19E1EBF6B7055F3D9E906474C9CFCA06C5067EAC78691B38
SHA-512:	040992690CF74ADAB8A64F3D091A47F99752CBBD5592064894D0E67A8F95A137220FADF5FF80BA5A09385E7A4A7184159D3509E3BA3A44333BDA51288637463D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*......................3.....H(.......0....@.............................................@.....................P....p...[......t!!........................................................................................................CODE................................ ..`DATA.........0......................@...BSS.....u...............................idata...[...p...\.................@....edata..P........... ..............@..P.tls................."...................rdata.............."..............@..P.reloc...............$..............@..P.rsrc...t!!......"!................@..P....................."..............@..P................................................................................................

C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	510563
Entropy (8bit):	6.212655849320538
Encrypted:	false
SSDEEP:	6144:zL6U5v/dRVgJFnffwFYQ3FjQMVi/ia+st8qWDDeSf2BUTijBVSJ7IizVb5Gzu6qk:PZ5NRVwVff5Q3FUMk/dt6eSfyUV7FzHu
MD5:	6CEC2728D55229767B64CAF85EE4BE17
SHA1:	E5AE2389B1B9CD51B56AC7A33490DCC126691447
SHA-256:	28E075B446F3EE3A30A2B82A6B372931D31B7746B96528980C04A35415806E6E
SHA-512:	00BE403EB1F02ED1BC50A556B9F5006832B638753538ACD83CBD642BF17BEAD763692E503A430C61DE37A1FA2BE76CE73FADD8DFEFE44A8203EE12BDF5E517AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........R..v......!....P...d!..8J.............................................................................................................................. 2...................................................................................text...P........................... ..`.data...d!......."..................@....rdata..p...........................@..@.bss....8J...p...........................CRT.................J..............@....idata...............L..............@....edata...............Z..............@..@.rsrc................\..............@....reloc.. 2.......4...j..............@..B.stab...p/...@...0..................@..B.stabstrr....p......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	750900
Entropy (8bit):	5.919233786288461
Encrypted:	false
SSDEEP:	6144:ZSrynUJJ0YqLcoxaaSOnMr0Rj+H4x+q6CgIfMDRfy2LRxWRFU0pWXs2uxm6Tokeg:wrynUJ2YqLcMxVV+Ygq6CgIfMA2Lc
MD5:	1B3D9B17D4233044C3D4CD69744D868B
SHA1:	896325C935141C8813D1343834B5B04583D38F2D
SHA-256:	9189F08C9EA21898D23783BBA3D3089093F5320D71295F1FCCFAB2EC6B0745CB
SHA-512:	943A0B2BE7A3C98E93D69D9F777BB541E7E987F87DA2677EBA11F7705969D995444E1E71673FD82EF29DAE446F5D512AAED4C7FC659EEDE6C0AB0699F39D6697
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........@..g.....& .....#.....PM..p%.......................................................................................................p...................H...................................................................t..H............................text....#.......$.................. ..`.data.......@...,...(..............@....rdata...D...p...F...T..............@..@.pdata...H.......J..................@..@.bss....PM...............................CRT.........`......................@....idata.......p......................@....edata..............................@..@.rsrc...............................@....reloc..............................@..B/4..................."..............@..B/16.................................@..B/30.................. ..............@..B/42..................4..............@..B................................................

C:\Program Files (x86)\GeoSetter\cameras.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27282
Entropy (8bit):	5.2209833125168945
Encrypted:	false
SSDEEP:	768:HSaYonfavq3g/ZC60WtNos+5D1Ekz5UlzFwXNkCKZbBfYpbn5ceqLKk3P49IZ9Zq:HSaYonfavq3g/ZN0WtNos+5D1Ekz5UlQ
MD5:	821A20750A34596C957D5D72AB982DF3
SHA1:	7A29D183310B08E36E2051BDAA3CAF7451C1BEC2
SHA-256:	959E7D4B95CD96BE391C7115AA013045A578FED5F5C469EA95FDA6DB82A7D69B
SHA-512:	A1BAF9988BB754D499412F1D6B552F04D95DCA9B2994E062BB26AE1D0CAAE444E211CEEDC04C4DD857B21E2546E7478BB6BBE74183E67256235BC4F799033435
Malicious:	false
Preview:	Apple iPhone = 9.61..Apple iPhone 3G = 9.61..Apple iPhone 3Gs = 9.61..Apple iPhone 4 = 7.64..CAMERA 5MP-9A3 = 4.861..Canon Canon DIGITAL IXUS 300 = 6.66..Canon Canon DIGITAL IXUS v2 = 6.66..Canon Canon EOS 1000D = 1.60..Canon Canon EOS 10D = 1.60..Canon Canon EOS 20D = 1.60..Canon Canon EOS 300D DIGITAL = 1.60..Canon Canon EOS 350D DIGITAL = 1.60..Canon Canon EOS 40D = 1.60..Canon Canon EOS 50D = 1.60..Canon Canon EOS 400D = 1.60..Canon Canon EOS 400D DIGITAL = 1.60..Canon Canon EOS 450D = 1.60..Canon Canon EOS 500D = 1.60..Canon Canon EOS 550D = 1.60..Canon Canon EOS 600D = 1.60..Canon Canon EOS 650D = 1.60..Canon Canon EOS 60D = 1.60..Canon Canon EOS 5D = 1.00..Canon Canon EOS 5D Mark II = 1.00..Canon Canon EOS 5D Mark III = 1.00..Canon Canon EOS 7D = 1.60..Canon Canon EOS D60 = 1.60..Canon Canon EOS DIGITAL REBEL = 1.60..Canon Canon EOS DIGITAL REBEL XSi = 1.60..Canon Canon PowerShot 350 = 7.21..Canon Canon PowerShot 600 = 7.21..Canon Canon PowerShot A10 = 6.56..Canon Canon PowerSho

C:\Program Files (x86)\GeoSetter\dcrawlib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.842364266823586
Encrypted:	false
SSDEEP:	6144:tkoF5P41jBNIOMGF04OmRSTf1jXJnWyXSkqAOXGm:3Fp4j3IOMG+4OmRSTLWCSkq4
MD5:	D150AF5B2CA2D94FFB18757F0EDEE01F
SHA1:	A5CE5C6803379912BFCC204D6360F0D1F10F7503
SHA-256:	9F449BD374EEB6C6416AEEA7F7C236911D6F375DB587AB4552ACB1A65DD4F346
SHA-512:	DABE7611FA6BB9D0567BD2005D1C6ACD51C024C7DA38700E844AFAE59C13693D449168DA58CF0B2600ADB604A398201A38269588F340DCBC2DDE0E640D72576A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........pe.............j_....................P....i.....................................Rich............PE..L...N..Q.........."!.........p.......A....................................................@.....................................<....`.......................p..xH.....................................@...............@............................text...)........................... ..`.rdata..............................@..@.data... ...........................@....rsrc........`......................@..@.reloc...V...p...X..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\help\GeoSetter-DE.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	6116969
Entropy (8bit):	7.999151555633067
Encrypted:	true
SSDEEP:	98304:eOsRuz6dhoCD7sKunHSeGxUWQ3TmmHg3POS5u63XRrwYZzkVGIrytUaznzv1Ux:eFuz4YK4HSeGqDTmmEOSIWBvS1rQUqbo
MD5:	170D51F4FB0DB4AB66D4D789D25288C8
SHA1:	3092B43304547C59065EA5A53599A6690A2B52F5
SHA-256:	77D5D3107149F45BFEA896106FE9ACA7A116B65807C7793CCAFE0C6FC6CED35B
SHA-512:	2D1A53B12DBD32FC445481D71CDD168EBE9B29C84AA7E14EBE8063DD54A8E81E7961BE6040997DDC9248EED625EB8D5DA72EA85DB424986E70924DF9BF94A71C
Malicious:	false
Preview:	ITSF....`.........O........\|.{.......".....\|.{......."..`...............x.......TP.......P..............iV].............ITSP....T...........................................j..].!......."..T...............PMGLD................/..../#IDXHDR...x.../#ITBITS..../#IVB....:.\./#STRINGS......5./#SYSTEM..>.1./#TOPICS...x.P./#URLSTR....d.#./#URLTBL....H.../#WINDOWS....*.../$FIftiMain....7..A./$OBJINST......../$WWAssociativeLinks/..../$WWAssociativeLinks/Property......./$WWKeywordLinks/..../$WWKeywordLinks/BTree.......L./$WWKeywordLinks/Data....d.R./$WWKeywordLinks/Map....6B./$WWKeywordLinks/Property....x ./Back.bmp......./CSHelp.txt......!/FAQ_ACTIVATE_SHELLEXTENSION.html.....?"/FAQ_ACTIVATE_SHELLEXTENSIONb1.PNG.......8./FAQ_CROSSHAIR.html...0.w&/FAQ_EXIFTOOL_ERRORS_AND_WARNINGS.html.....[ /FAQ_FILTER_ACTIVATED_TWICE.html...'..!/FAQ_FILTER_ACTIVATED_TWICEb1.PNG.......i./FAQ_GE_TIMESLIDER.html......./FAQ_GEONAMES.html...O.:./FAQ_GEONAMESb1.PNG....7.s./FAQ_GEOSETTER_ERROR.html...q.'./FAQ_GEOSETT

C:\Program Files (x86)\GeoSetter\help\GeoSetter-EN.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	6019719
Entropy (8bit):	7.9992123309859196
Encrypted:	true
SSDEEP:	98304:KSk3dOM/TeJQNxF1n0B1FIgBBJ5y/07Ham+ohmmJALMIWlh7geP2Ej+DXBQJ/JDv:7mb90BzIg7J5y/0umlAnWlZgxEj8XyJp
MD5:	8FCB255F100B8CC727D8CBDFF4313E54
SHA1:	477A980A596B1FA1AEB5266A2BEFEAE71A9B2163
SHA-256:	5F891F4D3A48395132C70B23D7AFB9DE9D3E03AC337827787643DE0E93CF2C74
SHA-512:	4E33A1517D798D050880A6A7E12B375ECAD4EA41322EB76A1613FDA3E059C47D9E10770CB6A0383110868F04DB4F1C70C2B9DD370967A4E9DBBEB60B4942EC6C
Malicious:	false
Preview:	ITSF....`........v.........\|.{.......".....\|.{......."..`...............x.......TP.......P................[.............ITSP....T...........................................j..].!......."..T...............PMGLE................/..../#IDXHDR....{.../#ITBITS..../#IVB....C.\./#STRINGS......A./#SYSTEM...././#TOPICS....{.P./#URLSTR....g.#./#URLTBL....K.../#WINDOWS....3.../$FIftiMain....5..F./$OBJINST....v.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....r../$WWKeywordLinks/..../$WWKeywordLinks/BTree....!..L./$WWKeywordLinks/Data....m.+./$WWKeywordLinks/Map.....:./$WWKeywordLinks/Property....R ./Back.bmp...E.../CSHelp.txt......!/FAQ_ACTIVATE_SHELLEXTENSION.html.....;"/FAQ_ACTIVATE_SHELLEXTENSIONb1.PNG....U..V./FAQ_CROSSHAIR.html.....J&/FAQ_EXIFTOOL_ERRORS_AND_WARNINGS.html.....f /FAQ_FILTER_ACTIVATED_TWICE.html...J.T!/FAQ_FILTER_ACTIVATED_TWICEb1.PNG....b..s./FAQ_GE_TIMESLIDER.html...h.../FAQ_GEONAMES.html...?."./FAQ_GEONAMESb1.PNG....+.../FAQ_GEOSETTER_ERROR.html...v.C./FAQ_GEOSETT

C:\Program Files (x86)\GeoSetter\help\is-0NEIU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	6019719
Entropy (8bit):	7.9992123309859196
Encrypted:	true
SSDEEP:	98304:KSk3dOM/TeJQNxF1n0B1FIgBBJ5y/07Ham+ohmmJALMIWlh7geP2Ej+DXBQJ/JDv:7mb90BzIg7J5y/0umlAnWlZgxEj8XyJp
MD5:	8FCB255F100B8CC727D8CBDFF4313E54
SHA1:	477A980A596B1FA1AEB5266A2BEFEAE71A9B2163
SHA-256:	5F891F4D3A48395132C70B23D7AFB9DE9D3E03AC337827787643DE0E93CF2C74
SHA-512:	4E33A1517D798D050880A6A7E12B375ECAD4EA41322EB76A1613FDA3E059C47D9E10770CB6A0383110868F04DB4F1C70C2B9DD370967A4E9DBBEB60B4942EC6C
Malicious:	false
Preview:	ITSF....`........v.........\|.{.......".....\|.{......."..`...............x.......TP.......P................[.............ITSP....T...........................................j..].!......."..T...............PMGLE................/..../#IDXHDR....{.../#ITBITS..../#IVB....C.\./#STRINGS......A./#SYSTEM...././#TOPICS....{.P./#URLSTR....g.#./#URLTBL....K.../#WINDOWS....3.../$FIftiMain....5..F./$OBJINST....v.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....r../$WWKeywordLinks/..../$WWKeywordLinks/BTree....!..L./$WWKeywordLinks/Data....m.+./$WWKeywordLinks/Map.....:./$WWKeywordLinks/Property....R ./Back.bmp...E.../CSHelp.txt......!/FAQ_ACTIVATE_SHELLEXTENSION.html.....;"/FAQ_ACTIVATE_SHELLEXTENSIONb1.PNG....U..V./FAQ_CROSSHAIR.html.....J&/FAQ_EXIFTOOL_ERRORS_AND_WARNINGS.html.....f /FAQ_FILTER_ACTIVATED_TWICE.html...J.T!/FAQ_FILTER_ACTIVATED_TWICEb1.PNG....b..s./FAQ_GE_TIMESLIDER.html...h.../FAQ_GEONAMES.html...?."./FAQ_GEONAMESb1.PNG....+.../FAQ_GEOSETTER_ERROR.html...v.C./FAQ_GEOSETT

C:\Program Files (x86)\GeoSetter\help\is-UIS00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	6116969
Entropy (8bit):	7.999151555633067
Encrypted:	true
SSDEEP:	98304:eOsRuz6dhoCD7sKunHSeGxUWQ3TmmHg3POS5u63XRrwYZzkVGIrytUaznzv1Ux:eFuz4YK4HSeGqDTmmEOSIWBvS1rQUqbo
MD5:	170D51F4FB0DB4AB66D4D789D25288C8
SHA1:	3092B43304547C59065EA5A53599A6690A2B52F5
SHA-256:	77D5D3107149F45BFEA896106FE9ACA7A116B65807C7793CCAFE0C6FC6CED35B
SHA-512:	2D1A53B12DBD32FC445481D71CDD168EBE9B29C84AA7E14EBE8063DD54A8E81E7961BE6040997DDC9248EED625EB8D5DA72EA85DB424986E70924DF9BF94A71C
Malicious:	false
Preview:	ITSF....`.........O........\|.{.......".....\|.{......."..`...............x.......TP.......P..............iV].............ITSP....T...........................................j..].!......."..T...............PMGLD................/..../#IDXHDR...x.../#ITBITS..../#IVB....:.\./#STRINGS......5./#SYSTEM..>.1./#TOPICS...x.P./#URLSTR....d.#./#URLTBL....H.../#WINDOWS....*.../$FIftiMain....7..A./$OBJINST......../$WWAssociativeLinks/..../$WWAssociativeLinks/Property......./$WWKeywordLinks/..../$WWKeywordLinks/BTree.......L./$WWKeywordLinks/Data....d.R./$WWKeywordLinks/Map....6B./$WWKeywordLinks/Property....x ./Back.bmp......./CSHelp.txt......!/FAQ_ACTIVATE_SHELLEXTENSION.html.....?"/FAQ_ACTIVATE_SHELLEXTENSIONb1.PNG.......8./FAQ_CROSSHAIR.html...0.w&/FAQ_EXIFTOOL_ERRORS_AND_WARNINGS.html.....[ /FAQ_FILTER_ACTIVATED_TWICE.html...'..!/FAQ_FILTER_ACTIVATED_TWICEb1.PNG.......i./FAQ_GE_TIMESLIDER.html......./FAQ_GEONAMES.html...O.:./FAQ_GEONAMESb1.PNG....7.s./FAQ_GEOSETTER_ERROR.html...q.'./FAQ_GEOSETT

C:\Program Files (x86)\GeoSetter\ielib32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	988936
Entropy (8bit):	6.85202685649218
Encrypted:	false
SSDEEP:	24576:NRBlpbQLEDnmOMJSKvs43BIUr35RRLjAGTrg/sb:/j4E6NJ5HB535HLjAGTM/sb
MD5:	64B64B8D72634EA8A454AD0CDC2B3A12
SHA1:	63C31D6003D3442A4C70C3E39F2183CD8F7C31B3
SHA-256:	09E114904F423A9E30A6AF70E2A286376A9325ECD6400926C2710204F609F8D3
SHA-512:	66EB2C044959CC6F2ABBC4FC4F7921F1079B85942AAC914D9165F6E1FCDABCC63C7E4E84BD14F9D999AE636214C628FC288373789DF4E7D7AA6E722B35D34350
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.Tp.x:#.x:#.x:#\|..#.x:#.6.#.x:#..#!x:#.x;#`x:#...#.x:#...#.x:#..#&y:#..#Yx:#..#.x:#..#.x:#..#.x:#Rich.x:#........PE..L....tES...........!.........z.......@...............................................}...............................t...>..8l..P............................... ...0...................................@............................................text...~~.......................... ..`.rdata...#.......$..................@..@.data...............................@....rsrc................Z..............@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-07QKO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11988480
Entropy (8bit):	6.782456664381823
Encrypted:	false
SSDEEP:	196608:dCgvRDIl33ZuLNT3vK7FhsrKz01uJR+0Jqwlm0PQp5hEMvsE:dC2RQ33oLNT3aFhsrKggWvwl34p5uo
MD5:	010F18D793587CEB5E31D53455F461A1
SHA1:	D06F6B0073AA89F495A4CF2A9337DFF3E4F489CE
SHA-256:	E5DB556D7DEE0B5B19E1EBF6B7055F3D9E906474C9CFCA06C5067EAC78691B38
SHA-512:	040992690CF74ADAB8A64F3D091A47F99752CBBD5592064894D0E67A8F95A137220FADF5FF80BA5A09385E7A4A7184159D3509E3BA3A44333BDA51288637463D
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\GeoSetter\is-07QKO.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*......................3.....H(.......0....@.............................................@.....................P....p...[......t!!........................................................................................................CODE................................ ..`DATA.........0......................@...BSS.....u...............................idata...[...p...\.................@....edata..P........... ..............@..P.tls................."...................rdata.............."..............@..P.reloc...............$..............@..P.rsrc...t!!......"!................@..P....................."..............@..P................................................................................................

C:\Program Files (x86)\GeoSetter\is-1BDNO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	725157
Entropy (8bit):	6.524824451329979
Encrypted:	false
SSDEEP:	12288:2sMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyRI:xMcMoi3rPR37dzHRA6G7WbuSEmK50syN
MD5:	42BBDA837847088254DD951A9A5F6303
SHA1:	AFD6CA3468E663C9506F8E817E73B7A9F1AD0427
SHA-256:	5C2C9DC3C3C3A3D7A3DFBB27262A9E971D34D346071BF93DBA26BE26AE3F91C3
SHA-512:	9BE157DAFE4C48F09FC9DB8A904EB1078D1562165B09B6EAEB9DED4A6E663DC193CD020CE7B669A70FEFAFBD4B787C60DBE907E663677FE3C1F885B92D6CFC6F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&...........................................................0......................................................CODE............................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..P....@......................@..P.rsrc...............................@..P.....................r..............@..P........................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-5LPT9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	750900
Entropy (8bit):	5.919233786288461
Encrypted:	false
SSDEEP:	6144:ZSrynUJJ0YqLcoxaaSOnMr0Rj+H4x+q6CgIfMDRfy2LRxWRFU0pWXs2uxm6Tokeg:wrynUJ2YqLcMxVV+Ygq6CgIfMA2Lc
MD5:	1B3D9B17D4233044C3D4CD69744D868B
SHA1:	896325C935141C8813D1343834B5B04583D38F2D
SHA-256:	9189F08C9EA21898D23783BBA3D3089093F5320D71295F1FCCFAB2EC6B0745CB
SHA-512:	943A0B2BE7A3C98E93D69D9F777BB541E7E987F87DA2677EBA11F7705969D995444E1E71673FD82EF29DAE446F5D512AAED4C7FC659EEDE6C0AB0699F39D6697
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........@..g.....& .....#.....PM..p%.......................................................................................................p...................H...................................................................t..H............................text....#.......$.................. ..`.data.......@...,...(..............@....rdata...D...p...F...T..............@..@.pdata...H.......J..................@..@.bss....PM...............................CRT.........`......................@....idata.......p......................@....edata..............................@..@.rsrc...............................@....reloc..............................@..B/4..................."..............@..B/16.................................@..B/30.................. ..............@..B/42..................4..............@..B................................................

C:\Program Files (x86)\GeoSetter\is-B0F3I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	988936
Entropy (8bit):	6.85202685649218
Encrypted:	false
SSDEEP:	24576:NRBlpbQLEDnmOMJSKvs43BIUr35RRLjAGTrg/sb:/j4E6NJ5HB535HLjAGTM/sb
MD5:	64B64B8D72634EA8A454AD0CDC2B3A12
SHA1:	63C31D6003D3442A4C70C3E39F2183CD8F7C31B3
SHA-256:	09E114904F423A9E30A6AF70E2A286376A9325ECD6400926C2710204F609F8D3
SHA-512:	66EB2C044959CC6F2ABBC4FC4F7921F1079B85942AAC914D9165F6E1FCDABCC63C7E4E84BD14F9D999AE636214C628FC288373789DF4E7D7AA6E722B35D34350
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.Tp.x:#.x:#.x:#\|..#.x:#.6.#.x:#..#!x:#.x;#`x:#...#.x:#...#.x:#..#&y:#..#Yx:#..#.x:#..#.x:#..#.x:#Rich.x:#........PE..L....tES...........!.........z.......@...............................................}...............................t...>..8l..P............................... ...0...................................@............................................text...~~.......................... ..`.rdata...#.......$..................@..@.data...............................@....rsrc................Z..............@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-HJO89.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337920
Entropy (8bit):	6.5178783700918705
Encrypted:	false
SSDEEP:	6144:M6MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1Pi5:M6MNzVgz1LgXCpfoaDqHojjYkARqPL0r
MD5:	E2616501D38321DFFE061456EA53899B
SHA1:	8C67AB03D4C19C3ED25B0CB73BFF47E953F10050
SHA-256:	BB8EE38E365913AF381B5911BCB2D9722177DC9DE5DD311C17B020C16DD6BEC0
SHA-512:	81AA45AE5AD68CAB7994CA6D9FA2A2244F9865A3CD7DC3E37B0D18C18CDC0C453D65BA48B807F6F2A82FF7A9EA71FCDF48964831C6DC46545BDC02FC4DC7D343
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`...3...3...3...3...3..f3...3..w3...3..q3...3...3i..3..a3...3..p3...3..v3...3..s3...3Rich...3........PE..L....Y{]...........!.........l......i5...............................................F..............................@....).....<....0..0....................@...,..@...............................@...@............................................text...j........................... ..`.rdata..............................@..@.data....[.......@..................@....rsrc...0....0......................@..@.reloc...3...@...4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-KONM9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	299520
Entropy (8bit):	6.185961311364828
Encrypted:	false
SSDEEP:	6144:yE2eKJePDxNrdidrV/6dn/rvDvjsyOAKSM2sT6Agjbh:nxKMbhyrV/6dn/zsyOAM6A
MD5:	1FA0B840106D39602894E5C5FFE49951
SHA1:	1B727C746E4C40DCF20D029938480156935C8CB0
SHA-256:	27DDF78ECEB8DB8449A6210E19CAFD5A785B494DF997990093E5AA56409078E6
SHA-512:	06F6D2E7937F8EC50232900A35509D26AA7011A152ACA1ED9D1691F0E2CEE999CECA289635B5F655F6CB995A357ADD76C345F38C88E5DE896A8273D69D7A0DC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....}L...........#.....P...p...............`....@..........................@..................................................~...............................,$...................................................................................text....P.......B.................. ..`.data....p...`.......H..............@....tls.................N..............@....idata...............P..............@..@.edata...............\..............@..@.rsrc................^..............@..@

C:\Program Files (x86)\GeoSetter\is-LEN5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	510563
Entropy (8bit):	6.212655849320538
Encrypted:	false
SSDEEP:	6144:zL6U5v/dRVgJFnffwFYQ3FjQMVi/ia+st8qWDDeSf2BUTijBVSJ7IizVb5Gzu6qk:PZ5NRVwVff5Q3FUMk/dt6eSfyUV7FzHu
MD5:	6CEC2728D55229767B64CAF85EE4BE17
SHA1:	E5AE2389B1B9CD51B56AC7A33490DCC126691447
SHA-256:	28E075B446F3EE3A30A2B82A6B372931D31B7746B96528980C04A35415806E6E
SHA-512:	00BE403EB1F02ED1BC50A556B9F5006832B638753538ACD83CBD642BF17BEAD763692E503A430C61DE37A1FA2BE76CE73FADD8DFEFE44A8203EE12BDF5E517AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........R..v......!....P...d!..8J.............................................................................................................................. 2...................................................................................text...P........................... ..`.data...d!......."..................@....rdata..p...........................@..@.bss....8J...p...........................CRT.................J..............@....idata...............L..............@....edata...............Z..............@..@.rsrc................\..............@....reloc.. 2.......4...j..............@..B.stab...p/...@...0..................@..B.stabstrr....p......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-OMIVA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1380864
Entropy (8bit):	6.849004938666354
Encrypted:	false
SSDEEP:	24576:wb9g+KpPh4i6HsyTx1tzrMDvuMbmcXxpOdJqFrG/kqg1:X56x1tzrMDvuiXxpO7qs/kP1
MD5:	7F82243694193B7BC23334112872E348
SHA1:	BD0806E27BBB7B53D88165760EC35E91C1AA512D
SHA-256:	3448C67CD01ECC5D74611C4FD7DC7C73AB73E77AF5B49BABCC6DF5D6B3A1C309
SHA-512:	05BC2E0A2C1DCF5F651F3F646A458160854F2CDF8FD9AF6B9ED7907E5E9E17F0E406538D550A91AEDFABC356D33A0A4E0987ADA4D81FBCCFC217A773B6CCB4BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L....Y{]...........!................o...............................................R................................A.......6..x.......0...........................p...................................@...............(............................text...t........................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-P21BL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.842364266823586
Encrypted:	false
SSDEEP:	6144:tkoF5P41jBNIOMGF04OmRSTf1jXJnWyXSkqAOXGm:3Fp4j3IOMG+4OmRSTLWCSkq4
MD5:	D150AF5B2CA2D94FFB18757F0EDEE01F
SHA1:	A5CE5C6803379912BFCC204D6360F0D1F10F7503
SHA-256:	9F449BD374EEB6C6416AEEA7F7C236911D6F375DB587AB4552ACB1A65DD4F346
SHA-512:	DABE7611FA6BB9D0567BD2005D1C6ACD51C024C7DA38700E844AFAE59C13693D449168DA58CF0B2600ADB604A398201A38269588F340DCBC2DDE0E640D72576A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........pe.............j_....................P....i.....................................Rich............PE..L...N..Q.........."!.........p.......A....................................................@.....................................<....`.......................p..xH.....................................@...............@............................text...)........................... ..`.rdata..............................@..@.data... ...........................@....rsrc........`......................@..@.reloc...V...p...X..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\is-UPJO3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27282
Entropy (8bit):	5.2209833125168945
Encrypted:	false
SSDEEP:	768:HSaYonfavq3g/ZC60WtNos+5D1Ekz5UlzFwXNkCKZbBfYpbn5ceqLKk3P49IZ9Zq:HSaYonfavq3g/ZN0WtNos+5D1Ekz5UlQ
MD5:	821A20750A34596C957D5D72AB982DF3
SHA1:	7A29D183310B08E36E2051BDAA3CAF7451C1BEC2
SHA-256:	959E7D4B95CD96BE391C7115AA013045A578FED5F5C469EA95FDA6DB82A7D69B
SHA-512:	A1BAF9988BB754D499412F1D6B552F04D95DCA9B2994E062BB26AE1D0CAAE444E211CEEDC04C4DD857B21E2546E7478BB6BBE74183E67256235BC4F799033435
Malicious:	false
Preview:	Apple iPhone = 9.61..Apple iPhone 3G = 9.61..Apple iPhone 3Gs = 9.61..Apple iPhone 4 = 7.64..CAMERA 5MP-9A3 = 4.861..Canon Canon DIGITAL IXUS 300 = 6.66..Canon Canon DIGITAL IXUS v2 = 6.66..Canon Canon EOS 1000D = 1.60..Canon Canon EOS 10D = 1.60..Canon Canon EOS 20D = 1.60..Canon Canon EOS 300D DIGITAL = 1.60..Canon Canon EOS 350D DIGITAL = 1.60..Canon Canon EOS 40D = 1.60..Canon Canon EOS 50D = 1.60..Canon Canon EOS 400D = 1.60..Canon Canon EOS 400D DIGITAL = 1.60..Canon Canon EOS 450D = 1.60..Canon Canon EOS 500D = 1.60..Canon Canon EOS 550D = 1.60..Canon Canon EOS 600D = 1.60..Canon Canon EOS 650D = 1.60..Canon Canon EOS 60D = 1.60..Canon Canon EOS 5D = 1.00..Canon Canon EOS 5D Mark II = 1.00..Canon Canon EOS 5D Mark III = 1.00..Canon Canon EOS 7D = 1.60..Canon Canon EOS D60 = 1.60..Canon Canon EOS DIGITAL REBEL = 1.60..Canon Canon EOS DIGITAL REBEL XSi = 1.60..Canon Canon PowerShot 350 = 7.21..Canon Canon PowerShot 600 = 7.21..Canon Canon PowerShot A10 = 6.56..Canon Canon PowerSho

C:\Program Files (x86)\GeoSetter\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1380864
Entropy (8bit):	6.849004938666354
Encrypted:	false
SSDEEP:	24576:wb9g+KpPh4i6HsyTx1tzrMDvuMbmcXxpOdJqFrG/kqg1:X56x1tzrMDvuiXxpO7qs/kP1
MD5:	7F82243694193B7BC23334112872E348
SHA1:	BD0806E27BBB7B53D88165760EC35E91C1AA512D
SHA-256:	3448C67CD01ECC5D74611C4FD7DC7C73AB73E77AF5B49BABCC6DF5D6B3A1C309
SHA-512:	05BC2E0A2C1DCF5F651F3F646A458160854F2CDF8FD9AF6B9ED7907E5E9E17F0E406538D550A91AEDFABC356D33A0A4E0987ADA4D81FBCCFC217A773B6CCB4BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L....Y{]...........!................o...............................................R................................A.......6..x.......0...........................p...................................@...............(............................text...t........................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\cs\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1918 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	162185
Entropy (8bit):	5.466401330534276
Encrypted:	false
SSDEEP:	3072:t3rjKZ6CcP9Ih3e8/rn2wrhvRlk0bLQC/JXDU6TC9IA:t3qZ61P9Ih3e8v1vn/JXD3C9h
MD5:	0BB7FFFC0D4958BD5D5877E74ED4E256
SHA1:	A9A121CEDE14DFF01B14B6E6A4D2F33234383808
SHA-256:	CF9075FA417755F459F66C614601B38D3778127787F8327643FCF65DEC7EA771
SHA-512:	C1ED2C7FC0E23E2A11B4190213CCB4462DAC34AA6843ADDCC6EA07D12CF66F749597267D628E5532F802DA77748311E059A4821AC7400EBF513A54352C9CA705
Malicious:	false
Preview:	........~........<.......w....................................-...............................5.......?.......[.......d.......{...........1.......(......'.......D...3...#...x.................../..............................,...........K.......T.......m.......t........................................................................................................................................%.......3.......A.......K.......R.......e.......o.......z...................................................................G.......O.........B......m...........,.......i......'...9...,...a.................................................................%.....................$...................2.......<...6...@.......w................... ..............&..........................)...;...4...$...p...........E.......#..............!..........?......j........................................3...........4.......=.......T.......l.......\|...........$.........................

C:\Program Files (x86)\GeoSetter\locale\cs\LC_MESSAGES\is-29I7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: Time Zones 'Abidjan'
Category:	dropped
Size (bytes):	16104
Entropy (8bit):	4.724354920868901
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZjsjWLHWAFQ6CbBwp+1iMnbmji:WyayF1tXGBwg1FnCji
MD5:	0CFF70F60DEAE422703790898CCDFB71
SHA1:	B8FCB6A220510C544AAF3C2A249829C52510058D
SHA-256:	9C9F5D243EFF49D8ABE918B7E7E71D831454629C4EFCDC6B8C8E462A610D256D
SHA-512:	1FEDF2D50FA13FE6FA5FF87F8171EC66FB74414D12F71E4F3E2BB5655938D08A08CEA5A622CB77426F0159CACA2154D67B635D8DC47A36D3E30CF32BE4E273BA
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\cs\LC_MESSAGES\is-2UV3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1918 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	162185
Entropy (8bit):	5.466401330534276
Encrypted:	false
SSDEEP:	3072:t3rjKZ6CcP9Ih3e8/rn2wrhvRlk0bLQC/JXDU6TC9IA:t3qZ61P9Ih3e8v1vn/JXD3C9h
MD5:	0BB7FFFC0D4958BD5D5877E74ED4E256
SHA1:	A9A121CEDE14DFF01B14B6E6A4D2F33234383808
SHA-256:	CF9075FA417755F459F66C614601B38D3778127787F8327643FCF65DEC7EA771
SHA-512:	C1ED2C7FC0E23E2A11B4190213CCB4462DAC34AA6843ADDCC6EA07D12CF66F749597267D628E5532F802DA77748311E059A4821AC7400EBF513A54352C9CA705
Malicious:	false
Preview:	........~........<.......w....................................-...............................5.......?.......[.......d.......{...........1.......(......'.......D...3...#...x.................../..............................,...........K.......T.......m.......t........................................................................................................................................%.......3.......A.......K.......R.......e.......o.......z...................................................................G.......O.........B......m...........,.......i......'...9...,...a.................................................................%.....................$...................2.......<...6...@.......w................... ..............&..........................)...;...4...$...p...........E.......#..............!..........?......j........................................3...........4.......=.......T.......l.......\|...........$.........................

C:\Program Files (x86)\GeoSetter\locale\cs\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: Time Zones 'Abidjan'
Category:	dropped
Size (bytes):	16104
Entropy (8bit):	4.724354920868901
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZjsjWLHWAFQ6CbBwp+1iMnbmji:WyayF1tXGBwg1FnCji
MD5:	0CFF70F60DEAE422703790898CCDFB71
SHA1:	B8FCB6A220510C544AAF3C2A249829C52510058D
SHA-256:	9C9F5D243EFF49D8ABE918B7E7E71D831454629C4EFCDC6B8C8E462A610D256D
SHA-512:	1FEDF2D50FA13FE6FA5FF87F8171EC66FB74414D12F71E4F3E2BB5655938D08A08CEA5A622CB77426F0159CACA2154D67B635D8DC47A36D3E30CF32BE4E273BA
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\cs\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.379006389034776
Encrypted:	false
SSDEEP:	12:Kf2jojn2ns9RrzfLsxnvjRdEm7+p1PHHlw3:K+Nns9RrzoDEm7QvFw3
MD5:	DBCD37F15A404C9D4F72CE563DDC679E
SHA1:	6B5DAFED9642473B1A38EABCBAF3A5024F4BBEA3
SHA-256:	15C1FC8CC964A8536CC7B15B24F0ED3FA4740EBE6A74AE1554FFC905CDAC4081
SHA-512:	7CB07C24D133F384298042BF94B6EA4EAEB9DFA90F82070DBBDD06D206D95CD8C7D3AFDE9A71C10472E044D9B555D1A0F1224CAD851EAEF91E81F1875C25A464
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................9...]..........................................A......XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,....G....q.k.::.44....)).##................//....M...u.q.l.::.44.//..$$.............22....Q...z.v.q.m.:;.55.//..$$..........66....U...}.z.v.c......................Y.....~.m.................................].....s...................................._...y........................................]............................................._..............................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\cs\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.456564762130953
Encrypted:	false
SSDEEP:	3:dayWLRLUU:daxmU
MD5:	097587A54608593CBA3CC1467439823A
SHA1:	4E6B28FE47DF537585054C55F98BB583E67DD8E1
SHA-256:	244EA0F40E26BC3C5B1AE1DCD8C1DE6678FF9CD983612E139D6BFE83ADC8F954
SHA-512:	152729B2EE709E4FC006A89076743C5CB27D6FD78661FA843D2C2BBC3C75CADFAC4DB183161D9955BA1B627A9E44D78BB1FEDC0F588E436170E5952349E8D60D
Malicious:	false
Preview:	Czech..3.4.13.0

C:\Program Files (x86)\GeoSetter\locale\cs\is-8KKC9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.379006389034776
Encrypted:	false
SSDEEP:	12:Kf2jojn2ns9RrzfLsxnvjRdEm7+p1PHHlw3:K+Nns9RrzoDEm7QvFw3
MD5:	DBCD37F15A404C9D4F72CE563DDC679E
SHA1:	6B5DAFED9642473B1A38EABCBAF3A5024F4BBEA3
SHA-256:	15C1FC8CC964A8536CC7B15B24F0ED3FA4740EBE6A74AE1554FFC905CDAC4081
SHA-512:	7CB07C24D133F384298042BF94B6EA4EAEB9DFA90F82070DBBDD06D206D95CD8C7D3AFDE9A71C10472E044D9B555D1A0F1224CAD851EAEF91E81F1875C25A464
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................9...]..........................................A......XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,....G....q.k.::.44....)).##................//....M...u.q.l.::.44.//..$$.............22....Q...z.v.q.m.:;.55.//..$$..........66....U...}.z.v.c......................Y.....~.m.................................].....s...................................._...y........................................]............................................._..............................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\cs\is-D3HKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.456564762130953
Encrypted:	false
SSDEEP:	3:dayWLRLUU:daxmU
MD5:	097587A54608593CBA3CC1467439823A
SHA1:	4E6B28FE47DF537585054C55F98BB583E67DD8E1
SHA-256:	244EA0F40E26BC3C5B1AE1DCD8C1DE6678FF9CD983612E139D6BFE83ADC8F954
SHA-512:	152729B2EE709E4FC006A89076743C5CB27D6FD78661FA843D2C2BBC3C75CADFAC4DB183161D9955BA1B627A9E44D78BB1FEDC0F588E436170E5952349E8D60D
Malicious:	false
Preview:	Czech..3.4.13.0

C:\Program Files (x86)\GeoSetter\locale\da\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1242 messages, Project-Id-Version: ' (%dx%d)'
Category:	dropped
Size (bytes):	87685
Entropy (8bit):	5.216188358713261
Encrypted:	false
SSDEEP:	1536:FjvZgkQrLMkm0Bb4Z9hMnh3WjdI64hyyuiSEfa7aINpj7RGkkK:9hgAzKh3YWSEfNINF8kx
MD5:	7B8617120F684BC6B54D30071AE6B768
SHA1:	98D26FE5C0A6EC1F98C67AB15D0CEA37051581C4
SHA-256:	6ED52ABEDF4090F593C6A937287281137CF9E38A54AE44F4B19CFB828C1AC141
SHA-512:	977E38DD20EF52BDF2F78C281D8BE7F0853C534071C45209476099E2CA23346E714A24AF8B421D8CA0339F622CC9CAC880E16E7E4820590C8E25F1084129A5AF
Malicious:	false
Preview:	.................&..y....M.......g.......g.......g.......g.......g.......g.......g..(....h..'...0h..#...Xh......\|h.......h.......h.......h.......h.......h.......h.......h.......i.......i.......i.......i......!i....../i......5i......;i......Ii......Oi......Wi......\i......`i......gi......mi......ri.......i.......i.......i.......i.......i.......i.......i.......i.......i.......i......i.....&j..,...Qj..'...~j..,....j.......j.......j.......j.......j.......j.......k..$....k......7k..6...;k......rk.......k.......k..;....k..$....k..E....l..#...Gl......kl..!...\|l.......l.......l.......l.......l..3....l......,m......5m......Em......`m......hm......qm.......m......*n......>n..h...Vn.......n.......o.......o.......o.......o.......o.......o.......o.......o.......p.......p...... p..g...)p.......p.......p.......p..e....p..X...$q......}q.......q.......q.......q..5....q.......q.......q..0....q..%.../r......Ur.......r.."....s..6....s.......s.......s.......t.......t.......t......,t......5t......Jt......

C:\Program Files (x86)\GeoSetter\locale\da\LC_MESSAGES\is-H0F7H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZDATA
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.261277754950746
Encrypted:	false
SSDEEP:	6:ilijD6YYOxfbXsxfp0tfq+PU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLijn:i4D6xOyx2TPU//IMBivXmBQWiRc5lHa9
MD5:	E10F7E59DD86B9D710BAC02662BDDFD4
SHA1:	CBE47FA99CE804755A160EFFD1B85DBE6A626897
SHA-256:	0BD5365D643D61611F66CAB51D25BECAB9E2E419C2553AC3F08582333B8EDDE3
SHA-512:	C211EC41861EE9F9A697ACAFEFBFCCCA0BF61CB02F98CCCCABAA472BA0BB0D2EF4E43B1EEDFF422AA522CD2EC3F99E04B4A78C3EF33B903A6875BCA26706A9E4
Malicious:	false
Preview:	................$.......,.......8...c...9................Project-Id-Version: TZDATA.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-01 12:26+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Danish.X-Poedit-Country: DENMARK..

C:\Program Files (x86)\GeoSetter\locale\da\LC_MESSAGES\is-ICAH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1242 messages, Project-Id-Version: ' (%dx%d)'
Category:	dropped
Size (bytes):	87685
Entropy (8bit):	5.216188358713261
Encrypted:	false
SSDEEP:	1536:FjvZgkQrLMkm0Bb4Z9hMnh3WjdI64hyyuiSEfa7aINpj7RGkkK:9hgAzKh3YWSEfNINF8kx
MD5:	7B8617120F684BC6B54D30071AE6B768
SHA1:	98D26FE5C0A6EC1F98C67AB15D0CEA37051581C4
SHA-256:	6ED52ABEDF4090F593C6A937287281137CF9E38A54AE44F4B19CFB828C1AC141
SHA-512:	977E38DD20EF52BDF2F78C281D8BE7F0853C534071C45209476099E2CA23346E714A24AF8B421D8CA0339F622CC9CAC880E16E7E4820590C8E25F1084129A5AF
Malicious:	false
Preview:	.................&..y....M.......g.......g.......g.......g.......g.......g.......g..(....h..'...0h..#...Xh......\|h.......h.......h.......h.......h.......h.......h.......h.......i.......i.......i.......i......!i....../i......5i......;i......Ii......Oi......Wi......\i......`i......gi......mi......ri.......i.......i.......i.......i.......i.......i.......i.......i.......i.......i......i.....&j..,...Qj..'...~j..,....j.......j.......j.......j.......j.......j.......k..$....k......7k..6...;k......rk.......k.......k..;....k..$....k..E....l..#...Gl......kl..!...\|l.......l.......l.......l.......l..3....l......,m......5m......Em......`m......hm......qm.......m......*n......>n..h...Vn.......n.......o.......o.......o.......o.......o.......o.......o.......o.......p.......p...... p..g...)p.......p.......p.......p..e....p..X...$q......}q.......q.......q.......q..5....q.......q.......q..0....q..%.../r......Ur.......r.."....s..6....s.......s.......s.......t.......t.......t......,t......5t......Jt......

C:\Program Files (x86)\GeoSetter\locale\da\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZDATA
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.261277754950746
Encrypted:	false
SSDEEP:	6:ilijD6YYOxfbXsxfp0tfq+PU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLijn:i4D6xOyx2TPU//IMBivXmBQWiRc5lHa9
MD5:	E10F7E59DD86B9D710BAC02662BDDFD4
SHA1:	CBE47FA99CE804755A160EFFD1B85DBE6A626897
SHA-256:	0BD5365D643D61611F66CAB51D25BECAB9E2E419C2553AC3F08582333B8EDDE3
SHA-512:	C211EC41861EE9F9A697ACAFEFBFCCCA0BF61CB02F98CCCCABAA472BA0BB0D2EF4E43B1EEDFF422AA522CD2EC3F99E04B4A78C3EF33B903A6875BCA26706A9E4
Malicious:	false
Preview:	................$.......,.......8...c...9................Project-Id-Version: TZDATA.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-01 12:26+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Danish.X-Poedit-Country: DENMARK..

C:\Program Files (x86)\GeoSetter\locale\da\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.9319938079394685
Encrypted:	false
SSDEEP:	12:Kf2qkoXi+xxSi+DYcBF53ATpl4ZzM7AqSeU0zuYRJlo2acq:K+q7Xxx9+kcBFKTQNMgeFTi2al
MD5:	D98D57C887E126559E2822BAC8749769
SHA1:	62B1105333FED93FB966305268C4CB226077A642
SHA-256:	485651EB621A5A26AC8A26A196DD8657E64E134AA479EB7F8D32935FF959E9BE
SHA-512:	BD52230A2FE88C902CE2922B06B6E222CA191D9664A74409BC7BB52767D5D4F1A4A61A9760949EB1FA99D86D11364790287B8ED60A8BDE77FE5FDAF35E97B517
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.......NN.BB.==.99.55.22.//.,,.......ff.DD.??.::.......11.##................//.......jj.II.EE.??.......87.**.$$.............22.......................................................................................................vv.XX.TT.PO.......AA.<;.66.00.++.%%. .??.......yy.\\.YY.TT.......NN.BA.<<.67.11.++.&&.DD.......z{.__.\\.YY.......TS.GG.BB.=<.77.11.,,.II.......{{.{{.yy.ww.......st.ii.ee.``.\\.WW.SS.NN......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\da\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.5898980954642865
Encrypted:	false
SSDEEP:	3:BKo9LThn:BKop1
MD5:	9129F564F95C8EEC90CCACB2379D5FC1
SHA1:	F10D80D80905480064CCBE4C339A35ADBC1548B3
SHA-256:	7CB5063EA3C2B7000E1112D1A8E4BE912F8D0273C6715320C62166CC0D5A5F48
SHA-512:	472B21016F28DFBC54EED06E51FCA7DCCE46E922B820AC0A4C4EB483B53C023626A44F93C0FE0BA618FA86B2E8826B4686C3B65CB724CCA2386E89886D4EB0E7
Malicious:	false
Preview:	Danish..2.4.6.0

C:\Program Files (x86)\GeoSetter\locale\da\is-78904.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.9319938079394685
Encrypted:	false
SSDEEP:	12:Kf2qkoXi+xxSi+DYcBF53ATpl4ZzM7AqSeU0zuYRJlo2acq:K+q7Xxx9+kcBFKTQNMgeFTi2al
MD5:	D98D57C887E126559E2822BAC8749769
SHA1:	62B1105333FED93FB966305268C4CB226077A642
SHA-256:	485651EB621A5A26AC8A26A196DD8657E64E134AA479EB7F8D32935FF959E9BE
SHA-512:	BD52230A2FE88C902CE2922B06B6E222CA191D9664A74409BC7BB52767D5D4F1A4A61A9760949EB1FA99D86D11364790287B8ED60A8BDE77FE5FDAF35E97B517
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.......NN.BB.==.99.55.22.//.,,.......ff.DD.??.::.......11.##................//.......jj.II.EE.??.......87.**.$$.............22.......................................................................................................vv.XX.TT.PO.......AA.<;.66.00.++.%%. .??.......yy.\\.YY.TT.......NN.BA.<<.67.11.++.&&.DD.......z{.__.\\.YY.......TS.GG.BB.=<.77.11.,,.II.......{{.{{.yy.ww.......st.ii.ee.``.\\.WW.SS.NN......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\da\is-NTMAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.5898980954642865
Encrypted:	false
SSDEEP:	3:BKo9LThn:BKop1
MD5:	9129F564F95C8EEC90CCACB2379D5FC1
SHA1:	F10D80D80905480064CCBE4C339A35ADBC1548B3
SHA-256:	7CB5063EA3C2B7000E1112D1A8E4BE912F8D0273C6715320C62166CC0D5A5F48
SHA-512:	472B21016F28DFBC54EED06E51FCA7DCCE46E922B820AC0A4C4EB483B53C023626A44F93C0FE0BA618FA86B2E8826B4686C3B65CB724CCA2386E89886D4EB0E7
Malicious:	false
Preview:	Danish..2.4.6.0

C:\Program Files (x86)\GeoSetter\locale\de\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2018 messages, Project-Id-Version: Delphi7 german ' (%dx%d)'
Category:	dropped
Size (bytes):	177595
Entropy (8bit):	5.273330607826139
Encrypted:	false
SSDEEP:	3072:VCPZ2J3ghh3x8Lrn2NDkgsxrf7qohl3nkMWe3+:cUwhh3x8KkZxrf7XnHW3
MD5:	39B3DC9F66903D213C1F49A0711C972E
SHA1:	D8C0CB7E9E4D86C468A2DEEA0AF4732832B15978
SHA-256:	1890A57728393FB8427705C04D105957F6C02DF1599F6B046A5A0B1B465ED0AD
SHA-512:	1D810C0381D521405878E0B3BCC6B22E8C021CD906797C299461AE9203C598FA73BEA59619AF69336C15C869A4DF5B20FF66E9CB699701EE64535D86E3471978
Malicious:	false
Preview:	................,?......<~......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...........D.......#....................../...........N.......g.......r...,.................................................................................".......(...............<.......B.......J.......O.......S.......Z.......`.......e.......x......................................................................................................................................H.......G...f...O.................).......T...,...^...i.......'.......,...........J.......[......._.......h.......n.......z...................%.......................$.............................6...........3.......C.......L.......a.......t... ...............&.....................................;.......$...L.......q...E...~...#.............!.................F.......q..................................3..........................0.......

C:\Program Files (x86)\GeoSetter\locale\de\LC_MESSAGES\is-0V39L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 28 messages, Project-Id-Version: Olson TimeZone Data 'Afrika'
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	4.872972236742063
Encrypted:	false
SSDEEP:	24:N0lUIbqmLswTJWCaTl17XSJbOphvJtlORxhIxSXmRIoWsUZ95e:WKIbqmLsUJenGetMHhmPQsSu
MD5:	E1C4B2E31A54853D5F87084B5F2B7AAB
SHA1:	CAFF24752342F5882239C47C12B1FA6DA876E030
SHA-256:	B934BAA0B9E7D77049D76803DE01494DCC9FB3D7B3E2E806E76524BBFC8F1150
SHA-512:	DF22BFEE804CAE87A7B1130F99BFD6C612F0DBF9B89274C1627CDBC60CE47A701616CBBD35A208903B2EDFD144BB92797222558FCDC4F8AF4AEE3BE720E5FE2C
Malicious:	false
Preview:	....................%...........p.......q.......x...............................................................................................................................".......).......4.......;.......C.......J.......O.......V.......].......d...p...k............................................... .......5.......;.......A.......J.......U.......].......f.......o.......u........................................................................................................................................................................................................................................................Africa.America.America/Argentina.America/Indiana.America/Kentucky.America/North Dakota.Asia.Athens.Atlantic.Australia.Belgrade.Brussels.Bucharest.Cairo.Copenhagen.Europe.Indian.Lisbon.Luxembourg.Moscow.Pacific.Prague.Rome.Tirane.Vienna.Warsaw.Zurich.Project-Id-Version: Olson TimeZone Data.POT-Creation-Date: 2008-04-13 02:04.PO-Revision-Date: 2008-04-13 02:05+0100.Last-Tran

C:\Program Files (x86)\GeoSetter\locale\de\LC_MESSAGES\is-N6KFD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2018 messages, Project-Id-Version: Delphi7 german ' (%dx%d)'
Category:	dropped
Size (bytes):	177595
Entropy (8bit):	5.273330607826139
Encrypted:	false
SSDEEP:	3072:VCPZ2J3ghh3x8Lrn2NDkgsxrf7qohl3nkMWe3+:cUwhh3x8KkZxrf7XnHW3
MD5:	39B3DC9F66903D213C1F49A0711C972E
SHA1:	D8C0CB7E9E4D86C468A2DEEA0AF4732832B15978
SHA-256:	1890A57728393FB8427705C04D105957F6C02DF1599F6B046A5A0B1B465ED0AD
SHA-512:	1D810C0381D521405878E0B3BCC6B22E8C021CD906797C299461AE9203C598FA73BEA59619AF69336C15C869A4DF5B20FF66E9CB699701EE64535D86E3471978
Malicious:	false
Preview:	................,?......<~......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...........D.......#....................../...........N.......g.......r...,.................................................................................".......(...............<.......B.......J.......O.......S.......Z.......`.......e.......x......................................................................................................................................H.......G...f...O.................).......T...,...^...i.......'.......,...........J.......[......._.......h.......n.......z...................%.......................$.............................6...........3.......C.......L.......a.......t... ...............&.....................................;.......$...L.......q...E...~...#.............!.................F.......q..................................3..........................0.......

C:\Program Files (x86)\GeoSetter\locale\de\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 28 messages, Project-Id-Version: Olson TimeZone Data 'Afrika'
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	4.872972236742063
Encrypted:	false
SSDEEP:	24:N0lUIbqmLswTJWCaTl17XSJbOphvJtlORxhIxSXmRIoWsUZ95e:WKIbqmLsUJenGetMHhmPQsSu
MD5:	E1C4B2E31A54853D5F87084B5F2B7AAB
SHA1:	CAFF24752342F5882239C47C12B1FA6DA876E030
SHA-256:	B934BAA0B9E7D77049D76803DE01494DCC9FB3D7B3E2E806E76524BBFC8F1150
SHA-512:	DF22BFEE804CAE87A7B1130F99BFD6C612F0DBF9B89274C1627CDBC60CE47A701616CBBD35A208903B2EDFD144BB92797222558FCDC4F8AF4AEE3BE720E5FE2C
Malicious:	false
Preview:	....................%...........p.......q.......x...............................................................................................................................".......).......4.......;.......C.......J.......O.......V.......].......d...p...k............................................... .......5.......;.......A.......J.......U.......].......f.......o.......u........................................................................................................................................................................................................................................................Africa.America.America/Argentina.America/Indiana.America/Kentucky.America/North Dakota.Asia.Athens.Atlantic.Australia.Belgrade.Brussels.Bucharest.Cairo.Copenhagen.Europe.Indian.Lisbon.Luxembourg.Moscow.Pacific.Prague.Rome.Tirane.Vienna.Warsaw.Zurich.Project-Id-Version: Olson TimeZone Data.POT-Creation-Date: 2008-04-13 02:04.PO-Revision-Date: 2008-04-13 02:05+0100.Last-Tran

C:\Program Files (x86)\GeoSetter\locale\de\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.693621110700182
Encrypted:	false
SSDEEP:	12:Kf27+3Bip2evmV79s96URrmFDJTfH7m7ocRm:K+7s4zvmVpsI6CFDJTfH7m8
MD5:	50EB0FBC70D7442F4DA7F3CF20C20C45
SHA1:	8716C581CAC0A2805D512DC13C7F71F106DC5D8C
SHA-256:	CCB658E975BA5B94D607FE2C10B6CEA695485D55E8BD14C78D8D158665C1DA48
SHA-512:	EABF29E49CADAD86FCDE5DE3173D04F67AC71CA3437207A85D99BDA1799025E47A30B2AE84D0F8235881E28690C093AB721D986AE2B4315C9E12E6E02FA96D80
Malicious:	false
Preview:	BM8.......6...(......................................................................................................................................................................................./../../../../../../../../../../../\|./~./v./y./s./..........................z..v..s..o..k..i../y./.....h..a..Z..S..K..E..=..7../..)..".....m../../y....k..d..]..V..O..G..A..9..2..*..$.....l../?./?....mm.ff.__.YY.QQ.II.BB.;;.22.+,.$$....k\|./?./?....ss.nm.ff.``.YY.RR.JJ.CC.<<.33.,,.%$.p../?.5D....yy.ss.nn.hh.aa.ZZ.SR.KK.DD.<<.53.--.v../?.<If...~~.zz.tt.oo.hh.aa.[[.SS~KLxDEq<<l56ez../??<II......~~~zzzuuuoooihibbb[[[TTTMMMEEE==>.../??:GG........................................../??CLL:IL8GL<JL:FF6A@1??/??/??/??/??/??/??/??/??/??..................................................................................................

C:\Program Files (x86)\GeoSetter\locale\de\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.4565647621309536
Encrypted:	false
SSDEEP:	3:BoOwn:eNn
MD5:	2DB77D0C34EEA75A688EC70872A15737
SHA1:	45803D47AC49DF5BF97F2025ECC6EB6721F435C1
SHA-256:	7489DA20362D7D793AE41301A6D0DCFE0944E6F129F91733F99CFA747DDA3D94
SHA-512:	4B6CC63107ECBB60CED874589319B77D55582D6F21DAB0F4701176B3A76800228DE444A531D70060C32E80453A6B1D0DEB3629A9D297F61757F2542EDE57EE25
Malicious:	false
Preview:	German..3.5.1.1

C:\Program Files (x86)\GeoSetter\locale\de\is-7QD6H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.693621110700182
Encrypted:	false
SSDEEP:	12:Kf27+3Bip2evmV79s96URrmFDJTfH7m7ocRm:K+7s4zvmVpsI6CFDJTfH7m8
MD5:	50EB0FBC70D7442F4DA7F3CF20C20C45
SHA1:	8716C581CAC0A2805D512DC13C7F71F106DC5D8C
SHA-256:	CCB658E975BA5B94D607FE2C10B6CEA695485D55E8BD14C78D8D158665C1DA48
SHA-512:	EABF29E49CADAD86FCDE5DE3173D04F67AC71CA3437207A85D99BDA1799025E47A30B2AE84D0F8235881E28690C093AB721D986AE2B4315C9E12E6E02FA96D80
Malicious:	false
Preview:	BM8.......6...(......................................................................................................................................................................................./../../../../../../../../../../../\|./~./v./y./s./..........................z..v..s..o..k..i../y./.....h..a..Z..S..K..E..=..7../..)..".....m../../y....k..d..]..V..O..G..A..9..2..*..$.....l../?./?....mm.ff.__.YY.QQ.II.BB.;;.22.+,.$$....k\|./?./?....ss.nm.ff.``.YY.RR.JJ.CC.<<.33.,,.%$.p../?.5D....yy.ss.nn.hh.aa.ZZ.SR.KK.DD.<<.53.--.v../?.<If...~~.zz.tt.oo.hh.aa.[[.SS~KLxDEq<<l56ez../??<II......~~~zzzuuuoooihibbb[[[TTTMMMEEE==>.../??:GG........................................../??CLL:IL8GL<JL:FF6A@1??/??/??/??/??/??/??/??/??/??..................................................................................................

C:\Program Files (x86)\GeoSetter\locale\de\is-NTBDP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.4565647621309536
Encrypted:	false
SSDEEP:	3:BoOwn:eNn
MD5:	2DB77D0C34EEA75A688EC70872A15737
SHA1:	45803D47AC49DF5BF97F2025ECC6EB6721F435C1
SHA-256:	7489DA20362D7D793AE41301A6D0DCFE0944E6F129F91733F99CFA747DDA3D94
SHA-512:	4B6CC63107ECBB60CED874589319B77D55582D6F21DAB0F4701176B3A76800228DE444A531D70060C32E80453A6B1D0DEB3629A9D297F61757F2542EDE57EE25
Malicious:	false
Preview:	German..3.5.1.1

C:\Program Files (x86)\GeoSetter\locale\en\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 26 messages, Project-Id-Version: GeoSetter 'Add Group'
Category:	dropped
Size (bytes):	5386
Entropy (8bit):	4.971120159095264
Encrypted:	false
SSDEEP:	96:BQZ+Och/TURMmOEWb9e3QZTLI5Auch/xQURomOM219u3QZz:BQ+hIbAbaPAh5jPk1WM
MD5:	AEFC2485130B6DAAA5D1EA92CA44AE94
SHA1:	E7DFDEA2E0F600F8A218B569BE0498DFDBC40358
SHA-256:	C7DAD3C66CD429CBAEE9D832622201CB3EB30C265E533CDE9643D7EEAB06344A
SHA-512:	86B0EB35B1C24F7B351B5897F2F4F3C5060AEECA8DF1A45ED524169353D76B3713FDE2168E6514A6EE0B7DD2BA86997E5CBEA09238735BCB214BED288ACB5AA2
Malicious:	false
Preview:	....................%...........P.......Q...$...[...#...............5.......+.......".......1...;...*...m...............................................m.......x...R....................... ..................."...+...9.......e...........h...........b.......l...................5.......+.......".......,...<.......i.................../..........................._.......p...R....................... ................... ...&...7.......^................................................................................................................................................................Add Group.Add Offset Values to EXIF Taken Date.Add Time Zone(s) to EXIF Taken Date.Album Description.Always update EXIF data (GPS and taken date) in image.Assign Position and Data to Selected Images.Assign Position to Selected Images.By disabling this option, changed GPS data and EXIF taken date.will only be written to the sidecar file. The EXIF data won't be.updated in the image itself and the changes m

C:\Program Files (x86)\GeoSetter\locale\en\LC_MESSAGES\is-1LFOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 26 messages, Project-Id-Version: GeoSetter 'Add Group'
Category:	dropped
Size (bytes):	5386
Entropy (8bit):	4.971120159095264
Encrypted:	false
SSDEEP:	96:BQZ+Och/TURMmOEWb9e3QZTLI5Auch/xQURomOM219u3QZz:BQ+hIbAbaPAh5jPk1WM
MD5:	AEFC2485130B6DAAA5D1EA92CA44AE94
SHA1:	E7DFDEA2E0F600F8A218B569BE0498DFDBC40358
SHA-256:	C7DAD3C66CD429CBAEE9D832622201CB3EB30C265E533CDE9643D7EEAB06344A
SHA-512:	86B0EB35B1C24F7B351B5897F2F4F3C5060AEECA8DF1A45ED524169353D76B3713FDE2168E6514A6EE0B7DD2BA86997E5CBEA09238735BCB214BED288ACB5AA2
Malicious:	false
Preview:	....................%...........P.......Q...$...[...#...............5.......+.......".......1...;...*...m...............................................m.......x...R....................... ..................."...+...9.......e...........h...........b.......l...................5.......+.......".......,...<.......i.................../..........................._.......p...R....................... ................... ...&...7.......^................................................................................................................................................................Add Group.Add Offset Values to EXIF Taken Date.Add Time Zone(s) to EXIF Taken Date.Album Description.Always update EXIF data (GPS and taken date) in image.Assign Position and Data to Selected Images.Assign Position to Selected Images.By disabling this option, changed GPS data and EXIF taken date.will only be written to the sidecar file. The EXIF data won't be.updated in the image itself and the changes m

C:\Program Files (x86)\GeoSetter\locale\en\LC_MESSAGES\is-SU4JQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	421
Entropy (8bit):	5.291366276156011
Encrypted:	false
SSDEEP:	6:ilijGYYuVsxfp0tfqqPS/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLidAwIB:i4Gxuyx2la/IMBivXmBQWiRc5lCCB
MD5:	D41BC29EEE6ACFB71174B159D46A9AB6
SHA1:	195B504265202D2C9A10EFBCC7A95E80E361D861
SHA-256:	90730C9A4FC8286B3A25D73841B873961C4B41D7ED9747428BC5FEC9E6A99251
SHA-512:	D7BAA18A692E8CF571857A8B3AA45354D73F91A1FE494F86567099B685A84D6E176A5541A7A151BCC1E5BBB564F0D23343D6BE5638D6E08A0C05CA866E7C0215
Malicious:	false
Preview:	................$.......,.......8...k...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:34+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: English.X-Poedit-Country: UNITED KINGDOM..

C:\Program Files (x86)\GeoSetter\locale\en\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	421
Entropy (8bit):	5.291366276156011
Encrypted:	false
SSDEEP:	6:ilijGYYuVsxfp0tfqqPS/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLidAwIB:i4Gxuyx2la/IMBivXmBQWiRc5lCCB
MD5:	D41BC29EEE6ACFB71174B159D46A9AB6
SHA1:	195B504265202D2C9A10EFBCC7A95E80E361D861
SHA-256:	90730C9A4FC8286B3A25D73841B873961C4B41D7ED9747428BC5FEC9E6A99251
SHA-512:	D7BAA18A692E8CF571857A8B3AA45354D73F91A1FE494F86567099B685A84D6E176A5541A7A151BCC1E5BBB564F0D23343D6BE5638D6E08A0C05CA866E7C0215
Malicious:	false
Preview:	................$.......,.......8...k...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:34+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: English.X-Poedit-Country: UNITED KINGDOM..

C:\Program Files (x86)\GeoSetter\locale\en\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.912371847252986
Encrypted:	false
SSDEEP:	12:Kf2MQNBQdutoHLyPu8F/1ROtcfrUiCRow4CZqha2TPX:K+MFrym4/1ROtMrDCRoBHha2j
MD5:	74A3030A545945A1E4B88F7F70EFB621
SHA1:	8C1565BE61BC98B52FD91B7479B5FD4B59679878
SHA-256:	915580C56BE994363C08E3DFF542C32A75756817018849E8EA80094F845522DE
SHA-512:	C59F89BA9544D1372A61A2E258DA2A5B1296237B925D92742734246B13931FCF5E784656B85AAD1D4F9ED99766DAD12549196EB268EE7EBEC26E3DB367B7B3A3
Malicious:	false
Preview:	BM8.......6...(.........................................................................................................................................................................................zcD..iC.,..(..%....8..4.....s..p..m..~1...n5E.....x.......q.n...HT.CR.....fW.^U.....M`.rk.V7.....~....t\...-+.+).....?:......\`...g...^?...fZ......_c....42.1/.......AB......`Tk.......................==.86......................}a....dd.__.YY.TT.NN.LL.EE.??.99.44....++.FS.:.......................UU.NN........................b...~...........\\.XW....im.......IA.r.-...b................ie.a`.....t..........4...................................\|.............{.d.d..a...c.~`....kI.fH.\=..ZoQ..{..................................................................................................

C:\Program Files (x86)\GeoSetter\locale\en\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.8077635764171953
Encrypted:	false
SSDEEP:	3:OCCWZUbV:OCC3x
MD5:	5D7335F5595D01C708EAA7CDC456940A
SHA1:	140046C930892288DCB7435702342205CC719DCB
SHA-256:	ACBC7F519259F914707880A4DBD26FBE57BBEC5248D68578F55206271A1A2C4B
SHA-512:	98623DF9B9DFEA087D0990FEC36EB429B2DBC0074FE34AD21D2D3ED91669724C2E798CC082803BAEF40597131B1C6EA04A4D3D3F41C1F654C98D6897F18389AB
Malicious:	false
Preview:	English..3.4.12.0

C:\Program Files (x86)\GeoSetter\locale\en\is-79M9F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.8077635764171953
Encrypted:	false
SSDEEP:	3:OCCWZUbV:OCC3x
MD5:	5D7335F5595D01C708EAA7CDC456940A
SHA1:	140046C930892288DCB7435702342205CC719DCB
SHA-256:	ACBC7F519259F914707880A4DBD26FBE57BBEC5248D68578F55206271A1A2C4B
SHA-512:	98623DF9B9DFEA087D0990FEC36EB429B2DBC0074FE34AD21D2D3ED91669724C2E798CC082803BAEF40597131B1C6EA04A4D3D3F41C1F654C98D6897F18389AB
Malicious:	false
Preview:	English..3.4.12.0

C:\Program Files (x86)\GeoSetter\locale\en\is-C5T88.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.912371847252986
Encrypted:	false
SSDEEP:	12:Kf2MQNBQdutoHLyPu8F/1ROtcfrUiCRow4CZqha2TPX:K+MFrym4/1ROtMrDCRoBHha2j
MD5:	74A3030A545945A1E4B88F7F70EFB621
SHA1:	8C1565BE61BC98B52FD91B7479B5FD4B59679878
SHA-256:	915580C56BE994363C08E3DFF542C32A75756817018849E8EA80094F845522DE
SHA-512:	C59F89BA9544D1372A61A2E258DA2A5B1296237B925D92742734246B13931FCF5E784656B85AAD1D4F9ED99766DAD12549196EB268EE7EBEC26E3DB367B7B3A3
Malicious:	false
Preview:	BM8.......6...(.........................................................................................................................................................................................zcD..iC.,..(..%....8..4.....s..p..m..~1...n5E.....x.......q.n...HT.CR.....fW.^U.....M`.rk.V7.....~....t\...-+.+).....?:......\`...g...^?...fZ......_c....42.1/.......AB......`Tk.......................==.86......................}a....dd.__.YY.TT.NN.LL.EE.??.99.44....++.FS.:.......................UU.NN........................b...~...........\\.XW....im.......IA.r.-...b................ie.a`.....t..........4...................................\|.............{.d.d..a...c.~`....kI.fH.\=..ZoQ..{..................................................................................................

C:\Program Files (x86)\GeoSetter\locale\es\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1918 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	164654
Entropy (8bit):	5.240844332815449
Encrypted:	false
SSDEEP:	3072:t3rjK3BPOHLQ0cP9Ih3e8/rn2wrhvULtEb+zcMy:t3qxCMP9Ih3e8v1ULtar
MD5:	967A95F7C67CEF8E975CDEC3399E45FB
SHA1:	2BBF32698370C456EEC6E11B53CB3EDE87EC5974
SHA-256:	EDCFCC7DD149F79711F4620A6D1E86B4877B0F810FB1D17E7C58E40ADE24F078
SHA-512:	1342FA062404D7BC68928D645924BCB1B2B7B91CBDFC1F142EBC6264ABCBFF3F63C8AD74D4FC857FF1DD8555DEBE9EFF8A4CB24B70AFBF395CB272D288C0292A
Malicious:	false
Preview:	........~........<.......w....................................-...............................5.......?.......[.......d.......{...........1.......(......'.......D...3...#...x.................../..............................,...........K.......T.......m.......t........................................................................................................................................%.......3.......A.......K.......R.......e.......o.......z...................................................................G.......O.........B......m...........,.......i......'...9...,...a.................................................................%.....................$...................2.......<...6...@.......w................... ..............&..........................)...;...4...$...p...........E.......#..............!..........?......j........................................3...........4.......=.......T.......l.......\|...........$.........................

C:\Program Files (x86)\GeoSetter\locale\es\LC_MESSAGES\is-U1PFO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: 'Abidjan'
Category:	dropped
Size (bytes):	16124
Entropy (8bit):	4.729328831147774
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZDrtk66eA/hCbBwp+1JKvlw9u:WyayjYhGBwg1JKvC9u
MD5:	33480CBED156BF1BE423390FD30AD585
SHA1:	B0D11AD456B113E3BD5EFBCBFE635E5CCBADCC4A
SHA-256:	4D9F116C2F8713F8CCF0E79350F7FE706E717D0AB8AC1FA46564238F10674684
SHA-512:	85BB071C7236A1A5ED610572D77EA6B2188517B77C57320A92F132E90A850A1C51CC8B2468BB0AD778AF35F6E4C675BF0BC9EBFD901BE6D6934558B5D647BB9B
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\es\LC_MESSAGES\is-UUOS7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1918 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	164654
Entropy (8bit):	5.240844332815449
Encrypted:	false
SSDEEP:	3072:t3rjK3BPOHLQ0cP9Ih3e8/rn2wrhvULtEb+zcMy:t3qxCMP9Ih3e8v1ULtar
MD5:	967A95F7C67CEF8E975CDEC3399E45FB
SHA1:	2BBF32698370C456EEC6E11B53CB3EDE87EC5974
SHA-256:	EDCFCC7DD149F79711F4620A6D1E86B4877B0F810FB1D17E7C58E40ADE24F078
SHA-512:	1342FA062404D7BC68928D645924BCB1B2B7B91CBDFC1F142EBC6264ABCBFF3F63C8AD74D4FC857FF1DD8555DEBE9EFF8A4CB24B70AFBF395CB272D288C0292A
Malicious:	false
Preview:	........~........<.......w....................................-...............................5.......?.......[.......d.......{...........1.......(......'.......D...3...#...x.................../..............................,...........K.......T.......m.......t........................................................................................................................................%.......3.......A.......K.......R.......e.......o.......z...................................................................G.......O.........B......m...........,.......i......'...9...,...a.................................................................%.....................$...................2.......<...6...@.......w................... ..............&..........................)...;...4...$...p...........E.......#..............!..........?......j........................................3...........4.......=.......T.......l.......\|...........$.........................

C:\Program Files (x86)\GeoSetter\locale\es\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: 'Abidjan'
Category:	dropped
Size (bytes):	16124
Entropy (8bit):	4.729328831147774
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZDrtk66eA/hCbBwp+1JKvlw9u:WyayjYhGBwg1JKvC9u
MD5:	33480CBED156BF1BE423390FD30AD585
SHA1:	B0D11AD456B113E3BD5EFBCBFE635E5CCBADCC4A
SHA-256:	4D9F116C2F8713F8CCF0E79350F7FE706E717D0AB8AC1FA46564238F10674684
SHA-512:	85BB071C7236A1A5ED610572D77EA6B2188517B77C57320A92F132E90A850A1C51CC8B2468BB0AD778AF35F6E4C675BF0BC9EBFD901BE6D6934558B5D647BB9B
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\es\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.8893313659364415
Encrypted:	false
SSDEEP:	12:Kf26IfHVTolfp/i+LqmocqUVDlLFFyrNb8IL0ND08Nqqvmmf9:K+6Y+lR6uqmomxLTsb8g0NwAqqvmmf9
MD5:	4E21B7BEC4E946A209DBE9AE5B78C962
SHA1:	091B50B811A6C29CC890E366145F3BBE2D95A3AB
SHA-256:	01477A887317D76E4AC5EBB35FEDE25997C661C81E30A3DE5DEBE2C505F62A0A
SHA-512:	2A01AC11AD9D6391E663CC578723E306FD0D484E3A3973069BE6D3E61BD018C14088B5B7218C0AB6F3F2353963BCE4861423D7FFC5DC5D2D1DA6F65F3C9A2CA1
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//.......j..I.....K..J...=....$..............2........o..O.....Q..QS....H../....$...........6........s..S.....Sg.....B..6..0..+..%........;........v..X..U..W~.Wi...A..<..6..0..+..%.. ..?........y..\..Y..W..S..K..G..B..<..6..1..+..&..D........z{.__.\\.YY.TT.QQ.LL.GG.BB.=<.77.11.,,.II.......{{.{{.yy.ww.tt.qp.mm.ii.ee.``.\\.WW.SS.NN......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\es\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.640223928941851
Encrypted:	false
SSDEEP:	3:XLMiUW:X43W
MD5:	4DDB90B0FB38947220D256CD27E00C8F
SHA1:	BA757CEE8157F78370257D28FA4CA2C4FFE564C5
SHA-256:	01B1EFD9569C1451C2EB57BB2A1F5F5E9331CA3DA603443CE8DDF5CFCD169D31
SHA-512:	416BAE46D3FCCA7237BD2296893544C9AFCA3E32F275372375579D257065A4ED19332103667127579510DD2F9215C83374948DB3D4AF530C47B25FBCD8D913C5
Malicious:	false
Preview:	Spanish..3.4.13

C:\Program Files (x86)\GeoSetter\locale\es\is-24022.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.8893313659364415
Encrypted:	false
SSDEEP:	12:Kf26IfHVTolfp/i+LqmocqUVDlLFFyrNb8IL0ND08Nqqvmmf9:K+6Y+lR6uqmomxLTsb8g0NwAqqvmmf9
MD5:	4E21B7BEC4E946A209DBE9AE5B78C962
SHA1:	091B50B811A6C29CC890E366145F3BBE2D95A3AB
SHA-256:	01477A887317D76E4AC5EBB35FEDE25997C661C81E30A3DE5DEBE2C505F62A0A
SHA-512:	2A01AC11AD9D6391E663CC578723E306FD0D484E3A3973069BE6D3E61BD018C14088B5B7218C0AB6F3F2353963BCE4861423D7FFC5DC5D2D1DA6F65F3C9A2CA1
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//.......j..I.....K..J...=....$..............2........o..O.....Q..QS....H../....$...........6........s..S.....Sg.....B..6..0..+..%........;........v..X..U..W~.Wi...A..<..6..0..+..%.. ..?........y..\..Y..W..S..K..G..B..<..6..1..+..&..D........z{.__.\\.YY.TT.QQ.LL.GG.BB.=<.77.11.,,.II.......{{.{{.yy.ww.tt.qp.mm.ii.ee.``.\\.WW.SS.NN......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\es\is-QLHDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.640223928941851
Encrypted:	false
SSDEEP:	3:XLMiUW:X43W
MD5:	4DDB90B0FB38947220D256CD27E00C8F
SHA1:	BA757CEE8157F78370257D28FA4CA2C4FFE564C5
SHA-256:	01B1EFD9569C1451C2EB57BB2A1F5F5E9331CA3DA603443CE8DDF5CFCD169D31
SHA-512:	416BAE46D3FCCA7237BD2296893544C9AFCA3E32F275372375579D257065A4ED19332103667127579510DD2F9215C83374948DB3D4AF530C47B25FBCD8D913C5
Malicious:	false
Preview:	Spanish..3.4.13

C:\Program Files (x86)\GeoSetter\locale\fr\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1724 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	141963
Entropy (8bit):	5.239576176013512
Encrypted:	false
SSDEEP:	3072:yBsYbksSISh3D8N8fi0WmqJCubZwHGibeGZrYzpX3j7pyWg5rmz:ms+kDISh3D8lrbZAAtD7pyWg5ry
MD5:	081454744BE57525215F7BA047533C6E
SHA1:	11AF27C30B3751D29A898BD0E3202EBBDB33D38D
SHA-256:	1E6886A96FC7567E0429FE5543E53B4652B1EABB54C1B40403139FDC6BE4250B
SHA-512:	84BEAFE843547B3C6306AA5221001FAF506CE87A625B81B6D67D240E9337C8D95291A697FF7ADECE08200708963888D8C65DC959C4A2FA8685E7261F52C3607B
Malicious:	false
Preview:	.................5.......k.....................................-...............................#.......?.......H...(..._...'.......D.......#...................%.../...2.......b.......{...........,.......................................................................(.......6.......<.......B.......P.......V.......^.......c.......g.......n.......t.......y................................................................................................................... .......".......$......'......R.......}...,.......'.......,..................................'.......-.......9.......?.......F...%...U.......{...$.............................6..................!.......6... ...I.......j...&...~..........................;......$.........../...E...<...#...............!.......*..........................2.......D.......U...3...o..................................$.................. ..................h..........R.......H.......V......._.......k.......y...........I.......9...

C:\Program Files (x86)\GeoSetter\locale\fr\LC_MESSAGES\is-4IBSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1724 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	141963
Entropy (8bit):	5.239576176013512
Encrypted:	false
SSDEEP:	3072:yBsYbksSISh3D8N8fi0WmqJCubZwHGibeGZrYzpX3j7pyWg5rmz:ms+kDISh3D8lrbZAAtD7pyWg5ry
MD5:	081454744BE57525215F7BA047533C6E
SHA1:	11AF27C30B3751D29A898BD0E3202EBBDB33D38D
SHA-256:	1E6886A96FC7567E0429FE5543E53B4652B1EABB54C1B40403139FDC6BE4250B
SHA-512:	84BEAFE843547B3C6306AA5221001FAF506CE87A625B81B6D67D240E9337C8D95291A697FF7ADECE08200708963888D8C65DC959C4A2FA8685E7261F52C3607B
Malicious:	false
Preview:	.................5.......k.....................................-...............................#.......?.......H...(..._...'.......D.......#...................%.../...2.......b.......{...........,.......................................................................(.......6.......<.......B.......P.......V.......^.......c.......g.......n.......t.......y................................................................................................................... .......".......$......'......R.......}...,.......'.......,..................................'.......-.......9.......?.......F...%...U.......{...$.............................6..................!.......6... ...I.......j...&...~..........................;......$.........../...E...<...#...............!.......*..........................2.......D.......U...3...o..................................$.................. ..................h..........R.......H.......V......._.......k.......y...........I.......9...

C:\Program Files (x86)\GeoSetter\locale\fr\LC_MESSAGES\is-QK6B6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 46 messages, Project-Id-Version: 1.0 'Afrique'
Category:	dropped
Size (bytes):	2244
Entropy (8bit):	4.8007217768548385
Encrypted:	false
SSDEEP:	48:ZcDgjfKOEpGbsGnBpDKTVRN1z2g2g761+stoODwG3:Z1OOeGVpG31z2swn73
MD5:	DFFA07656814FF3DCB7F0FF0FE954069
SHA1:	C7A90E25135D7E10064A24C29F406A767926D067
SHA-256:	F3F5E52946D3B7B13AAE4F1452076FC70E923F0A8A5B0522380D881CE18C75A1
SHA-512:	7BF0EF0A184184FEB456B55BB6BFEA2091822A9B9F027B86B1F160FAD72A4DB93E6D39B7F16C095FFBF9A876A50F7E77F928CE3AD7F22137427C5A32B58AFD85
Malicious:	false
Preview:	....................=..................................................................?.......G.......R.......W.......^.......g.......q.......x....................................................................................................................................................................... .......'......./.......6.......;.......C.......Q.......Y.......`.......l.......s.......z.......................................3.......E.......^.......f.......q.......v.......................................................................................................................................!..............0.......8.......>.......D.......L.......T.......[.......c.......k.......s.......y...............................................................&...)...................(...*... ..............."...........................#...........................................................'...........+...................!.......%...............-.......................,.......

C:\Program Files (x86)\GeoSetter\locale\fr\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 46 messages, Project-Id-Version: 1.0 'Afrique'
Category:	dropped
Size (bytes):	2244
Entropy (8bit):	4.8007217768548385
Encrypted:	false
SSDEEP:	48:ZcDgjfKOEpGbsGnBpDKTVRN1z2g2g761+stoODwG3:Z1OOeGVpG31z2swn73
MD5:	DFFA07656814FF3DCB7F0FF0FE954069
SHA1:	C7A90E25135D7E10064A24C29F406A767926D067
SHA-256:	F3F5E52946D3B7B13AAE4F1452076FC70E923F0A8A5B0522380D881CE18C75A1
SHA-512:	7BF0EF0A184184FEB456B55BB6BFEA2091822A9B9F027B86B1F160FAD72A4DB93E6D39B7F16C095FFBF9A876A50F7E77F928CE3AD7F22137427C5A32B58AFD85
Malicious:	false
Preview:	....................=..................................................................?.......G.......R.......W.......^.......g.......q.......x....................................................................................................................................................................... .......'......./.......6.......;.......C.......Q.......Y.......`.......l.......s.......z.......................................3.......E.......^.......f.......q.......v.......................................................................................................................................!..............0.......8.......>.......D.......L.......T.......[.......c.......k.......s.......y...............................................................&...)...................(...*... ..............."...........................#...........................................................'...........+...................!.......%...............-.......................,.......

C:\Program Files (x86)\GeoSetter\locale\fr\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.333268573172441
Encrypted:	false
SSDEEP:	12:Kf2G63wUxklEfRM4N7oJA0VJgy2yAxJdfEdi:K+GAkMhR0VuyExfKi
MD5:	CC233735CD2BB52C34895096CE45230F
SHA1:	52839F26BF574C65F1073D41A94B7B5C5DD39952
SHA-256:	D77DCB40B079A27ABCB880675F4527697426B773997128A53AB4D057F4A33C9D
SHA-512:	0F9703DC57E72CD2A7E7E293341820412860DBCED9B793960869328BD3344E3ADF4B48794D43D38D1D95E1FE8275FEF3C08DE7B75290386B37FA68D7831BC07E
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................g?._5.W-.O#.G..................................qI........................am.]i.Yf.Uc.....wS..........................HV.CR.>M.Zf......[..........................O].HW.CR.]j.....c.........................Uc.O].JW.bn.....i.......................\i.Vd.P^.ht.....o.........................cp.\j.Wd.lx.....s............................jw.dp.]l.r~.....s...........................r}.kw.dq.x......s.....................................~......s.s.s.s.q...................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\fr\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:llLXUn:lK
MD5:	964511F91DC995C8253ED6AEB89E3096
SHA1:	1C311CF49B2FFD02B470642A2462F078107EAC2C
SHA-256:	18851AAF26AA2C4994237EFC70C9E1C597D15F6B0BCE730B87C6503B2CD40EF9
SHA-512:	F0F0F46C49966ACD98B2F87CB2F939CC46FC7AFCC643951A596DEB15D4584EE1D7AC739B704B4C3F0D98B315F3E8C548C51FEE51674AFB846A45E1608D6DB61A
Malicious:	false
Preview:	French..3.4.23.0

C:\Program Files (x86)\GeoSetter\locale\fr\is-JBD4N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.333268573172441
Encrypted:	false
SSDEEP:	12:Kf2G63wUxklEfRM4N7oJA0VJgy2yAxJdfEdi:K+GAkMhR0VuyExfKi
MD5:	CC233735CD2BB52C34895096CE45230F
SHA1:	52839F26BF574C65F1073D41A94B7B5C5DD39952
SHA-256:	D77DCB40B079A27ABCB880675F4527697426B773997128A53AB4D057F4A33C9D
SHA-512:	0F9703DC57E72CD2A7E7E293341820412860DBCED9B793960869328BD3344E3ADF4B48794D43D38D1D95E1FE8275FEF3C08DE7B75290386B37FA68D7831BC07E
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................g?._5.W-.O#.G..................................qI........................am.]i.Yf.Uc.....wS..........................HV.CR.>M.Zf......[..........................O].HW.CR.]j.....c.........................Uc.O].JW.bn.....i.......................\i.Vd.P^.ht.....o.........................cp.\j.Wd.lx.....s............................jw.dp.]l.r~.....s...........................r}.kw.dq.x......s.....................................~......s.s.s.s.q...................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\fr\is-MRADP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:llLXUn:lK
MD5:	964511F91DC995C8253ED6AEB89E3096
SHA1:	1C311CF49B2FFD02B470642A2462F078107EAC2C
SHA-256:	18851AAF26AA2C4994237EFC70C9E1C597D15F6B0BCE730B87C6503B2CD40EF9
SHA-512:	F0F0F46C49966ACD98B2F87CB2F939CC46FC7AFCC643951A596DEB15D4584EE1D7AC739B704B4C3F0D98B315F3E8C548C51FEE51674AFB846A45E1608D6DB61A
Malicious:	false
Preview:	French..3.4.23.0

C:\Program Files (x86)\GeoSetter\locale\it\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 560 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	40677
Entropy (8bit):	5.042438905090378
Encrypted:	false
SSDEEP:	768:QgoIj4Eq0GhC8u6MDChswBZcmIT6gn/9hfF62/X4vb:QgoIjnpf8/5Tgn/9hRwz
MD5:	4968E8C6F4E68CB4EFBC0373325BB043
SHA1:	7C66017278CADEC409B201F948A9BAD246BE7D02
SHA-256:	4D6451A3DFE104500B3BFEC42592A79A29F06CED8A720DECAEDBBC9576CAB381
SHA-512:	7EC2B3838717556C5B61614DF359E1B9DCFFACD031D622DB440CA3618EC001FF2C23CB6FE609933C628130715BFDA0E366072780AED3054EF8013E695AA1C1E2
Malicious:	false
Preview:	........0................#......................................./..(..../..'...H/..#...p/......./......./......./......./......./......./......./.......0.......0.......0......%0......00......90......G0......M0......S0......a0......g0......o0......t0......x0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0......0.....)1..'...T1..,...\|1.......1.......1.......1.......1..$....1.......1.......1..!....2......$2......<2......R2......[2......w2......{2.......2.......2.......2..e....2.......3.......3......33..%...<3.."...b3..6....3.......3.......3.. ....3..)....3..4...%4......Z4......l4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4..0....5.....65......a5..e...h5..)....5..!....5..5....6......P6..+...c6..2....6.......6..&....6..#....7.."...+7......N7......^7......t7.......7.......7.......7.......7.......7.."....7.......8......48......98.. ...Y8......z8.......8......8.......8.......8.......8..!....8......

C:\Program Files (x86)\GeoSetter\locale\it\LC_MESSAGES\is-7IQFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 560 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	40677
Entropy (8bit):	5.042438905090378
Encrypted:	false
SSDEEP:	768:QgoIj4Eq0GhC8u6MDChswBZcmIT6gn/9hfF62/X4vb:QgoIjnpf8/5Tgn/9hRwz
MD5:	4968E8C6F4E68CB4EFBC0373325BB043
SHA1:	7C66017278CADEC409B201F948A9BAD246BE7D02
SHA-256:	4D6451A3DFE104500B3BFEC42592A79A29F06CED8A720DECAEDBBC9576CAB381
SHA-512:	7EC2B3838717556C5B61614DF359E1B9DCFFACD031D622DB440CA3618EC001FF2C23CB6FE609933C628130715BFDA0E366072780AED3054EF8013E695AA1C1E2
Malicious:	false
Preview:	........0................#......................................./..(..../..'...H/..#...p/......./......./......./......./......./......./......./.......0.......0.......0......%0......00......90......G0......M0......S0......a0......g0......o0......t0......x0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0......0.....)1..'...T1..,...\|1.......1.......1.......1.......1..$....1.......1.......1..!....2......$2......<2......R2......[2......w2......{2.......2.......2.......2..e....2.......3.......3......33..%...<3.."...b3..6....3.......3.......3.. ....3..)....3..4...%4......Z4......l4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4..0....5.....65......a5..e...h5..)....5..!....5..5....6......P6..+...c6..2....6.......6..&....6..#....7.."...+7......N7......^7......t7.......7.......7.......7.......7.......7.."....7.......8......48......98.. ...Y8......z8.......8......8.......8.......8.......8..!....8......

C:\Program Files (x86)\GeoSetter\locale\it\LC_MESSAGES\is-GGRNT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.236617838318599
Encrypted:	false
SSDEEP:	6:ilij+6YYuVsxfp0tfqqPC9/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLinlrj:i4Nxuyx2la9/IMBivXmBQWiRc5lij
MD5:	A209065AE65E16352E79CD2FEF035ABF
SHA1:	ABB87F144197D21C3CA48204CF461C3038319DD0
SHA-256:	07275F78A7D9C9610EAE8AF7C60F5A045C2C31EDD3050479C7CA4753DBBC5ABD
SHA-512:	D9B7C397FE5FA69563639CBFEE4576FD7C5E2F84DBDAC51627BCEE5A56571E112197EB1A980F811446DE9DED8EF92EE12A6C439440846DCE8410D080039F4227
Malicious:	false
Preview:	................$.......,.......8...b...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:36+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Italian.X-Poedit-Country: ITALY..

C:\Program Files (x86)\GeoSetter\locale\it\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.236617838318599
Encrypted:	false
SSDEEP:	6:ilij+6YYuVsxfp0tfqqPC9/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLinlrj:i4Nxuyx2la9/IMBivXmBQWiRc5lij
MD5:	A209065AE65E16352E79CD2FEF035ABF
SHA1:	ABB87F144197D21C3CA48204CF461C3038319DD0
SHA-256:	07275F78A7D9C9610EAE8AF7C60F5A045C2C31EDD3050479C7CA4753DBBC5ABD
SHA-512:	D9B7C397FE5FA69563639CBFEE4576FD7C5E2F84DBDAC51627BCEE5A56571E112197EB1A980F811446DE9DED8EF92EE12A6C439440846DCE8410D080039F4227
Malicious:	false
Preview:	................$.......,.......8...b...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:36+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Italian.X-Poedit-Country: ITALY..

C:\Program Files (x86)\GeoSetter\locale\it\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.9389029282422054
Encrypted:	false
SSDEEP:	12:Kf2H+POaN1Ul3BXv0YcvYqgdHxAxuh2BZwuwBgsWXP:K+eGaHUl3Rv+Y/dHxUuhnLeP
MD5:	9BF9BD10952818C23190FB20E927D166
SHA1:	DDB85D65F1181C593378341A216299B05A888E3E
SHA-256:	E547DCFD0AEC6A37E8D35494F55871972023A6A730EE3E82F337F6762D9A479F
SHA-512:	F1C499457678B30DA0BADB8F824043A35BE3A779808708692F0A2738CBF5401D9EEACBA78CF4B6476EE724AA05C48D170159B032C4D86E2CFD8015608C565AB3
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................u..g..c..[..S...................................o.b.a].]X.XU.T..................55.22.//.,,.....w.f.fD.D?.?:.:...........................//.....{.j.jI.IE.E?.@...........................22.......o.oO.OI.IE.E...........................66.......s.rS.SO.OK.K..................%%.......;;.......v.vX.XT.TP.P..................++.%%. .??.......y.y\.\Y.XT.T..................11.++.&&.DD.......z.{_._\.\Y.Y..................77.11.,,.II.......{.{{.{y.yw.w..................\\.WW.SS.NN......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\it\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2806390622295662
Encrypted:	false
SSDEEP:	3:wErHLC:wErrC
MD5:	E34E561EA5CA7B66CB1FA5847079580F
SHA1:	68F7766F67C807F56AD1A66F6292CC6A632F1008
SHA-256:	5E7086C30617CC6276860FFE2836746395A35905CCB7A97AD28FAE5DE48BDB3A
SHA-512:	158DC02AF1D44D65B2381DFE0211281CFFDC735953D6D6A764AD7973BC7140C86206277FE15FE61077578B34F0D7F5046375190DA867A70325161AE6541EC84F
Malicious:	false
Preview:	Italian..1.3.1.1

C:\Program Files (x86)\GeoSetter\locale\it\is-FI01S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2806390622295662
Encrypted:	false
SSDEEP:	3:wErHLC:wErrC
MD5:	E34E561EA5CA7B66CB1FA5847079580F
SHA1:	68F7766F67C807F56AD1A66F6292CC6A632F1008
SHA-256:	5E7086C30617CC6276860FFE2836746395A35905CCB7A97AD28FAE5DE48BDB3A
SHA-512:	158DC02AF1D44D65B2381DFE0211281CFFDC735953D6D6A764AD7973BC7140C86206277FE15FE61077578B34F0D7F5046375190DA867A70325161AE6541EC84F
Malicious:	false
Preview:	Italian..1.3.1.1

C:\Program Files (x86)\GeoSetter\locale\it\is-TKIKU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.9389029282422054
Encrypted:	false
SSDEEP:	12:Kf2H+POaN1Ul3BXv0YcvYqgdHxAxuh2BZwuwBgsWXP:K+eGaHUl3Rv+Y/dHxUuhnLeP
MD5:	9BF9BD10952818C23190FB20E927D166
SHA1:	DDB85D65F1181C593378341A216299B05A888E3E
SHA-256:	E547DCFD0AEC6A37E8D35494F55871972023A6A730EE3E82F337F6762D9A479F
SHA-512:	F1C499457678B30DA0BADB8F824043A35BE3A779808708692F0A2738CBF5401D9EEACBA78CF4B6476EE724AA05C48D170159B032C4D86E2CFD8015608C565AB3
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................u..g..c..[..S...................................o.b.a].]X.XU.T..................55.22.//.,,.....w.f.fD.D?.?:.:...........................//.....{.j.jI.IE.E?.@...........................22.......o.oO.OI.IE.E...........................66.......s.rS.SO.OK.K..................%%.......;;.......v.vX.XT.TP.P..................++.%%. .??.......y.y\.\Y.XT.T..................11.++.&&.DD.......z.{_._\.\Y.Y..................77.11.,,.II.......{.{{.{y.yw.w..................\\.WW.SS.NN......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\ja\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1910 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	168645
Entropy (8bit):	6.0594262578368605
Encrypted:	false
SSDEEP:	1536:xCAVtOwTmdwZMQaG7yh3c4F8/rnmDiwwTlsoo/52u+q3NFNgBY8i9APJQ6WnX6:8wTLbaLh3H8/rn7ww5MGBY8i9APJc6
MD5:	0414CDF5E1F98C2EB9E374E4CA2DC3A4
SHA1:	507006083D862C49522B470D4120BE32B7E5BE93
SHA-256:	79D821E1CBF5480EB2B9B299851A318FC60D32B5CD17A85147E6085DBA312F0F
SHA-512:	ECE5687B7E61F387941B437F4BBFDD8E3934DABCE2F817236326D59B4E2A81BA9441645E2988EFF7310AE03B48D3A6CE1867AB977CADEF19F896043CBA1CDC42
Malicious:	false
Preview:	........v........;......\|w......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...D.......#....................../...........E.......^.......i...,...~...........................................................................................%.......3.......9.......A.......F.......J.......Q.......W.......\.......o..............................................................................................................................G.......O...R................,.......i...%...'.......,..................................................................!...%...0.......V.......7...$...K.......p...................6............................ ...........&...&...:.......a.......k...........;.......$.............E.......#...>.......b...!...s............................................+.......<...3...V................................................$...................6..............

C:\Program Files (x86)\GeoSetter\locale\ja\LC_MESSAGES\is-5B21J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1910 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	168645
Entropy (8bit):	6.0594262578368605
Encrypted:	false
SSDEEP:	1536:xCAVtOwTmdwZMQaG7yh3c4F8/rnmDiwwTlsoo/52u+q3NFNgBY8i9APJQ6WnX6:8wTLbaLh3H8/rn7ww5MGBY8i9APJc6
MD5:	0414CDF5E1F98C2EB9E374E4CA2DC3A4
SHA1:	507006083D862C49522B470D4120BE32B7E5BE93
SHA-256:	79D821E1CBF5480EB2B9B299851A318FC60D32B5CD17A85147E6085DBA312F0F
SHA-512:	ECE5687B7E61F387941B437F4BBFDD8E3934DABCE2F817236326D59B4E2A81BA9441645E2988EFF7310AE03B48D3A6CE1867AB977CADEF19F896043CBA1CDC42
Malicious:	false
Preview:	........v........;......\|w......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...D.......#....................../...........E.......^.......i...,...~...........................................................................................%.......3.......9.......A.......F.......J.......Q.......W.......\.......o..............................................................................................................................G.......O...R................,.......i...%...'.......,..................................................................!...%...0.......V.......7...$...K.......p...................6............................ ...........&...&...:.......a.......k...........;.......$.............E.......#...>.......b...!...s............................................+.......<...3...V................................................$...................6..............

C:\Program Files (x86)\GeoSetter\locale\ja\LC_MESSAGES\is-6H4BK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: GeoSetter '\343\202\242\343\203\223\343\202\270\343\203\243\343\203\263'
Category:	dropped
Size (bytes):	19164
Entropy (8bit):	5.003037096965352
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZqfvxzeJcIWwhCbBwp+1CCyFjRxygPV3Rx5H:WyayQfvEJ+whGBwg1xCjREw
MD5:	40E49FE0580708654345A373C813F1A1
SHA1:	0980D9A1873C3A4F14FF85E98FDCEE2423BC1F74
SHA-256:	E349DFE22F8234E31D37BA84665F5EE3E1912ACCC55BB206E4DF1EC5F0A89E39
SHA-512:	F810ED7783D709815F9ECDD4B9CA731DBB1EA22C9F74F318FD4825D05D15D814EFD96CDC1EC6AD523B13B7F7276F61BDEF9CD5F733591AF0095F6B88A069F7AF
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\ja\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: GeoSetter '\343\202\242\343\203\223\343\202\270\343\203\243\343\203\263'
Category:	dropped
Size (bytes):	19164
Entropy (8bit):	5.003037096965352
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZqfvxzeJcIWwhCbBwp+1CCyFjRxygPV3Rx5H:WyayQfvEJ+whGBwg1xCjREw
MD5:	40E49FE0580708654345A373C813F1A1
SHA1:	0980D9A1873C3A4F14FF85E98FDCEE2423BC1F74
SHA-256:	E349DFE22F8234E31D37BA84665F5EE3E1912ACCC55BB206E4DF1EC5F0A89E39
SHA-512:	F810ED7783D709815F9ECDD4B9CA731DBB1EA22C9F74F318FD4825D05D15D814EFD96CDC1EC6AD523B13B7F7276F61BDEF9CD5F733591AF0095F6B88A069F7AF
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\ja\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.66315474899585
Encrypted:	false
SSDEEP:	6:Olfam6B/jcOEqs/39Sdj+xvFe0fGTrI5TfHTNgIlgFhXZs8yhiefI8CN86l:Kf2VoP9ujswdrI5TzV+F1ZsjhzI8o
MD5:	C9B4440CD2F0D4ADD52C0A704AC2EB91
SHA1:	49700DAD879843140F8A7E7AF6F3B4832DBD741C
SHA-256:	36EB4A9A89FCDEB82806645EF7DFC24D814EC8825368BABEC67BC5CBA1575996
SHA-512:	66FA0143DB3CA3C12948CBAB05FB4643661EEC2F7FE9DE2FAB995CE9D298E64613A8E17188946D67813E4826D36D938B8B3E068F436D4B0F051E98A1175FE6F4
Malicious:	false
Preview:	BM8.......6...(............................................................................................................................................................................................................................................................................................................[[.UU........................................44.//..$$.}}...............................HH.:;.55.//..**...............................FF.@@.;;.66.00.++...............................UU.FF.AA.<;.66.77..................................KK.GG.BA.<<.........................................~.yy........................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\ja\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.6835423624332306
Encrypted:	false
SSDEEP:	3:NvNvLbV:Nxx
MD5:	7CFFBED956BBD012517068418E68DDBB
SHA1:	3C1CEEEEA90A47692D0264F9E7B4E38F373D37FE
SHA-256:	9FE98BEFE4855EB15B67B9B876127207E9317F0302F50B53BA9E781FF36D747E
SHA-512:	C55E23B41206BC080E8F037242ED32BF166CC045CAB58AF5CDE1675B6AA53D294B0B51BB71F8B430AF4775015E855CBDFE6E2483455697629EAE3475EDE11906
Malicious:	false
Preview:	Japanese..3.4.12.0

C:\Program Files (x86)\GeoSetter\locale\ja\is-KIRBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.66315474899585
Encrypted:	false
SSDEEP:	6:Olfam6B/jcOEqs/39Sdj+xvFe0fGTrI5TfHTNgIlgFhXZs8yhiefI8CN86l:Kf2VoP9ujswdrI5TzV+F1ZsjhzI8o
MD5:	C9B4440CD2F0D4ADD52C0A704AC2EB91
SHA1:	49700DAD879843140F8A7E7AF6F3B4832DBD741C
SHA-256:	36EB4A9A89FCDEB82806645EF7DFC24D814EC8825368BABEC67BC5CBA1575996
SHA-512:	66FA0143DB3CA3C12948CBAB05FB4643661EEC2F7FE9DE2FAB995CE9D298E64613A8E17188946D67813E4826D36D938B8B3E068F436D4B0F051E98A1175FE6F4
Malicious:	false
Preview:	BM8.......6...(............................................................................................................................................................................................................................................................................................................[[.UU........................................44.//..$$.}}...............................HH.:;.55.//..**...............................FF.@@.;;.66.00.++...............................UU.FF.AA.<;.66.77..................................KK.GG.BA.<<.........................................~.yy........................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\ja\is-MB05K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.6835423624332306
Encrypted:	false
SSDEEP:	3:NvNvLbV:Nxx
MD5:	7CFFBED956BBD012517068418E68DDBB
SHA1:	3C1CEEEEA90A47692D0264F9E7B4E38F373D37FE
SHA-256:	9FE98BEFE4855EB15B67B9B876127207E9317F0302F50B53BA9E781FF36D747E
SHA-512:	C55E23B41206BC080E8F037242ED32BF166CC045CAB58AF5CDE1675B6AA53D294B0B51BB71F8B430AF4775015E855CBDFE6E2483455697629EAE3475EDE11906
Malicious:	false
Preview:	Japanese..3.4.12.0

C:\Program Files (x86)\GeoSetter\locale\nl\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1217 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	91028
Entropy (8bit):	5.1624873222411045
Encrypted:	false
SSDEEP:	1536:5NUj8tpx6uVilyPkh3fZasCgcsewFuiDIzorQ98Nv:GA75VCh3wucCvrS8V
MD5:	76D8239CB5A25D77EA264E90C0668871
SHA1:	1086F61E8A480ED848D35017D4970F192FEB1D21
SHA-256:	ED80B3A5BEBEE6B9DF834277CB5C9732DF7990956A6BC974F3702E713381559F
SHA-512:	CA4E2F1D112A647E4259D3ECE59F16F55FBF300C03CA43F74641ABAAFBF258C620DFC57F894E723A08B3C7FC9BBF6CF71119A444BCBBAD0AF73ADF3AB5411331
Malicious:	false
Preview:	................$&..[...,L.......e.......e.......e.......e.......e.......e.......e..(....e..'...(f..D...Pf..#....f.......f.......f.......f.......f..,....f......+g......4g......Mg......Tg......kg......pg......wg.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......h.......h.......h....../h......9h......Dh......Ih......Kh.....eh......h..,....h..'....h..,....i......=i......Ni......Wi......]i......ci..$...ji.......i..6....i.......i.......i..&....i.......j..;....j..$...[j..E....j..#....j.......j..!....j.......k......5k......Kk......]k..3...wk.......k.......k.......k.......k.......k.......l.......l.......l..h....l......5m......+n......7n......En......Mn......Un......Yn......fn......tn.......n.......n..g....n.......o.......o.......o..e...2o..X....o.......o.......p.......p..5....p......Ip..%...Xp......~p......!q.......q.."...gr..6....r.......r.......r.......r.......r.......r.......r.......s.......s...... s......(s......

C:\Program Files (x86)\GeoSetter\locale\nl\LC_MESSAGES\is-89J04.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.287219724318624
Encrypted:	false
SSDEEP:	6:ilij+EYYuVsxfp0tfqqPC9/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLi8ljp/:i4Bxuyx2la9/IMBivXmBQWiRc5l/BpCY
MD5:	891B5BA6BDF84EDC59B7B7D6A6920721
SHA1:	F88D6B2B215877C6468416BD4291C4EA715A2223
SHA-256:	71F60753289DA459F81FF0FAF66DFE4D79F66C3FE76C62282FEAFECEDD918565
SHA-512:	2B170320D1DCE4D8D6D1822260D5C27865A45E5CD67C430AF9F775E38DC4EB0C59190EA11AD092D22A2664E0B4376ADED4E8AE254702DF8072EB2A8D6039477C
Malicious:	false
Preview:	................$.......,.......8...f...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:36+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Dutch.X-Poedit-Country: NETHERLANDS..

C:\Program Files (x86)\GeoSetter\locale\nl\LC_MESSAGES\is-B11G9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1217 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	91028
Entropy (8bit):	5.1624873222411045
Encrypted:	false
SSDEEP:	1536:5NUj8tpx6uVilyPkh3fZasCgcsewFuiDIzorQ98Nv:GA75VCh3wucCvrS8V
MD5:	76D8239CB5A25D77EA264E90C0668871
SHA1:	1086F61E8A480ED848D35017D4970F192FEB1D21
SHA-256:	ED80B3A5BEBEE6B9DF834277CB5C9732DF7990956A6BC974F3702E713381559F
SHA-512:	CA4E2F1D112A647E4259D3ECE59F16F55FBF300C03CA43F74641ABAAFBF258C620DFC57F894E723A08B3C7FC9BBF6CF71119A444BCBBAD0AF73ADF3AB5411331
Malicious:	false
Preview:	................$&..[...,L.......e.......e.......e.......e.......e.......e.......e..(....e..'...(f..D...Pf..#....f.......f.......f.......f.......f..,....f......+g......4g......Mg......Tg......kg......pg......wg.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......h.......h.......h....../h......9h......Dh......Ih......Kh.....eh......h..,....h..'....h..,....i......=i......Ni......Wi......]i......ci..$...ji.......i..6....i.......i.......i..&....i.......j..;....j..$...[j..E....j..#....j.......j..!....j.......k......5k......Kk......]k..3...wk.......k.......k.......k.......k.......k.......l.......l.......l..h....l......5m......+n......7n......En......Mn......Un......Yn......fn......tn.......n.......n..g....n.......o.......o.......o..e...2o..X....o.......o.......p.......p..5....p......Ip..%...Xp......~p......!q.......q.."...gr..6....r.......r.......r.......r.......r.......r.......r.......s.......s...... s......(s......

C:\Program Files (x86)\GeoSetter\locale\nl\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.287219724318624
Encrypted:	false
SSDEEP:	6:ilij+EYYuVsxfp0tfqqPC9/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLi8ljp/:i4Bxuyx2la9/IMBivXmBQWiRc5l/BpCY
MD5:	891B5BA6BDF84EDC59B7B7D6A6920721
SHA1:	F88D6B2B215877C6468416BD4291C4EA715A2223
SHA-256:	71F60753289DA459F81FF0FAF66DFE4D79F66C3FE76C62282FEAFECEDD918565
SHA-512:	2B170320D1DCE4D8D6D1822260D5C27865A45E5CD67C430AF9F775E38DC4EB0C59190EA11AD092D22A2664E0B4376ADED4E8AE254702DF8072EB2A8D6039477C
Malicious:	false
Preview:	................$.......,.......8...f...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:36+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Dutch.X-Poedit-Country: NETHERLANDS..

C:\Program Files (x86)\GeoSetter\locale\nl\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.03755437579034
Encrypted:	false
SSDEEP:	12:Kf2v+CPsiDUDnx1Z4x9sokeNskdwy11AgYPhosNeqfXqqvmmf9:K+v+OlgDnx1yxWSdRnANOweoqqvmmf9
MD5:	619FF3D50095D8A47915EBB4D32D70CC
SHA1:	2666E31C035EB8E1AB0855A37E18DE0F81CCA271
SHA-256:	B69B7568637923F15417934995C4C1AE7A63B616D72DED2C48750870C1622025
SHA-512:	8B64011DAB60F2C3DAAA9727B0A8E09BE8C855D1364FF12D49A01B55F0C378DA470C15F43D63FE2EE1D34A679370E95AD4CC6D3A3F94824B6410AFC898006A03
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................................................{..u..o..k..e.._..[..W..Q..M..G..C..A..=..;..=......a.].X..T..P..K.\|F.xB.u=.q9.o5.l2.j/.g,;......f.zD.v?.s:.o4.j..f).b#.^..Z..V..R..P..i/;...!..w.Y..T..P.~J.{E.w@.s;.o6.k1.g,.c(.`#.wCM..................................................................................................................................................1............{..x..t..p.}l.zh.vd.r_.nZ.jV..m........{.l_.i\.gY.cT.^Q.ZL.VG.QB.M<.G7.B1.<,.WI........{..{..y..w..t..p.{m.xi.te.p`.m\.hW.eS.`N......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\nl\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.4677201004745006
Encrypted:	false
SSDEEP:	3:rSV:q
MD5:	35B74A6A2E7827D1F7EA72D44435A8D2
SHA1:	411C4756744CFA089ECB65D0C027FCFE92683339
SHA-256:	4404D9ED5F0C7D181B23F32CE85B25D3233D58C92D41D0F47B0F3C04D2E8C4D9
SHA-512:	1794C1E1C63C70D9B3FF902FACC6C05875888EDE09EFC4310918000560D448362BEA0CCB85B9B405845AF8605F82BBFF00A9C2BB8855740857C334E2B936B086
Malicious:	false
Preview:	Dutch..2.5.1.0

C:\Program Files (x86)\GeoSetter\locale\nl\is-995OP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.4677201004745006
Encrypted:	false
SSDEEP:	3:rSV:q
MD5:	35B74A6A2E7827D1F7EA72D44435A8D2
SHA1:	411C4756744CFA089ECB65D0C027FCFE92683339
SHA-256:	4404D9ED5F0C7D181B23F32CE85B25D3233D58C92D41D0F47B0F3C04D2E8C4D9
SHA-512:	1794C1E1C63C70D9B3FF902FACC6C05875888EDE09EFC4310918000560D448362BEA0CCB85B9B405845AF8605F82BBFF00A9C2BB8855740857C334E2B936B086
Malicious:	false
Preview:	Dutch..2.5.1.0

C:\Program Files (x86)\GeoSetter\locale\nl\is-MIKL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.03755437579034
Encrypted:	false
SSDEEP:	12:Kf2v+CPsiDUDnx1Z4x9sokeNskdwy11AgYPhosNeqfXqqvmmf9:K+v+OlgDnx1yxWSdRnANOweoqqvmmf9
MD5:	619FF3D50095D8A47915EBB4D32D70CC
SHA1:	2666E31C035EB8E1AB0855A37E18DE0F81CCA271
SHA-256:	B69B7568637923F15417934995C4C1AE7A63B616D72DED2C48750870C1622025
SHA-512:	8B64011DAB60F2C3DAAA9727B0A8E09BE8C855D1364FF12D49A01B55F0C378DA470C15F43D63FE2EE1D34A679370E95AD4CC6D3A3F94824B6410AFC898006A03
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................................................{..u..o..k..e.._..[..W..Q..M..G..C..A..=..;..=......a.].X..T..P..K.\|F.xB.u=.q9.o5.l2.j/.g,;......f.zD.v?.s:.o4.j..f).b#.^..Z..V..R..P..i/;...!..w.Y..T..P.~J.{E.w@.s;.o6.k1.g,.c(.`#.wCM..................................................................................................................................................1............{..x..t..p.}l.zh.vd.r_.nZ.jV..m........{.l_.i\.gY.cT.^Q.ZL.VG.QB.M<.G7.B1.<,.WI........{..{..y..w..t..p.{m.xi.te.p`.m\.hW.eS.`N......................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\no\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1802 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	144896
Entropy (8bit):	5.235451761284087
Encrypted:	false
SSDEEP:	3072:K1X/jqUQ6yOLwh3z8qBzmOhN5EBp+RTCNeY6S1xihAk76u/11XZ:K1Pjqqch3z8VD2036+xihTp
MD5:	0623B2A7DA74AE7DF9E0C919B90DBC16
SHA1:	EF8AB56DA17D94E3D9DC73B65BECF6A27A38E72B
SHA-256:	D92D47185990605804DC3C60A2D37E93D55C00CAF68CEDEC27D3D43079F45B05
SHA-512:	4AB77FDA5CEE5FC7C5373F22063F85F0EAE568E4E5C712665F1D0C5841824007EFA3E9D2F88DDB6A2F1079A12C183682A79E4C0E9F3F5AD9BDCEF1BAA6BA6F04
Malicious:	false
Preview:	................l8..k....p......h.......i.......r.................................................(.......'.......D...G...#.............../..............................,...%.......R.......[.......t.......{.........................................................................................................................................$.......2.......<.......C.......V.......`.......k.......p.......r...................................................G.......O.........3......^...,.......i.......'... ...,...H.......u...................................................%.....................$..............................6...#.......Z... ...j...........&............................;......$...+.......P...E...]...#..............!................%.......P.......h.......~...................3..................................'.......7.......R...$...Z.......................8.......L...h...d.............................................I.......9...J...............

C:\Program Files (x86)\GeoSetter\locale\no\LC_MESSAGES\is-88GJ4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.284304086390274
Encrypted:	false
SSDEEP:	12:i4Y86xuyx2lP9/IMBivXmBQWiRc5lK5ajl:RYBuyx2ttxOXmX
MD5:	5A029D448ABC53DB7B15A5C8D34C53EE
SHA1:	F3DE89C95C931B632AF843CF100DF49E009026F0
SHA-256:	472A2CCA2FE4BA22A8B82E559ED6F4856B6671D3ABB63FD2462DD1FDCD876C06
SHA-512:	F26A3D487FD7A278F45C396D764A3DC5C88B1C5E3103F3FB8079CC5750B3767E66753E6E3799C11CC2D9F92AC6693A34440DB2B6E0AFDE608798AF3EA52AA5C9
Malicious:	false
Preview:	................$.......,.......8...m...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:37+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Norwegian Nynorsk.X-Poedit-Country: NORWAY..

C:\Program Files (x86)\GeoSetter\locale\no\LC_MESSAGES\is-HLFEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1802 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	144896
Entropy (8bit):	5.235451761284087
Encrypted:	false
SSDEEP:	3072:K1X/jqUQ6yOLwh3z8qBzmOhN5EBp+RTCNeY6S1xihAk76u/11XZ:K1Pjqqch3z8VD2036+xihTp
MD5:	0623B2A7DA74AE7DF9E0C919B90DBC16
SHA1:	EF8AB56DA17D94E3D9DC73B65BECF6A27A38E72B
SHA-256:	D92D47185990605804DC3C60A2D37E93D55C00CAF68CEDEC27D3D43079F45B05
SHA-512:	4AB77FDA5CEE5FC7C5373F22063F85F0EAE568E4E5C712665F1D0C5841824007EFA3E9D2F88DDB6A2F1079A12C183682A79E4C0E9F3F5AD9BDCEF1BAA6BA6F04
Malicious:	false
Preview:	................l8..k....p......h.......i.......r.................................................(.......'.......D...G...#.............../..............................,...%.......R.......[.......t.......{.........................................................................................................................................$.......2.......<.......C.......V.......`.......k.......p.......r...................................................G.......O.........3......^...,.......i.......'... ...,...H.......u...................................................%.....................$..............................6...#.......Z... ...j...........&............................;......$...+.......P...E...]...#..............!................%.......P.......h.......~...................3..................................'.......7.......R...$...Z.......................8.......L...h...d.............................................I.......9...J...............

C:\Program Files (x86)\GeoSetter\locale\no\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.284304086390274
Encrypted:	false
SSDEEP:	12:i4Y86xuyx2lP9/IMBivXmBQWiRc5lK5ajl:RYBuyx2ttxOXmX
MD5:	5A029D448ABC53DB7B15A5C8D34C53EE
SHA1:	F3DE89C95C931B632AF843CF100DF49E009026F0
SHA-256:	472A2CCA2FE4BA22A8B82E559ED6F4856B6671D3ABB63FD2462DD1FDCD876C06
SHA-512:	F26A3D487FD7A278F45C396D764A3DC5C88B1C5E3103F3FB8079CC5750B3767E66753E6E3799C11CC2D9F92AC6693A34440DB2B6E0AFDE608798AF3EA52AA5C9
Malicious:	false
Preview:	................$.......,.......8...m...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:37+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Norwegian Nynorsk.X-Poedit-Country: NORWAY..

C:\Program Files (x86)\GeoSetter\locale\no\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.240830750551435
Encrypted:	false
SSDEEP:	12:Kf2aaNBKc7KsVOdfD9W+6d/8Z7k6AbF3ev+KyTaUfVl:K+aaPpadf5Y/8lkjx3tKyWUfj
MD5:	2C56B966554D05EADCA65DFB1045023A
SHA1:	A29D70DE7FDA85A22C4F9656CEF829C7999955ED
SHA-256:	6AFE58B6D723EA8FC6890892EA7D35F8409F7060731209F9AF5BE21D252DC453
SHA-512:	1062BF68AB4B6A39EEE46A43754378494E756C22008D29756CEB8BEE72A51EB32BA18E7BAC6A682AE410A6D47B0A1F895CD5EE0A5D977683F831BB5C3F119BD3
Malicious:	false
Preview:	BM8.......6...(.........................................................................................................................................................................................................................................bd.]_.....z...KL.FI.BD.=@.9;.57.24./1.,........fh.DF.....e....0.)+.#&..!............./1.......jm.IK......j...47./1.*,.$'..!..........25.................o..................................S...z.w.s.o..k.f.b.].Y.T.P.K.e................w....................................yz.\].....{...KN.GI.BC.<>.69.14.+..&).DF.......z}._a.....~...QR.LN.GI.BD.=?.7:.14.,..IK.......{}.{}........qr.mo.ik.eg.`c.\^.WZ.SU.NP.................Y....................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\no\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.8924071185928786
Encrypted:	false
SSDEEP:	3:ISMiyMdeV:ISxyMdeV
MD5:	ACC6366C2B62DE2B702D7E02A9F6506E
SHA1:	393FC3997BF6EEA199272A0BCD5EDD2066F5F3B9
SHA-256:	DB4909E34537991879B60F399A5EB9BC502C62F14FFF696A471720A5DE51DF3E
SHA-512:	8E8E7D19EA12C53D93F7333545703530FD7F2A9756BEE4F84CCEA05410D8968FF3AE219425F66CABC94AA338EE6DA83CA52EC9B64D4EEB89193C689404DA9B5D
Malicious:	false
Preview:	Norwegian..3.3.95.0

C:\Program Files (x86)\GeoSetter\locale\no\is-6CKII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.240830750551435
Encrypted:	false
SSDEEP:	12:Kf2aaNBKc7KsVOdfD9W+6d/8Z7k6AbF3ev+KyTaUfVl:K+aaPpadf5Y/8lkjx3tKyWUfj
MD5:	2C56B966554D05EADCA65DFB1045023A
SHA1:	A29D70DE7FDA85A22C4F9656CEF829C7999955ED
SHA-256:	6AFE58B6D723EA8FC6890892EA7D35F8409F7060731209F9AF5BE21D252DC453
SHA-512:	1062BF68AB4B6A39EEE46A43754378494E756C22008D29756CEB8BEE72A51EB32BA18E7BAC6A682AE410A6D47B0A1F895CD5EE0A5D977683F831BB5C3F119BD3
Malicious:	false
Preview:	BM8.......6...(.........................................................................................................................................................................................................................................bd.]_.....z...KL.FI.BD.=@.9;.57.24./1.,........fh.DF.....e....0.)+.#&..!............./1.......jm.IK......j...47./1.*,.$'..!..........25.................o..................................S...z.w.s.o..k.f.b.].Y.T.P.K.e................w....................................yz.\].....{...KN.GI.BC.<>.69.14.+..&).DF.......z}._a.....~...QR.LN.GI.BD.=?.7:.14.,..IK.......{}.{}........qr.mo.ik.eg.`c.\^.WZ.SU.NP.................Y....................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\no\is-P0MV2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.8924071185928786
Encrypted:	false
SSDEEP:	3:ISMiyMdeV:ISxyMdeV
MD5:	ACC6366C2B62DE2B702D7E02A9F6506E
SHA1:	393FC3997BF6EEA199272A0BCD5EDD2066F5F3B9
SHA-256:	DB4909E34537991879B60F399A5EB9BC502C62F14FFF696A471720A5DE51DF3E
SHA-512:	8E8E7D19EA12C53D93F7333545703530FD7F2A9756BEE4F84CCEA05410D8968FF3AE219425F66CABC94AA338EE6DA83CA52EC9B64D4EEB89193C689404DA9B5D
Malicious:	false
Preview:	Norwegian..3.3.95.0

C:\Program Files (x86)\GeoSetter\locale\pt\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1578 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	127752
Entropy (8bit):	5.252274356465809
Encrypted:	false
SSDEEP:	1536:lL9y0xUTHaTJnUILB6HVbh3BTN8D1dHg4LyJ/u+tu808gSzk3jhIZfWpD:l9FxUTyJnRB6xh3D8DfgZuszytIZfG
MD5:	5F5DC0DC12E6C021736B83460CA77119
SHA1:	1354B7E22749DEB39635DA77155FD58DFD1FEEDA
SHA-256:	2F8886757D471D4320B828C340A3333A62B63CE5A77D910334D071685164E8AE
SHA-512:	C5709536E70FE14F995BD0F576679F2EE1F33662401A418181C4DE16620AA439A6BFC5046C6A9EBF840BF3835E2C036DD7D0423ABD50B58628FDA46153FD7B34
Malicious:	false
Preview:	...............l1..?....b............................................................&......./...(...F...'...o...D.......#..........................%.......0...,...E.......r.......{...........................................................................................................................................#.......6.......D.......R.......\.......c.......v...................................................................................G.......O..........S...*...~...,.......i......'...@...,...h.........................................................%..............$...........<.......T.......^...6...b...................&.....................;.......$...5.......Z...E...g...#..............!..........................2.......D.......U...3...o..................................$.................. ..................h..........R.......H.......Q.......].......k.......s...I.......9..........................................(.......G.......U.......d.......u.......

C:\Program Files (x86)\GeoSetter\locale\pt\LC_MESSAGES\is-C0G3H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1578 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	127752
Entropy (8bit):	5.252274356465809
Encrypted:	false
SSDEEP:	1536:lL9y0xUTHaTJnUILB6HVbh3BTN8D1dHg4LyJ/u+tu808gSzk3jhIZfWpD:l9FxUTyJnRB6xh3D8DfgZuszytIZfG
MD5:	5F5DC0DC12E6C021736B83460CA77119
SHA1:	1354B7E22749DEB39635DA77155FD58DFD1FEEDA
SHA-256:	2F8886757D471D4320B828C340A3333A62B63CE5A77D910334D071685164E8AE
SHA-512:	C5709536E70FE14F995BD0F576679F2EE1F33662401A418181C4DE16620AA439A6BFC5046C6A9EBF840BF3835E2C036DD7D0423ABD50B58628FDA46153FD7B34
Malicious:	false
Preview:	...............l1..?....b............................................................&......./...(...F...'...o...D.......#..........................%.......0...,...E.......r.......{...........................................................................................................................................#.......6.......D.......R.......\.......c.......v...................................................................................G.......O..........S...*...~...,.......i......'...@...,...h.........................................................%..............$...........<.......T.......^...6...b...................&.....................;.......$...5.......Z...E...g...#..............!..........................2.......D.......U...3...o..................................$.................. ..................h..........R.......H.......Q.......].......k.......s...I.......9..........................................(.......G.......U.......d.......u.......

C:\Program Files (x86)\GeoSetter\locale\pt\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.22948500718895
Encrypted:	false
SSDEEP:	12:Kf2SevlOMfRcTolfVZP8i+LGCdm0xogm4dxvhszwoOa70zn06TF/wlhf9:K+SClOMRjlff5uxxVVxXDrF/wvf9
MD5:	7F5D0827AC7B79F62F4BC26F44DA453A
SHA1:	667C9AD732C2F3848B47620393FDB9D1438813D1
SHA-256:	E73355D0418BC192F47E3F5DB934C605A3C87A8E31FC0941F2111A5532596DD7
SHA-512:	15E993EC9A06222850760ED6A4FAB77E9C11B77831FDA09FC2FACAD34A84B73358D0B61A09BA73AAF643CCE06B2A37616DDCD3D176B9310F01F16446D3CA613C
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................3..!............................................+.b.a].]X.XU.TP.PKK.FF.BB.==.99.55.22.//.,,.....5.f.fD.D?.?:.:4.A...)5.##................//.....;.j.jI.IE.S@..<..7..2..i.$$.............22.....?.o.oO.OI..F..Xx.v..9..0../.$$..........66.....E.s.rS.SO..Kv.......`x.6..0A.++.%%.......;;.....K.v.vX.XT..Q........[v.=..6<.00.++.%%. .??.....M.y.y\.\Y..U..Qp.Lg.G..B..<<.67.11.++.&&.DD.....M.z.{_._\.iY..T..Q..L..GS.BB.=<.77.11.,,.II.....K.{.{{.{y.yw.wt.tqp.mm.ii.ee.``.\\.WW.SS.NN.....Y..M..M..M..K..O.................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\pt\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.7841837197791883
Encrypted:	false
SSDEEP:	3:yMT:yMT
MD5:	AC5AA633EF1AE5294F8CA4A99FEB09CD
SHA1:	C6FDFC4663EADAB1F6D8CD22F766BF09DA11E297
SHA-256:	D7C34BEE058789C1C730BDC4CD03D83BF925F12557B417B2E21AF35DCA23BE59
SHA-512:	42E47CC24621EC532C77CB1DECA6D8D84BDE6DF876D142BFDF40BA01CDB124B7812C41B913542215ED229EF0CF909BB71A88BF7C03BC5C9422220D9FFA131722
Malicious:	false
Preview:	Portuguese..3.1.20.0

C:\Program Files (x86)\GeoSetter\locale\pt\is-2TVOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.22948500718895
Encrypted:	false
SSDEEP:	12:Kf2SevlOMfRcTolfVZP8i+LGCdm0xogm4dxvhszwoOa70zn06TF/wlhf9:K+SClOMRjlff5uxxVVxXDrF/wvf9
MD5:	7F5D0827AC7B79F62F4BC26F44DA453A
SHA1:	667C9AD732C2F3848B47620393FDB9D1438813D1
SHA-256:	E73355D0418BC192F47E3F5DB934C605A3C87A8E31FC0941F2111A5532596DD7
SHA-512:	15E993EC9A06222850760ED6A4FAB77E9C11B77831FDA09FC2FACAD34A84B73358D0B61A09BA73AAF643CCE06B2A37616DDCD3D176B9310F01F16446D3CA613C
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................3..!............................................+.b.a].]X.XU.TP.PKK.FF.BB.==.99.55.22.//.,,.....5.f.fD.D?.?:.:4.A...)5.##................//.....;.j.jI.IE.S@..<..7..2..i.$$.............22.....?.o.oO.OI..F..Xx.v..9..0../.$$..........66.....E.s.rS.SO..Kv.......`x.6..0A.++.%%.......;;.....K.v.vX.XT..Q........[v.=..6<.00.++.%%. .??.....M.y.y\.\Y..U..Qp.Lg.G..B..<<.67.11.++.&&.DD.....M.z.{_._\.iY..T..Q..L..GS.BB.=<.77.11.,,.II.....K.{.{{.{y.yw.wt.tqp.mm.ii.ee.``.\\.WW.SS.NN.....Y..M..M..M..K..O.................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\pt\is-5G307.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.7841837197791883
Encrypted:	false
SSDEEP:	3:yMT:yMT
MD5:	AC5AA633EF1AE5294F8CA4A99FEB09CD
SHA1:	C6FDFC4663EADAB1F6D8CD22F766BF09DA11E297
SHA-256:	D7C34BEE058789C1C730BDC4CD03D83BF925F12557B417B2E21AF35DCA23BE59
SHA-512:	42E47CC24621EC532C77CB1DECA6D8D84BDE6DF876D142BFDF40BA01CDB124B7812C41B913542215ED229EF0CF909BB71A88BF7C03BC5C9422220D9FFA131722
Malicious:	false
Preview:	Portuguese..3.1.20.0

C:\Program Files (x86)\GeoSetter\locale\rs\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 944 messages, Project-Id-Version: GeoSetter ' (%dx%d) '
Category:	dropped
Size (bytes):	77900
Entropy (8bit):	5.378577000709878
Encrypted:	false
SSDEEP:	1536:XQ7WXcQYNuvboRmmMxaw9XzYFPUOYn8KO421e:XQCXcZqkMxrtzYFPUOYn3OT1e
MD5:	5FFB9FE33AB2CE6EA38645DF9279D624
SHA1:	2AD1E941B367F2D43D237562CD99AA9B6F7A4DAF
SHA-256:	4562E81EB6320FCAB160805AFF2DEF3C659DB08AB92D47D7ADE8C899EFADDF74
SHA-512:	5F3564853D727C00D4BECA77FB06EC2D22C23C75BFD19D910E7268A3086A2CA29A5A2632936C9E920D02D862425D37C5DAAE5165FC31EE4B09887EB8D2A70ED3
Malicious:	false
Preview:	.........................;.......N.......N.......N.......N.......O..(....O..'...8O..#...`O.......O.......O.......O.......O.......O.......O.......P.......P......!P......8P......=P......DP......OP......XP......fP......lP......rP.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......Q......Q.....HQ..'...sQ..,....Q.......Q.......Q.......Q.......Q..$....Q.......R.......R..!...!R......CR......[R......qR......zR.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S..g....S.......S.......S.......S..e....S.......T......*T....../T......8T..%...GT.."...mT..6....T.......T.......T.......T.......T.......T.......T.......U.......U......&U.......U.. ...4U.. ...UU..)...vU.......U..4....U.......U.......U.......V.......V..I....V......xV.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......W.......W.......W......6W......;W......@W......LW......

C:\Program Files (x86)\GeoSetter\locale\rs\LC_MESSAGES\is-BRB9J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.290170436958179
Encrypted:	false
SSDEEP:	6:ilij36YYuVsxfp0tfqqPnU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLiV+Rc:i436xuyx2lvU//IMBivXmBQWiRc5l01
MD5:	39101C20FEC81388B6EC5DFD1A203BE0
SHA1:	F648C6E187A4DC85BB08BF68555FEC5363C349A4
SHA-256:	978370CCA3D0DE4F198D7E367B01EA2B9FA1E6C7BDA5EF104B8ADBF1BDFF22EF
SHA-512:	76DEB3D9FA7DAA3AA7BE4A371BD2AD6EF4694F8822621FC96D940CB13FD12205985A1731FAAAA438B509153D4CECF4B14616DD4F8AB8842C52131A60A0B1E5D4
Malicious:	false
Preview:	................$.......,.......8...o...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:38+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Russian.X-Poedit-Country: RUSSIAN FEDERATION..

C:\Program Files (x86)\GeoSetter\locale\rs\LC_MESSAGES\is-P2081.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 944 messages, Project-Id-Version: GeoSetter ' (%dx%d) '
Category:	dropped
Size (bytes):	77900
Entropy (8bit):	5.378577000709878
Encrypted:	false
SSDEEP:	1536:XQ7WXcQYNuvboRmmMxaw9XzYFPUOYn8KO421e:XQCXcZqkMxrtzYFPUOYn3OT1e
MD5:	5FFB9FE33AB2CE6EA38645DF9279D624
SHA1:	2AD1E941B367F2D43D237562CD99AA9B6F7A4DAF
SHA-256:	4562E81EB6320FCAB160805AFF2DEF3C659DB08AB92D47D7ADE8C899EFADDF74
SHA-512:	5F3564853D727C00D4BECA77FB06EC2D22C23C75BFD19D910E7268A3086A2CA29A5A2632936C9E920D02D862425D37C5DAAE5165FC31EE4B09887EB8D2A70ED3
Malicious:	false
Preview:	.........................;.......N.......N.......N.......N.......O..(....O..'...8O..#...`O.......O.......O.......O.......O.......O.......O.......P.......P......!P......8P......=P......DP......OP......XP......fP......lP......rP.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......Q......Q.....HQ..'...sQ..,....Q.......Q.......Q.......Q.......Q..$....Q.......R.......R..!...!R......CR......[R......qR......zR.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S..g....S.......S.......S.......S..e....S.......T......*T....../T......8T..%...GT.."...mT..6....T.......T.......T.......T.......T.......T.......T.......U.......U......&U.......U.. ...4U.. ...UU..)...vU.......U..4....U.......U.......U.......V.......V..I....V......xV.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......W.......W.......W......6W......;W......@W......LW......

C:\Program Files (x86)\GeoSetter\locale\rs\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.290170436958179
Encrypted:	false
SSDEEP:	6:ilij36YYuVsxfp0tfqqPnU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLiV+Rc:i436xuyx2lvU//IMBivXmBQWiRc5l01
MD5:	39101C20FEC81388B6EC5DFD1A203BE0
SHA1:	F648C6E187A4DC85BB08BF68555FEC5363C349A4
SHA-256:	978370CCA3D0DE4F198D7E367B01EA2B9FA1E6C7BDA5EF104B8ADBF1BDFF22EF
SHA-512:	76DEB3D9FA7DAA3AA7BE4A371BD2AD6EF4694F8822621FC96D940CB13FD12205985A1731FAAAA438B509153D4CECF4B14616DD4F8AB8842C52131A60A0B1E5D4
Malicious:	false
Preview:	................$.......,.......8...o...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:38+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Russian.X-Poedit-Country: RUSSIAN FEDERATION..

C:\Program Files (x86)\GeoSetter\locale\rs\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.913567323630911
Encrypted:	false
SSDEEP:	12:Kf26IfHVTolfp/i+L1CQU2fzHfz3/T9Xc9au:K+6Y+lR6u1s2z7TeF
MD5:	F7A56F3F48B51FB335A9BD519663DB48
SHA1:	67E6F1A2CBCB430C9C6122A09169C2DFD9A82444
SHA-256:	2CCAFEC967418B040C2AE79667FEF29FC3806745FB53C1B7F5436B9CE46D5826
SHA-512:	53011C375F5BDF0F3CCB697760402B416D5C3A9F48785760207859754AAC63EBB8A38EF3CD2D8813EB540AA6F617DA0F18D998995E0EFDB5589843515D5D5C60
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//........j.rI.nE.j?.f:.a4.]/.X.S$.O..K..F..C..^2...{....oo.OO.JI.EE.@@.;;.55.//..$$..........66.......rr.SS.OO.JK.FF.@@.;;.66.00.+.%%.......;;.......vv.XX.TT.OP.KK.FF.AA.;;.66.00.++.%%. .??....II.....................................}}........................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\rs\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4104172527605203
Encrypted:	false
SSDEEP:	3:TwLxULV:kLxSV
MD5:	0F1E5AA0BC50A749B845E7AF76098CF5
SHA1:	BD0C749C30728CD4112FCB356B3896E75FF81C7D
SHA-256:	20C07E43922AF063322174E3831ED11A9A8E766357A877E120A22B1CA6EDB476
SHA-512:	736116A792B99137C3CB9EA92AB1ACED6147EBB22FB3062A800353836A0B216784379127615C5EAAC6AAE03B2903C8618D25155DAFB1F3F22375AB42DA624588
Malicious:	false
Preview:	Russian..3.1.11.0

C:\Program Files (x86)\GeoSetter\locale\rs\is-R5A6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.913567323630911
Encrypted:	false
SSDEEP:	12:Kf26IfHVTolfp/i+L1CQU2fzHfz3/T9Xc9au:K+6Y+lR6u1s2z7TeF
MD5:	F7A56F3F48B51FB335A9BD519663DB48
SHA1:	67E6F1A2CBCB430C9C6122A09169C2DFD9A82444
SHA-256:	2CCAFEC967418B040C2AE79667FEF29FC3806745FB53C1B7F5436B9CE46D5826
SHA-512:	53011C375F5BDF0F3CCB697760402B416D5C3A9F48785760207859754AAC63EBB8A38EF3CD2D8813EB540AA6F617DA0F18D998995E0EFDB5589843515D5D5C60
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//........j.rI.nE.j?.f:.a4.]/.X.S$.O..K..F..C..^2...{....oo.OO.JI.EE.@@.;;.55.//..$$..........66.......rr.SS.OO.JK.FF.@@.;;.66.00.+.%%.......;;.......vv.XX.TT.OP.KK.FF.AA.;;.66.00.++.%%. .??....II.....................................}}........................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\rs\is-ULFFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4104172527605203
Encrypted:	false
SSDEEP:	3:TwLxULV:kLxSV
MD5:	0F1E5AA0BC50A749B845E7AF76098CF5
SHA1:	BD0C749C30728CD4112FCB356B3896E75FF81C7D
SHA-256:	20C07E43922AF063322174E3831ED11A9A8E766357A877E120A22B1CA6EDB476
SHA-512:	736116A792B99137C3CB9EA92AB1ACED6147EBB22FB3062A800353836A0B216784379127615C5EAAC6AAE03B2903C8618D25155DAFB1F3F22375AB42DA624588
Malicious:	false
Preview:	Russian..3.1.11.0

C:\Program Files (x86)\GeoSetter\locale\sv\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1203 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	85301
Entropy (8bit):	5.262831745834831
Encrypted:	false
SSDEEP:	1536:AX15IKyacafSQTA8icS80w/Oeh3WU+0JE5yBuiLf4+K5XL8JvwP/aK:M1tyahaGuwph35BL4+K5XQSd
MD5:	3B159C607A965E08D66C9B2429E74D1E
SHA1:	87EE1F96D920BEF44D31A5F205068B921463C614
SHA-256:	71521829D64DD667DA5385552313917AA52FC6F9A81727C1B2E57F801FA65166
SHA-512:	84C89BB650254D7F5FA3B63EFD052425C424D32FBF7B9A8A2DDE208732667E3EF66648D1E32FB3068259D5FC2CE242938326DB41A0F10AC2B3BED6A28D3C739E
Malicious:	false
Preview:	.................%..G...LK......hd......id......rd.......d.......d..(....d..'....d..#....e......$e......0e......Ie......Te......ie......re.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......f.......f.......f.......f.......f......-f......;f......If......Sf......Zf......mf......wf.......f.......f.......f......f......f..,....f..'...&g..,...Ng......{g.......g.......g.......g.......g..$....g.......g..6....g.......h......#h......7h..;...Ah..$...}h..E....h..#....h.......i..!....i......?i......Wi......mi.......i..3....i.......i.......i.......i.......i.......j.......j.......j.......j..h....j......Pk......Fl......Rl......`l......gl......ol......wl......{l.......l.......l.......l..g....l.......m......#m......-m..e...Am..Y....m.......n.......n......)n.......n..5...7n......mn......\|n..0....n..%....n.......n......\|o.."....p..6...Bp......yp.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p......

C:\Program Files (x86)\GeoSetter\locale\sv\LC_MESSAGES\is-C72FK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.251051164897462
Encrypted:	false
SSDEEP:	6:ilijD6YYuVsxfp0tfqqPnU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLiTA1e:i4D6xuyx2lvU//IMBivXmBQWiRc5l/bq
MD5:	AE93145DAD53FA65F2CBCA2872AA2F69
SHA1:	98B7A1EE27FFBBD2784F40FFA0D4B8A447715DEA
SHA-256:	BCF5441450E97C6A8B18EDFCAF38AE3155E04E88762343D0ADA2A39B238491F3
SHA-512:	49024822169B4510BC304208738F9B2946E4407D8E74C004572E522FAD563DE353B26F64CD7482A7F381F06AE0FF7EC7401392E5499F193A5B21BA0E24EE86AE
Malicious:	false
Preview:	................$.......,.......8...c...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:38+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Swedish.X-Poedit-Country: SWEDEN..

C:\Program Files (x86)\GeoSetter\locale\sv\LC_MESSAGES\is-H8A68.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1203 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	85301
Entropy (8bit):	5.262831745834831
Encrypted:	false
SSDEEP:	1536:AX15IKyacafSQTA8icS80w/Oeh3WU+0JE5yBuiLf4+K5XL8JvwP/aK:M1tyahaGuwph35BL4+K5XQSd
MD5:	3B159C607A965E08D66C9B2429E74D1E
SHA1:	87EE1F96D920BEF44D31A5F205068B921463C614
SHA-256:	71521829D64DD667DA5385552313917AA52FC6F9A81727C1B2E57F801FA65166
SHA-512:	84C89BB650254D7F5FA3B63EFD052425C424D32FBF7B9A8A2DDE208732667E3EF66648D1E32FB3068259D5FC2CE242938326DB41A0F10AC2B3BED6A28D3C739E
Malicious:	false
Preview:	.................%..G...LK......hd......id......rd.......d.......d..(....d..'....d..#....e......$e......0e......Ie......Te......ie......re.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......f.......f.......f.......f.......f......-f......;f......If......Sf......Zf......mf......wf.......f.......f.......f......f......f..,....f..'...&g..,...Ng......{g.......g.......g.......g.......g..$....g.......g..6....g.......h......#h......7h..;...Ah..$...}h..E....h..#....h.......i..!....i......?i......Wi......mi.......i..3....i.......i.......i.......i.......i.......j.......j.......j.......j..h....j......Pk......Fl......Rl......`l......gl......ol......wl......{l.......l.......l.......l..g....l.......m......#m......-m..e...Am..Y....m.......n.......n......)n.......n..5...7n......mn......\|n..0....n..%....n.......n......\|o.."....p..6...Bp......yp.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p......

C:\Program Files (x86)\GeoSetter\locale\sv\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.251051164897462
Encrypted:	false
SSDEEP:	6:ilijD6YYuVsxfp0tfqqPnU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLiTA1e:i4D6xuyx2lvU//IMBivXmBQWiRc5l/bq
MD5:	AE93145DAD53FA65F2CBCA2872AA2F69
SHA1:	98B7A1EE27FFBBD2784F40FFA0D4B8A447715DEA
SHA-256:	BCF5441450E97C6A8B18EDFCAF38AE3155E04E88762343D0ADA2A39B238491F3
SHA-512:	49024822169B4510BC304208738F9B2946E4407D8E74C004572E522FAD563DE353B26F64CD7482A7F381F06AE0FF7EC7401392E5499F193A5B21BA0E24EE86AE
Malicious:	false
Preview:	................$.......,.......8...c...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:38+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Swedish.X-Poedit-Country: SWEDEN..

C:\Program Files (x86)\GeoSetter\locale\sv\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.593387401137585
Encrypted:	false
SSDEEP:	12:Kf2/i0ASYS0CqwaCv/Nh73YCe3PQKdTP8PO8r0mpxt6RLZFKu/73:K+cRCEo/Nh7HYPjj4OOReRLZFJ/L
MD5:	8FB6C32243D7C0CF255D78BA96F77F74
SHA1:	8CC6258FFFBDC810FC0F9C54FF40D27CC0EEA19D
SHA-256:	2944DFA3FF38066F090C76D7EBF29FC5BFD4281AD5A641F9B28A8AD92DC76D4D
SHA-512:	3654BC2DBB19867F900192F7CAE1A64BD0AC67F6757303D4B7ADCB459B0C207D47A85C3A5724DEBD111728E7F6445F74D4658049C98281A4A541067F3A70EBEC
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................................................c..]..Y..S...........=..9..3..-..'..%..!........i!...a..]..XU..P..K....F..B..=..9..5..2.\|/.{,...o'...f..D..?:..4......{).w#.t..p..l..j..g..}/!..s/..j..I..E?..:..4..../.{.x$.p..l..i..e..{3=.....o..O..I..E..@..:..5../....$...........6........s..S..O..K..F..@..;..6..0..+..%........;........v..X..T..P..K..F..A..<..6..0..+..%.. ..?......A..y..\.XT..Q..K....P..B..<..7..1.\|+.z&..D;...C..{.._..\Y..T..Q....L..G..B..=..7..1.\|,..IA...C..{.{.yw..t..q...m.i..e..a..\..X..S..NG...C..C..C..C..........u3.s-.m'.i!.c..]..Y..S..M....................................................................................................

C:\Program Files (x86)\GeoSetter\locale\sv\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:K6LVhn:VD
MD5:	3055DF4B5AE6CFAFDC25B07795EB59B1
SHA1:	EDE1A4DB7CDC03073CDD6A3756DF5E0B81BF6446
SHA-256:	5E517E50BBFCEE244673125B767BA5DCA2BFA9A814B9799EEBC01CE21D361BBB
SHA-512:	48970A67A791417423EE095F4D8C5CB3A869FBA65307A9BC85D1553299353FBD00FFB53D868D65E17F856EC641927A608F4D07D649F6D443C3B6B9F2D5092FB2
Malicious:	false
Preview:	Swedish..2.4.0.0

C:\Program Files (x86)\GeoSetter\locale\sv\is-05NLD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:K6LVhn:VD
MD5:	3055DF4B5AE6CFAFDC25B07795EB59B1
SHA1:	EDE1A4DB7CDC03073CDD6A3756DF5E0B81BF6446
SHA-256:	5E517E50BBFCEE244673125B767BA5DCA2BFA9A814B9799EEBC01CE21D361BBB
SHA-512:	48970A67A791417423EE095F4D8C5CB3A869FBA65307A9BC85D1553299353FBD00FFB53D868D65E17F856EC641927A608F4D07D649F6D443C3B6B9F2D5092FB2
Malicious:	false
Preview:	Swedish..2.4.0.0

C:\Program Files (x86)\GeoSetter\locale\sv\is-8GUVM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.593387401137585
Encrypted:	false
SSDEEP:	12:Kf2/i0ASYS0CqwaCv/Nh73YCe3PQKdTP8PO8r0mpxt6RLZFKu/73:K+cRCEo/Nh7HYPjj4OOReRLZFJ/L
MD5:	8FB6C32243D7C0CF255D78BA96F77F74
SHA1:	8CC6258FFFBDC810FC0F9C54FF40D27CC0EEA19D
SHA-256:	2944DFA3FF38066F090C76D7EBF29FC5BFD4281AD5A641F9B28A8AD92DC76D4D
SHA-512:	3654BC2DBB19867F900192F7CAE1A64BD0AC67F6757303D4B7ADCB459B0C207D47A85C3A5724DEBD111728E7F6445F74D4658049C98281A4A541067F3A70EBEC
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................................................c..]..Y..S...........=..9..3..-..'..%..!........i!...a..]..XU..P..K....F..B..=..9..5..2.\|/.{,...o'...f..D..?:..4......{).w#.t..p..l..j..g..}/!..s/..j..I..E?..:..4..../.{.x$.p..l..i..e..{3=.....o..O..I..E..@..:..5../....$...........6........s..S..O..K..F..@..;..6..0..+..%........;........v..X..T..P..K..F..A..<..6..0..+..%.. ..?......A..y..\.XT..Q..K....P..B..<..7..1.\|+.z&..D;...C..{.._..\Y..T..Q....L..G..B..=..7..1.\|,..IA...C..{.{.yw..t..q...m.i..e..a..\..X..S..NG...C..C..C..C..........u3.s-.m'.i!.c..]..Y..S..M....................................................................................................

C:\Program Files (x86)\GeoSetter\locale\zh\LC_MESSAGES\default.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1910 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	148890
Entropy (8bit):	6.129193608576821
Encrypted:	false
SSDEEP:	3072:i5vibaLh3H8/rn7ww5MfcIfin7pgOmoxJS:iV9h3H8x2fcIfin72uk
MD5:	6BB92F6B3BA345CE7B45DAB9CBF9F02C
SHA1:	D348C7D73C0B5A6E666207CBBE220204E0321FCD
SHA-256:	BC211B92ACA1BD25ABC019D2D93279A457FA09B09EEA49479A1AEB9FB1AB33EF
SHA-512:	3A99146137FE6B7F95719A0B1A3E136E2E2E9AEBDCC5A406353228134A3105545727CE9F9AA93CB932FF92811DFF596B82DFDF0FEFE1D87EC52249CF3A756C5E
Malicious:	false
Preview:	........v........;......\|w......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...D.......#....................../...........E.......^.......i...,...~...........................................................................................%.......3.......9.......A.......F.......J.......Q.......W.......\.......o..............................................................................................................................G.......O...R................,.......i...%...'.......,..................................................................!...%...0.......V.......7...$...K.......p...................6............................ ...........&...&...:.......a.......k...........;.......$.............E.......#...>.......b...!...s............................................+.......<...3...V................................................$...................6..............

C:\Program Files (x86)\GeoSetter\locale\zh\LC_MESSAGES\is-CVVEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 1910 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	148890
Entropy (8bit):	6.129193608576821
Encrypted:	false
SSDEEP:	3072:i5vibaLh3H8/rn7ww5MfcIfin7pgOmoxJS:iV9h3H8x2fcIfin72uk
MD5:	6BB92F6B3BA345CE7B45DAB9CBF9F02C
SHA1:	D348C7D73C0B5A6E666207CBBE220204E0321FCD
SHA-256:	BC211B92ACA1BD25ABC019D2D93279A457FA09B09EEA49479A1AEB9FB1AB33EF
SHA-512:	3A99146137FE6B7F95719A0B1A3E136E2E2E9AEBDCC5A406353228134A3105545727CE9F9AA93CB932FF92811DFF596B82DFDF0FEFE1D87EC52249CF3A756C5E
Malicious:	false
Preview:	........v........;......\|w......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...D.......#....................../...........E.......^.......i...,...~...........................................................................................%.......3.......9.......A.......F.......J.......Q.......W.......\.......o..............................................................................................................................G.......O...R................,.......i...%...'.......,..................................................................!...%...0.......V.......7...$...K.......p...................6............................ ...........&...&...:.......a.......k...........;.......$.............E.......#...>.......b...!...s............................................+.......<...3...V................................................$...................6..............

C:\Program Files (x86)\GeoSetter\locale\zh\LC_MESSAGES\is-M06OA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: GeoSetter '\351\230\277\346\257\224\350\256\251'
Category:	dropped
Size (bytes):	16337
Entropy (8bit):	4.843944614214454
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZlg5B1FLVCbBwp+1uWhws+ME:WyayDgtxVGBwg1Zw1ME
MD5:	1B1F3745862A141ECA10BB5B63BB4991
SHA1:	7791C72B2D7F96C719FFB1CFE09A195B24777246
SHA-256:	8FF5356B192804EEF408020E0A3C088D8517740E8C70B67064AEC048BAAE95AE
SHA-512:	A80B1DE7DDE48C8BBE226B15691B53DD7EDFDD22B32200605E6A840657B18AE5EB305F964AA3C9EBE6CD34D54DB518093145A2C562F8E30AAA68C98B6977012E
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\zh\LC_MESSAGES\tzdata.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: GeoSetter '\351\230\277\346\257\224\350\256\251'
Category:	dropped
Size (bytes):	16337
Entropy (8bit):	4.843944614214454
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZlg5B1FLVCbBwp+1uWhws+ME:WyayDgtxVGBwg1Zw1ME
MD5:	1B1F3745862A141ECA10BB5B63BB4991
SHA1:	7791C72B2D7F96C719FFB1CFE09A195B24777246
SHA-256:	8FF5356B192804EEF408020E0A3C088D8517740E8C70B67064AEC048BAAE95AE
SHA-512:	A80B1DE7DDE48C8BBE226B15691B53DD7EDFDD22B32200605E6A840657B18AE5EB305F964AA3C9EBE6CD34D54DB518093145A2C562F8E30AAA68C98B6977012E
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Program Files (x86)\GeoSetter\locale\zh\flag.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.198147678266805
Encrypted:	false
SSDEEP:	24:K+fT9AlcnudJp7HGYhQGWj6YhenBYdCd0y:RfpAGe77HtPWjaBus0y
MD5:	8EDF8AA53810DF0F766D9FD9B0F165AE
SHA1:	F3013D94420D754100BD056659F0E40E1319D910
SHA-256:	56AD9629CA37D5977480C493A3CED11011B9D2955262FDCF3A75ACBCAB07F895
SHA-512:	765EB617EBB0082FE79C9E72A4D9BF81FDF716F2D79F1C01F6A8D3C4F8AEF63019A0A4B961A218C93A51CA0E07EA1497823E0BAC8A2A04A9D636A9B6B19667AA
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//.......jj.II.EE.??.::.44.//..$$.............22.......oo.OO.IJ.EE.@@.:;.55.//..$$..........66.......sr.SS.OO.KR.F..@@.;;.66.00.++.%%.......;;.......vy.XX.TW.P..K..F..AB.<;.66.00.++.%%. .??.......y..\..Y..TT.Q..K..G..BA.<<.67.11.++.&&.DD.......z.._..\..Y\.T..Q..L..GG.BB.=<.77.11.,,.II.......{..{..y..w..t..q..mo.ii.ee.``.\\.WW.SS.NN....................E.................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\zh\info.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.5724694587701364
Encrypted:	false
SSDEEP:	3:LzNgbV:2
MD5:	4F3B56109AA385E87B17DD8BE01DA0C3
SHA1:	B8C13386207D574965BC53F123A8693208BBEBD6
SHA-256:	B6B0ED129D9845475BE345990E930EA24F3B1B92427F7804317F7A297BE75D3E
SHA-512:	6932029836654ED8AB0CF241D7B9BECD0435D531D9E8A2CEA725B692ADB0158FD8CFDD7262879E0A457040E122F00036B580ED9A016DB97B454292D21BA75954
Malicious:	false
Preview:	Chinese..3.4.22.0

C:\Program Files (x86)\GeoSetter\locale\zh\is-JNE8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.198147678266805
Encrypted:	false
SSDEEP:	24:K+fT9AlcnudJp7HGYhQGWj6YhenBYdCd0y:RfpAGe77HtPWjaBus0y
MD5:	8EDF8AA53810DF0F766D9FD9B0F165AE
SHA1:	F3013D94420D754100BD056659F0E40E1319D910
SHA-256:	56AD9629CA37D5977480C493A3CED11011B9D2955262FDCF3A75ACBCAB07F895
SHA-512:	765EB617EBB0082FE79C9E72A4D9BF81FDF716F2D79F1C01F6A8D3C4F8AEF63019A0A4B961A218C93A51CA0E07EA1497823E0BAC8A2A04A9D636A9B6B19667AA
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//.......jj.II.EE.??.::.44.//..$$.............22.......oo.OO.IJ.EE.@@.:;.55.//..$$..........66.......sr.SS.OO.KR.F..@@.;;.66.00.++.%%.......;;.......vy.XX.TW.P..K..F..AB.<;.66.00.++.%%. .??.......y..\..Y..TT.Q..K..G..BA.<<.67.11.++.&&.DD.......z.._..\..Y\.T..Q..L..GG.BB.=<.77.11.,,.II.......{..{..y..w..t..q..mo.ii.ee.``.\\.WW.SS.NN....................E.................................................................................................................................

C:\Program Files (x86)\GeoSetter\locale\zh\is-TCCPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.5724694587701364
Encrypted:	false
SSDEEP:	3:LzNgbV:2
MD5:	4F3B56109AA385E87B17DD8BE01DA0C3
SHA1:	B8C13386207D574965BC53F123A8693208BBEBD6
SHA-256:	B6B0ED129D9845475BE345990E930EA24F3B1B92427F7804317F7A297BE75D3E
SHA-512:	6932029836654ED8AB0CF241D7B9BECD0435D531D9E8A2CEA725B692ADB0158FD8CFDD7262879E0A457040E122F00036B580ED9A016DB97B454292D21BA75954
Malicious:	false
Preview:	Chinese..3.4.22.0

C:\Program Files (x86)\GeoSetter\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337920
Entropy (8bit):	6.5178783700918705
Encrypted:	false
SSDEEP:	6144:M6MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1Pi5:M6MNzVgz1LgXCpfoaDqHojjYkARqPL0r
MD5:	E2616501D38321DFFE061456EA53899B
SHA1:	8C67AB03D4C19C3ED25B0CB73BFF47E953F10050
SHA-256:	BB8EE38E365913AF381B5911BCB2D9722177DC9DE5DD311C17B020C16DD6BEC0
SHA-512:	81AA45AE5AD68CAB7994CA6D9FA2A2244F9865A3CD7DC3E37B0D18C18CDC0C453D65BA48B807F6F2A82FF7A9EA71FCDF48964831C6DC46545BDC02FC4DC7D343
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`...3...3...3...3...3..f3...3..w3...3..q3...3...3i..3..a3...3..p3...3..v3...3..s3...3Rich...3........PE..L....Y{]...........!.........l......i5...............................................F..............................@....).....<....0..0....................@...,..@...............................@...@............................................text...j........................... ..`.rdata..............................@..@.data....[.......@..................@....rsrc...0....0......................@..@.reloc...3...@...4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\tools\.ExifTool_config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.798195437385917
Encrypted:	false
SSDEEP:	12:bo4BXmsTo5FGv17T/7DzSGTVMuc/xhVSmFI465K4tAQsHYNM1dNgPybSt:xmaobGvhT/7D9TRSbHFI4+K4tAQTYsD
MD5:	2AC4F720B6BE1BA346522BA8C0C093F2
SHA1:	108F607D110C0D4F4FCA2408073E51743F281D6F
SHA-256:	9431CB310309A9D49510E44FC45B2D468E8E9ED544EEF3CEC19996152E0F8319
SHA-512:	1392B881D51A5D41E2650D9124E217C9AEB06ED64CED57B31AFE65C05A61D15996E8F8457BC53632DD72E73A280C062BB4148844C872C30162076B53BF17015F
Malicious:	false
Preview:	# exiftool config file..%Image::ExifTool::UserDefined = (.. 'Image::ExifTool::XMP::Main' => {.. geosetter => {.. SubDirectory => {.. TagTable => 'Image::ExifTool::UserDefined::geosetter',.. },.. },.. },..);....%Image::ExifTool::UserDefined::geosetter = (.. GROUPS => { 0 => 'XMP', 1 => 'XMP-geosetter', 2 => 'Other' },.. # (use whatever URI you want in the next line).. NAMESPACE => { 'geosetter' => 'http://ns.geosetter.com/1.0/' },.. WRITABLE => 'string',.. ForeignKeys => {.. Name => 'ForeignKeys', # (specified only to get proper capitalization).. Writable => 'string',.. List => 'Bag',.. },..);..1; #end

C:\Program Files (x86)\GeoSetter\tools\consoleStartHelper.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	6.410768722623736
Encrypted:	false
SSDEEP:	1536:REqqCwQr1LLFuFYRzHqEi3K4YTTFnn79pWdOqombEzaVie45H3vopgGCBGFcX:oCwe1/Hni64Y3pn79pWdRombEzaVd4tH
MD5:	508863FFA139B1842A8797CD12EB4E13
SHA1:	F7A7A672AA20DCB07F37C1AA366215766771E953
SHA-256:	34242F4CEC8920D2C924F8F14CEF4BA4A95333109F43011F20E25C4A83933BB4
SHA-512:	712A7278D243897B9C815AA8FD67DF4A04A198FFC00A077CCBFC6D95AE8EC6C4C3AE115232A1667C80987024E760AE7EB25BB5B7F1F193CB9C226AAED69D2AB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B.......$.......0....@..............................................@...........................P..\............................................................p......................................................CODE................................ ..`DATA....x....0......................@...BSS..........@......."...................idata..\....P......."..............@....tls.........`...........................rdata.......p......................@..P.reloc...............0..............@..P.rsrc................H..............@..P.....................^..............@..P........................................................................................................................................

C:\Program Files (x86)\GeoSetter\tools\exiftool.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8340681
Entropy (8bit):	7.6374125796179735
Encrypted:	false
SSDEEP:	196608:rhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vklt4qqkGwFirGi8XxlV:7Jhlt4qqkGwFirGixuWl2
MD5:	CB2157B42F3AB50ED1A1977F995223E4
SHA1:	AC92CD9AB5480F6AAF321BF99541B311B7ED9DFC
SHA-256:	37E911F909D4EC025B9B3A4D3DF9D890B47992BD4CF4EC946BB1377C7105AE20
SHA-512:	BAC51CB2ADF092CA1B0E336DD38BA531A029614E347A264846A3CB8179432E8B3495647DC21F437E6A2AE6DEB86436864E2AFAED49C9F5A01ED12C493882377B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....%X.................B...................`....@..................................d........ ..............................p..(........#...........................................................................q..`............................text...dA.......B..................`.P`.data...Hj...`...l...F..............@.`..rdata..............................@.0@.bss..................................`..idata..(....p......................@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc....#.......$..................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\tools\is-O4PJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.798195437385917
Encrypted:	false
SSDEEP:	12:bo4BXmsTo5FGv17T/7DzSGTVMuc/xhVSmFI465K4tAQsHYNM1dNgPybSt:xmaobGvhT/7D9TRSbHFI4+K4tAQTYsD
MD5:	2AC4F720B6BE1BA346522BA8C0C093F2
SHA1:	108F607D110C0D4F4FCA2408073E51743F281D6F
SHA-256:	9431CB310309A9D49510E44FC45B2D468E8E9ED544EEF3CEC19996152E0F8319
SHA-512:	1392B881D51A5D41E2650D9124E217C9AEB06ED64CED57B31AFE65C05A61D15996E8F8457BC53632DD72E73A280C062BB4148844C872C30162076B53BF17015F
Malicious:	false
Preview:	# exiftool config file..%Image::ExifTool::UserDefined = (.. 'Image::ExifTool::XMP::Main' => {.. geosetter => {.. SubDirectory => {.. TagTable => 'Image::ExifTool::UserDefined::geosetter',.. },.. },.. },..);....%Image::ExifTool::UserDefined::geosetter = (.. GROUPS => { 0 => 'XMP', 1 => 'XMP-geosetter', 2 => 'Other' },.. # (use whatever URI you want in the next line).. NAMESPACE => { 'geosetter' => 'http://ns.geosetter.com/1.0/' },.. WRITABLE => 'string',.. ForeignKeys => {.. Name => 'ForeignKeys', # (specified only to get proper capitalization).. Writable => 'string',.. List => 'Bag',.. },..);..1; #end

C:\Program Files (x86)\GeoSetter\tools\is-QSPTB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8340681
Entropy (8bit):	7.6374125796179735
Encrypted:	false
SSDEEP:	196608:rhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vklt4qqkGwFirGi8XxlV:7Jhlt4qqkGwFirGixuWl2
MD5:	CB2157B42F3AB50ED1A1977F995223E4
SHA1:	AC92CD9AB5480F6AAF321BF99541B311B7ED9DFC
SHA-256:	37E911F909D4EC025B9B3A4D3DF9D890B47992BD4CF4EC946BB1377C7105AE20
SHA-512:	BAC51CB2ADF092CA1B0E336DD38BA531A029614E347A264846A3CB8179432E8B3495647DC21F437E6A2AE6DEB86436864E2AFAED49C9F5A01ED12C493882377B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....%X.................B...................`....@..................................d........ ..............................p..(........#...........................................................................q..`............................text...dA.......B..................`.P`.data...Hj...`...l...F..............@.`..rdata..............................@.0@.bss..................................`..idata..(....p......................@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc....#.......$..................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	6.410768722623736
Encrypted:	false
SSDEEP:	1536:REqqCwQr1LLFuFYRzHqEi3K4YTTFnn79pWdOqombEzaVie45H3vopgGCBGFcX:oCwe1/Hni64Y3pn79pWdRombEzaVd4tH
MD5:	508863FFA139B1842A8797CD12EB4E13
SHA1:	F7A7A672AA20DCB07F37C1AA366215766771E953
SHA-256:	34242F4CEC8920D2C924F8F14CEF4BA4A95333109F43011F20E25C4A83933BB4
SHA-512:	712A7278D243897B9C815AA8FD67DF4A04A198FFC00A077CCBFC6D95AE8EC6C4C3AE115232A1667C80987024E760AE7EB25BB5B7F1F193CB9C226AAED69D2AB0
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B.......$.......0....@..............................................@...........................P..\............................................................p......................................................CODE................................ ..`DATA....x....0......................@...BSS..........@......."...................idata..\....P......."..............@....tls.........`...........................rdata.......p......................@..P.reloc...............0..............@..P.rsrc................H..............@..P.....................^..............@..P........................................................................................................................................

C:\Program Files (x86)\GeoSetter\tzdata\africa (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	42415
Entropy (8bit):	5.469619097721864
Encrypted:	false
SSDEEP:	768:8BZWtpKEi/fwS7YZsGkl8eL5asCRULYkpDkKmwewpkmo:QzEafr75L5CRULYkpAzmo
MD5:	87916D047677BC81B7FA62A0432F3AAB
SHA1:	4E74E87B43C7C4ECA6D84F5C48C390F2798BA988
SHA-256:	52F344C8FFDF19AF91180ECD889E32850A43135F8DE888FCCB9B8BCA2C3DE3A5
SHA-512:	F1A3F90E9C2D2997CE62FC3C4F6C8186545FB70C94FD93CDDF780BC17FE6BC3B74864530B892BF27222C5D97660D7A7EF9E093342DC632ACF1904D15C262BFD3
Malicious:	false
Preview:	# <pre>.# @(#)africa.8.33.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.#.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1990, and IATA SSIM is the source for entries afterwards..#.# Another source occasionally used is Edward W. W

C:\Program Files (x86)\GeoSetter\tzdata\antarctica (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	5.4095590961113675
Encrypted:	false
SSDEEP:	384:sA2Tae5ZHtCpvyqK04kNQvbS5iMFwyvct:sA272M04kNsLMFwXt
MD5:	AABAD07AB765FDE7CD1FFF689F664132
SHA1:	A2D3E2826AB10A98A7CC68F26508EE51F26861AF
SHA-256:	F444BB1E4C80E4E59CDFCAD284CFB7FC3F211C32AA4611E8F738746F5F1195CD
SHA-512:	C22DF3483C4945901E06A21C4EC4610D4233F37627EF7D02BCDC8F769DCAAEBB5B192E102C7F20E7FBBC882A46906544A4535AA49F6E36B12ED6BBD7ACFEA993
Malicious:	false
Preview:	# <pre>.# @(#)antarctica.8.9.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# From Paul Eggert (1999-11-15):.# To keep things manageable, we list only locations occupied year-round; see.# <a href="http://www.comnap.aq/comnap/comnap.nsf/P/Stations/">.# COMNAP - Stations and Bases.# </a>.# and.# <a href="http://www.spri.cam.ac.uk/bob/periant.htm">.# Summary of the Peri-Antarctic Islands (1998-07-23).# </a>.# for information..# Unless otherwise specified, we have no time zone information..#.# Except for the French entries,.# I made up all time zone abbreviations mentioned here; corrections welcome!.# FORMAT is `zzz' and GMTOFF is 0 for locations while uninhabited...# These rules are stolen from the `southamerica' file..# Rule.NAME.FROM.TO.TYPE.IN.ON.AT.SAVE.LETTER/S.Rule.ArgAQ.1964.1966.-.Mar. 1.0:00.0.-.Rule.ArgAQ.1964.1966.-.Oct.15.0:00.1:00.S.Rule.ArgAQ.1967.only.-.Apr. 2.0:00.0.-.Rule.ArgAQ.1967.1968.-.Oct.Sun>=1.0:00.1:00.S.Rule.ArgAQ.196

C:\Program Files (x86)\GeoSetter\tzdata\asia (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	110213
Entropy (8bit):	5.37126559321908
Encrypted:	false
SSDEEP:	1536:dxTFX/N+mJwA/1/s/WsQ7AqwtfYB6GjmrwjMFu:/TFRb5i09Ku
MD5:	83F91463549640E039CBF003247D5637
SHA1:	F6FE879C40EAEAD1EC9FE613A0413292695779A1
SHA-256:	479001FC5D3B97274C1525181BF0ACAD75CDFC9CB09EEC0FB6C05F4F725D7CB2
SHA-512:	B584AB79BCFC7EE4A9555F2ADDC86046D2EE24CFF4A88B3227D250B72D5450299B14D6E112FA4744F2A483619E2EDEBCFEC3BBB7655F177E5D1C5C66896D1041
Malicious:	false
Preview:	# @(#)asia.8.69.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.#.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1990, and IATA SSIM is the source for entries afterwards..#.# Another source occasionally used is Edward W. Whitman, Wo

C:\Program Files (x86)\GeoSetter\tzdata\australasia (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	67373
Entropy (8bit):	5.325962273855227
Encrypted:	false
SSDEEP:	768:/bCROh21kVPmYfelhwxQ9vLcVc2fl/d/qBhsMEVe5YP3nMAK0/wueFLVm6zJwwq7:OBA+YfGhL4V//qBq4YP3nVBdHoW
MD5:	3BBCBE95E0CB223B66D214AEA478C341
SHA1:	5A218DAB70FD2EEDD51C657F91F31CC56D0970EF
SHA-256:	A0ABB05700C2D65036A971003F16575DB10BDAC72471181DB5F2EBA6DA3AB219
SHA-512:	3B72B0512F147F46888FC2D9C72FF72D30063B6C5C74393898AE6DAFFF200C9F6894775C929E4E126CD99BE55F1F3851302C325E9AC31AE1895674C0F3DF1388
Malicious:	false
Preview:	# <pre>.# @(#)australasia.8.29.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This file also includes Pacific islands...# Notes are at the end of this file..###############################################################################..# Australia..# Please see the notes below for the controversy about "EST" versus "AEST" etc...# Rule.NAME.FROM.TO.TYPE.IN.ON.AT.SAVE.LETTER/S.Rule.Aus.1917.only.-.Jan. 1.0:01.1:00.-.Rule.Aus.1917.only.-.Mar.25.2:00.0.-.Rule.Aus.1942.only.-.Jan. 1.2:00.1:00.-.Rule.Aus.1942.only.-.Mar.29.2:00.0.-.Rule.Aus.1942.only.-.Sep.27.2:00.1:00.-.Rule.Aus.1943.1944.-.Mar.lastSun.2:00.0.-.Rule.Aus.1943.only.-.Oct. 3.2:00.1:00.-.# Go with Whitman and the Australian National Standards Commission, which.# says W Australia didn't use DST in 1943/1944. Ignore Whitman's claim that.# 1944/1945 was just like 1943/1944...# Zone.NAME..GMTOFF.RULES.FORMAT.[UNTIL].# Northern Territory.Zone Australia/Darwin. 8:43:20 -.LMT.1895 Feb

C:\Program Files (x86)\GeoSetter\tzdata\europe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	121157
Entropy (8bit):	5.373153939869935
Encrypted:	false
SSDEEP:	3072:VOALnWpty/basC9PhQts/xoWYCAzrfz7tqE:kAzWpty/basC9PhQtCjYCAzrtqE
MD5:	49F084B215A64D8AEADB80E10CFA98CA
SHA1:	928BE04CD3D5841240B1C887EB3F0A9EB4A14E90
SHA-256:	FD850645D417417CEFCC1CB838DF124B7CC16216610BA2C885DA52B132736113
SHA-512:	5AF80B1D94EC5B623861D47E7ED4E367DDE66D62810E7BC71F5794EDAB9345D01C73D348ADCD8D9230DF640AF49EEAFA42ADAC9DE47882A3199641AFC87B42AF
Malicious:	false
Preview:	# <pre>.# @(#)europe.8.40.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1991, and IATA SSIM is the source for entries afterwards..#.# Other sources occasionally used include:.#.#.Edwa

C:\Program Files (x86)\GeoSetter\tzdata\is-18N5M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	130000
Entropy (8bit):	5.382565942844045
Encrypted:	false
SSDEEP:	1536:0SHzwRPGYKCOXd6clGRf0Iacv293TlhvqIM/s86eSuCOBjY+fEArxeWoCI269:0ST+uYKlh02pFuC+V2x24
MD5:	33DB104AC53B1862FDA9E18CB2F4860C
SHA1:	279106E55B9AD5A35E469D3A1B51EE81F701E99A
SHA-256:	901C89E274221C8FDD6FF2DFF33F869E7B6EE5B4051E8B56993DE376FE70AB24
SHA-512:	C97E3AFD51F6D102617D26757AFB40E60781D4EAC2CE17339C85D467EDA8A974297AAD5C982B4097AF90F2CC1573632AF4788DFDD406B7CBBF8A0CC05D14A2B8
Malicious:	false
Preview:	# <pre>.# @(#)northamerica.8.51.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# also includes Central America and the Caribbean..# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (1999-03-22):.# A reliable and entertaining source about time zones is.# Derek Howse, Greenwich time and longitude, Philip Wilson Publishers (1997)...###############################################################################..# United States..# From Paul Eggert (1999-03-31):.# Howse writes (pp 121-125) that time zones were invented by.# Professor Charles Ferdinand Dowd (1825-1904),.# Principal of Temple Grove Ladies' Seminary (Saratoga Springs, NY)..# His pamphlet ``A System of National Time for Railroads'' (1870).# was the result of his proposals at the Convention of Railroad Trunk Lines.# in New York C

C:\Program Files (x86)\GeoSetter\tzdata\is-2BE55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	121157
Entropy (8bit):	5.373153939869935
Encrypted:	false
SSDEEP:	3072:VOALnWpty/basC9PhQts/xoWYCAzrfz7tqE:kAzWpty/basC9PhQtCjYCAzrtqE
MD5:	49F084B215A64D8AEADB80E10CFA98CA
SHA1:	928BE04CD3D5841240B1C887EB3F0A9EB4A14E90
SHA-256:	FD850645D417417CEFCC1CB838DF124B7CC16216610BA2C885DA52B132736113
SHA-512:	5AF80B1D94EC5B623861D47E7ED4E367DDE66D62810E7BC71F5794EDAB9345D01C73D348ADCD8D9230DF640AF49EEAFA42ADAC9DE47882A3199641AFC87B42AF
Malicious:	false
Preview:	# <pre>.# @(#)europe.8.40.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1991, and IATA SSIM is the source for entries afterwards..#.# Other sources occasionally used include:.#.#.Edwa

C:\Program Files (x86)\GeoSetter\tzdata\is-925FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	42415
Entropy (8bit):	5.469619097721864
Encrypted:	false
SSDEEP:	768:8BZWtpKEi/fwS7YZsGkl8eL5asCRULYkpDkKmwewpkmo:QzEafr75L5CRULYkpAzmo
MD5:	87916D047677BC81B7FA62A0432F3AAB
SHA1:	4E74E87B43C7C4ECA6D84F5C48C390F2798BA988
SHA-256:	52F344C8FFDF19AF91180ECD889E32850A43135F8DE888FCCB9B8BCA2C3DE3A5
SHA-512:	F1A3F90E9C2D2997CE62FC3C4F6C8186545FB70C94FD93CDDF780BC17FE6BC3B74864530B892BF27222C5D97660D7A7EF9E093342DC632ACF1904D15C262BFD3
Malicious:	false
Preview:	# <pre>.# @(#)africa.8.33.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.#.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1990, and IATA SSIM is the source for entries afterwards..#.# Another source occasionally used is Edward W. W

C:\Program Files (x86)\GeoSetter\tzdata\is-AUA1H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	5.4095590961113675
Encrypted:	false
SSDEEP:	384:sA2Tae5ZHtCpvyqK04kNQvbS5iMFwyvct:sA272M04kNsLMFwXt
MD5:	AABAD07AB765FDE7CD1FFF689F664132
SHA1:	A2D3E2826AB10A98A7CC68F26508EE51F26861AF
SHA-256:	F444BB1E4C80E4E59CDFCAD284CFB7FC3F211C32AA4611E8F738746F5F1195CD
SHA-512:	C22DF3483C4945901E06A21C4EC4610D4233F37627EF7D02BCDC8F769DCAAEBB5B192E102C7F20E7FBBC882A46906544A4535AA49F6E36B12ED6BBD7ACFEA993
Malicious:	false
Preview:	# <pre>.# @(#)antarctica.8.9.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# From Paul Eggert (1999-11-15):.# To keep things manageable, we list only locations occupied year-round; see.# <a href="http://www.comnap.aq/comnap/comnap.nsf/P/Stations/">.# COMNAP - Stations and Bases.# </a>.# and.# <a href="http://www.spri.cam.ac.uk/bob/periant.htm">.# Summary of the Peri-Antarctic Islands (1998-07-23).# </a>.# for information..# Unless otherwise specified, we have no time zone information..#.# Except for the French entries,.# I made up all time zone abbreviations mentioned here; corrections welcome!.# FORMAT is `zzz' and GMTOFF is 0 for locations while uninhabited...# These rules are stolen from the `southamerica' file..# Rule.NAME.FROM.TO.TYPE.IN.ON.AT.SAVE.LETTER/S.Rule.ArgAQ.1964.1966.-.Mar. 1.0:00.0.-.Rule.ArgAQ.1964.1966.-.Oct.15.0:00.1:00.S.Rule.ArgAQ.1967.only.-.Apr. 2.0:00.0.-.Rule.ArgAQ.1967.1968.-.Oct.Sun>=1.0:00.1:00.S.Rule.ArgAQ.196

C:\Program Files (x86)\GeoSetter\tzdata\is-F5A0M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1211
Entropy (8bit):	5.330350454852805
Encrypted:	false
SSDEEP:	24:4j99FWP0OJ6fQ3n22LI/U8Qgd32Ldb9OqC+2iPX2LVS9NtoCEmNIXDzzLNqhz1Un:4cS022LIJ9d2L/H6y2LVUaCEmIPPNqha
MD5:	8104230A4302828C165DC8B74D0318A7
SHA1:	D9B0F006606B1F55FA8BFF0F193D002763AC4E6D
SHA-256:	49D684E220ABF73FA429DC80F6C3F25FA0840AD2F9BFE35D2091D50E25539918
SHA-512:	886BE2717628778C226A8FAF049BF4EF95962C71FB67DD3D3DC5089B49387F3E42B827FA9478115CAC512745C9360684FFB895C0A7C3AC393316ECD1C010EB64
Malicious:	false
Preview:	# <pre>.# @(#)pacificnew.8.2.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# From Arthur David Olson (1989-04-05):.# On 1989-04-05, the U. S. House of Representatives passed (238-154) a bill.# establishing "Pacific Presidential Election Time"; it was not acted on.# by the Senate or signed into law by the President..# You might want to change the "PE" (Presidential Election) below to.# "Q" (Quadrennial) to maintain three-character zone abbreviations..# If you're really conservative, you might want to change it to "D"..# Avoid "L" (Leap Year), which won't be true in 2100...# If Presidential Election Time is ever established, replace "XXXX" below.# with the year the law takes effect and uncomment the "##" lines...# Rule.NAME.FROM.TO.TYPE.IN.ON.AT.SAVE.LETTER/S.## Rule.Twilite.XXXX.max.-.Apr.Sun>=1.2:00.1:00.D.## Rule.Twilite.XXXX.max.uspres.Oct.lastSun.2:00.1:00.PE.## Rule.Twilite.XXXX.max.uspres.Nov.Sun>=7.2:00.0.S.## Rule.Twilite.XXXX.max.n

C:\Program Files (x86)\GeoSetter\tzdata\is-N7D0S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	71921
Entropy (8bit):	5.401078288492173
Encrypted:	false
SSDEEP:	1536:5vPxoIg6wc7E6tC32iEFeibn1JCv+X/WAPOZt:5DgtEosn1xX/HPOD
MD5:	C8B550CD100E879BA995A6ECBD97C602
SHA1:	90184E1C4CAADB6744FB5F8A9B36889D6C8C8FC9
SHA-256:	F10AE7D7832DFC7C0367EB3DA536A5E4F46004C105FC839298ED68BC98B895AF
SHA-512:	9C092AE21266D22950C87ECE761B1F938C9ADBAEC7F5A0BFE7572A9CF84AC3E0E47519F12E09350A76B28D837F0C2044FABC28C3C4C86F546C7E240764A72559
Malicious:	false
Preview:	# <pre>.# @(#)southamerica.8.52.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1990, and IATA SSIM is the source for entries afterwards..#.# Earlier editions of these tables used the N

C:\Program Files (x86)\GeoSetter\tzdata\is-SFEQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	67373
Entropy (8bit):	5.325962273855227
Encrypted:	false
SSDEEP:	768:/bCROh21kVPmYfelhwxQ9vLcVc2fl/d/qBhsMEVe5YP3nMAK0/wueFLVm6zJwwq7:OBA+YfGhL4V//qBq4YP3nVBdHoW
MD5:	3BBCBE95E0CB223B66D214AEA478C341
SHA1:	5A218DAB70FD2EEDD51C657F91F31CC56D0970EF
SHA-256:	A0ABB05700C2D65036A971003F16575DB10BDAC72471181DB5F2EBA6DA3AB219
SHA-512:	3B72B0512F147F46888FC2D9C72FF72D30063B6C5C74393898AE6DAFFF200C9F6894775C929E4E126CD99BE55F1F3851302C325E9AC31AE1895674C0F3DF1388
Malicious:	false
Preview:	# <pre>.# @(#)australasia.8.29.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This file also includes Pacific islands...# Notes are at the end of this file..###############################################################################..# Australia..# Please see the notes below for the controversy about "EST" versus "AEST" etc...# Rule.NAME.FROM.TO.TYPE.IN.ON.AT.SAVE.LETTER/S.Rule.Aus.1917.only.-.Jan. 1.0:01.1:00.-.Rule.Aus.1917.only.-.Mar.25.2:00.0.-.Rule.Aus.1942.only.-.Jan. 1.2:00.1:00.-.Rule.Aus.1942.only.-.Mar.29.2:00.0.-.Rule.Aus.1942.only.-.Sep.27.2:00.1:00.-.Rule.Aus.1943.1944.-.Mar.lastSun.2:00.0.-.Rule.Aus.1943.only.-.Oct. 3.2:00.1:00.-.# Go with Whitman and the Australian National Standards Commission, which.# says W Australia didn't use DST in 1943/1944. Ignore Whitman's claim that.# 1944/1945 was just like 1943/1944...# Zone.NAME..GMTOFF.RULES.FORMAT.[UNTIL].# Northern Territory.Zone Australia/Darwin. 8:43:20 -.LMT.1895 Feb

C:\Program Files (x86)\GeoSetter\tzdata\is-VDVOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	110213
Entropy (8bit):	5.37126559321908
Encrypted:	false
SSDEEP:	1536:dxTFX/N+mJwA/1/s/WsQ7AqwtfYB6GjmrwjMFu:/TFRb5i09Ku
MD5:	83F91463549640E039CBF003247D5637
SHA1:	F6FE879C40EAEAD1EC9FE613A0413292695779A1
SHA-256:	479001FC5D3B97274C1525181BF0ACAD75CDFC9CB09EEC0FB6C05F4F725D7CB2
SHA-512:	B584AB79BCFC7EE4A9555F2ADDC86046D2EE24CFF4A88B3227D250B72D5450299B14D6E112FA4744F2A483619E2EDEBCFEC3BBB7655F177E5D1C5C66896D1041
Malicious:	false
Preview:	# @(#)asia.8.69.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.#.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1990, and IATA SSIM is the source for entries afterwards..#.# Another source occasionally used is Edward W. Whitman, Wo

C:\Program Files (x86)\GeoSetter\tzdata\northamerica (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	130000
Entropy (8bit):	5.382565942844045
Encrypted:	false
SSDEEP:	1536:0SHzwRPGYKCOXd6clGRf0Iacv293TlhvqIM/s86eSuCOBjY+fEArxeWoCI269:0ST+uYKlh02pFuC+V2x24
MD5:	33DB104AC53B1862FDA9E18CB2F4860C
SHA1:	279106E55B9AD5A35E469D3A1B51EE81F701E99A
SHA-256:	901C89E274221C8FDD6FF2DFF33F869E7B6EE5B4051E8B56993DE376FE70AB24
SHA-512:	C97E3AFD51F6D102617D26757AFB40E60781D4EAC2CE17339C85D467EDA8A974297AAD5C982B4097AF90F2CC1573632AF4788DFDD406B7CBBF8A0CC05D14A2B8
Malicious:	false
Preview:	# <pre>.# @(#)northamerica.8.51.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# also includes Central America and the Caribbean..# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (1999-03-22):.# A reliable and entertaining source about time zones is.# Derek Howse, Greenwich time and longitude, Philip Wilson Publishers (1997)...###############################################################################..# United States..# From Paul Eggert (1999-03-31):.# Howse writes (pp 121-125) that time zones were invented by.# Professor Charles Ferdinand Dowd (1825-1904),.# Principal of Temple Grove Ladies' Seminary (Saratoga Springs, NY)..# His pamphlet ``A System of National Time for Railroads'' (1870).# was the result of his proposals at the Convention of Railroad Trunk Lines.# in New York C

C:\Program Files (x86)\GeoSetter\tzdata\pacificnew (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1211
Entropy (8bit):	5.330350454852805
Encrypted:	false
SSDEEP:	24:4j99FWP0OJ6fQ3n22LI/U8Qgd32Ldb9OqC+2iPX2LVS9NtoCEmNIXDzzLNqhz1Un:4cS022LIJ9d2L/H6y2LVUaCEmIPPNqha
MD5:	8104230A4302828C165DC8B74D0318A7
SHA1:	D9B0F006606B1F55FA8BFF0F193D002763AC4E6D
SHA-256:	49D684E220ABF73FA429DC80F6C3F25FA0840AD2F9BFE35D2091D50E25539918
SHA-512:	886BE2717628778C226A8FAF049BF4EF95962C71FB67DD3D3DC5089B49387F3E42B827FA9478115CAC512745C9360684FFB895C0A7C3AC393316ECD1C010EB64
Malicious:	false
Preview:	# <pre>.# @(#)pacificnew.8.2.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# From Arthur David Olson (1989-04-05):.# On 1989-04-05, the U. S. House of Representatives passed (238-154) a bill.# establishing "Pacific Presidential Election Time"; it was not acted on.# by the Senate or signed into law by the President..# You might want to change the "PE" (Presidential Election) below to.# "Q" (Quadrennial) to maintain three-character zone abbreviations..# If you're really conservative, you might want to change it to "D"..# Avoid "L" (Leap Year), which won't be true in 2100...# If Presidential Election Time is ever established, replace "XXXX" below.# with the year the law takes effect and uncomment the "##" lines...# Rule.NAME.FROM.TO.TYPE.IN.ON.AT.SAVE.LETTER/S.## Rule.Twilite.XXXX.max.-.Apr.Sun>=1.2:00.1:00.D.## Rule.Twilite.XXXX.max.uspres.Oct.lastSun.2:00.1:00.PE.## Rule.Twilite.XXXX.max.uspres.Nov.Sun>=7.2:00.0.S.## Rule.Twilite.XXXX.max.n

C:\Program Files (x86)\GeoSetter\tzdata\southamerica (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	71921
Entropy (8bit):	5.401078288492173
Encrypted:	false
SSDEEP:	1536:5vPxoIg6wc7E6tC32iEFeibn1JCv+X/WAPOZt:5DgtEosn1xX/HPOD
MD5:	C8B550CD100E879BA995A6ECBD97C602
SHA1:	90184E1C4CAADB6744FB5F8A9B36889D6C8C8FC9
SHA-256:	F10AE7D7832DFC7C0367EB3DA536A5E4F46004C105FC839298ED68BC98B895AF
SHA-512:	9C092AE21266D22950C87ECE761B1F938C9ADBAEC7F5A0BFE7572A9CF84AC3E0E47519F12E09350A76B28D837F0C2044FABC28C3C4C86F546C7E240764A72559
Malicious:	false
Preview:	# <pre>.# @(#)southamerica.8.52.# This file is in the public domain, so clarified as of.# 2009-05-17 by Arthur David Olson...# This data is by no means authoritative; if you think you know better,.# go ahead and edit the file (and please send any changes to.# tz@elsie.nci.nih.gov for general use in the future)...# From Paul Eggert (2006-03-22):.# A good source for time zone historical data outside the U.S. is.# Thomas G. Shanks and Rique Pottenger, The International Atlas (6th edition),.# San Diego: ACS Publications, Inc. (2003)..#.# Gwillim Law writes that a good source.# for recent time zone data is the International Air Transport.# Association's Standard Schedules Information Manual (IATA SSIM),.# published semiannually. Law sent in several helpful summaries.# of the IATA's data after 1990..#.# Except where otherwise noted, Shanks & Pottenger is the source for.# entries through 1990, and IATA SSIM is the source for entries afterwards..#.# Earlier editions of these tables used the N

C:\Program Files (x86)\GeoSetter\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	InnoSetup Log GeoSetter, version 0x30, 12250 bytes, 305090\user, "C:\Program Files (x86)\GeoSetter"
Category:	dropped
Size (bytes):	12250
Entropy (8bit):	5.121558821049311
Encrypted:	false
SSDEEP:	192:2MH39zEUAXJrcVSQ1n7gFGkX97AlUWsE4AO3FRIDKaOCNEN30lJX:2MH3iXan7sGW97ANdkXIDKaOGEN30lV
MD5:	4C11FDAC3F9FED922460FE0F355FC0DB
SHA1:	F401811EEC16277351C6C4A60F07243969333470
SHA-256:	AB5E2FFA65F339E73C54FF6581B8F97270BB4849E30BE652B3B93C5CC91BEA18
SHA-512:	6585BED50F1AC2396E5777209397A3B976507A579779C38D13CA035D7752F7C8167DF02ECAB48FC51F43574CD2790F02521BB38601D13CF469B89BCEC7A9EB2A
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................GeoSetter.......................................................................................................................GeoSetter.......................................................................................................................0...x..../..%...............................................................................................................c.6N.........Bk.......A....305090.user C:\Program Files (x86)\GeoSetter.............,.... .....P......IFPS.............................................................................................................BOOLEAN..............TINPUTOPTIONWIZARDPAGE....TINPUTOPTIONWIZARDPAGE.................!MAIN....-1.....(.......INITIALIZEWIZARD....-1..CREATEINPUTOPTIONPAGE.............EXPANDCONSTANT........$...class:TINPUTOPTIONWIZARDPAGE\|ADD\|.....GETPREVIOUSDATA.........)...class:TINPUTOPTIONWIZARDPAGE\|VALUES@\|.................REGISTERPREVIOUSDATA....-

C:\Program Files (x86)\GeoSetter\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	725157
Entropy (8bit):	6.524824451329979
Encrypted:	false
SSDEEP:	12288:2sMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyRI:xMcMoi3rPR37dzHRA6G7WbuSEmK50syN
MD5:	42BBDA837847088254DD951A9A5F6303
SHA1:	AFD6CA3468E663C9506F8E817E73B7A9F1AD0427
SHA-256:	5C2C9DC3C3C3A3D7A3DFBB27262A9E971D34D346071BF93DBA26BE26AE3F91C3
SHA-512:	9BE157DAFE4C48F09FC9DB8A904EB1078D1562165B09B6EAEB9DED4A6E663DC193CD020CE7B669A70FEFAFBD4B787C60DBE907E663677FE3C1F885B92D6CFC6F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&...........................................................0......................................................CODE............................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..P....@......................@..P.rsrc...............................@..P.....................r..............@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoSetter\GeoSetter.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 31 20:22:44 2024, mtime=Thu Oct 31 20:22:44 2024, atime=Wed Oct 30 01:47:06 2019, length=11988480, window=hide
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	4.608355113968814
Encrypted:	false
SSDEEP:	24:8mLp+/EO+dOEk1vuwsHWDuw+UA5iKdReuwnuwfdReuwYUUPex0xFqygm:8m9hfdOTAwsHVw+j5iKdHwuwfdHwtByg
MD5:	AE561513D4C869B250A315DABAF3C9A5
SHA1:	73F0C6998544F639EBF737A9C07727A95F000BFB
SHA-256:	2723AC4E0BA4130317FE8DBE2D60D4F423A5FF25B3E746228DC90C69512AB3ED
SHA-512:	581C7EDB61298C83912EB72BE6886A68D76BE28AD379E084A687CDEDEF1C22F079B2F884D2BC40724769A0C7B794B3BCF06BF19A9DC1B9F878EC205F8E720F52
Malicious:	false
Preview:	L..................F.... ....}l..+...z...+.....P...............................P.O. .:i.....+00.../C:\.....................1....._Y...PROGRA~2.........O.I_Y.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1....._Y...GEOSET~1..D......_Y._Y...............................G.e.o.S.e.t.t.e.r.....h.2....^O.. .GEOSET~1.EXE..L......_Y._Y...............................G.e.o.S.e.t.t.e.r...e.x.e.......]...............-.......\...........N.lQ.....C:\Program Files (x86)\GeoSetter\GeoSetter.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.e.o.S.e.t.t.e.r.\.G.e.o.S.e.t.t.e.r...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.e.o.S.e.t.t.e.r.........*................@Z\|...K.J.........`.......X.......305090...........hT..CrF.f4... .0.2=.b...,...W..hT..CrF.f4... .0.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\leaflet[1].js

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with very long lines (65383)
Category:	dropped
Size (bytes):	146715
Entropy (8bit):	5.179938589303319
Encrypted:	false
SSDEEP:	1536:pd8s/7u3iwkCNP/yaKuLBlRBxbP4B5Sc8wOjrb0KZk/kb03Maxpk9UHP8Ln9TJ:v/7uTjyaKSfZPXTuTpkrJ
MD5:	F8B1586D921C9B7D9171D7ED17E62E3D
SHA1:	6F92A294F3ED864530977F810FD58FE5D247C140
SHA-256:	5819285CEC137B229C94E1EE5AD73E8B6B84345A4367D60F75FE477FE0FB7B03
SHA-512:	0EA9B7875638AA21D48DB8714EE04642CCDAD137E9A67E7748796EFEE8F57FE453FB17D285F7BBAFA73345FE6BD8D9A594ED9A2B1FAD609828C5BA0E927D5272
Malicious:	false
Preview:	/* @preserve. * Leaflet 1.9.3, a JS library for interactive maps. https://leafletjs.com. * (c) 2010-2022 Vladimir Agafonkin, (c) 2010-2011 CloudMade. */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?define(["exports"],e):e((t="undefined"!=typeof globalThis?globalThis:t\|\|self).leaflet={})}(this,function(t){"use strict";function l(t){for(var e,i,n=1,o=arguments.length;n<o;n++)for(e in i=arguments[n])t[e]=i[e];return t}var R=Object.create\|\|function(t){return N.prototype=t,new N};function N(){}function a(t,e){var i,n=Array.prototype.slice;return t.bind?t.bind.apply(t,n.call(arguments,1)):(i=n.call(arguments,2),function(){return t.apply(e,i.length?i.concat(n.call(arguments)):arguments)})}var D=0;function h(t){return"_leaflet_id"in t\|\|(t._leaflet_id=++D),t._leaflet_id}function j(t,e,i){var n,o,s=function(){n=!1,o&&(r.apply(i,o),o=!1)},r=function(){n?o=arguments:(t.apply(i,arguments),setTimeout(s,e),n=!0)};return r}functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json3[1].js

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40066
Entropy (8bit):	4.45077744139255
Encrypted:	false
SSDEEP:	384:9T1JuDG1hAPtlUz+pDkTFMcM/PJHsL5j0BWpgDg4Ps61l3RJSOU/9mh3rTtQXqxY:9ze1mIPyj0QpIjamhFHy91n
MD5:	77F904F8070E82071D5F5440B10379A1
SHA1:	16AD1563C98686105B9ED2EB9B4C27E5D0562A60
SHA-256:	D6762C1124856780D9D1B41231A3443D3F713B8CAC7026B3D00EC90BCB9F19E1
SHA-512:	1A1672B80D6B452DEBF5DAD1D00B091AE7321E19BDDC08122623DEC9DC316A997D02D3F8FB9B8F4C24006052A78FF735CE5975929824FDAF6F0F611B44E4589E
Malicious:	false
Preview:	/! JSON v3.2.6 \| http://bestiejs.github.io/json3 \| Copyright 2012-2013, Kit Cambridge \| http://kit.mit-license.org /.;(function (window) {. // Convenience aliases.. var getClass = {}.toString, isProperty, forEach, undef;.. // Detect the `define` function exposed by asynchronous module loaders. The. // strict `define` check is necessary for compatibility with `r.js`.. var isLoader = typeof define === "function" && define.amd;.. // Detect native implementations.. var nativeJSON = typeof JSON == "object" && JSON;.. // Set up the JSON 3 namespace, preferring the CommonJS `exports` object if. // available.. var JSON3 = typeof exports == "object" && exports && !exports.nodeType && exports;.. if (JSON3 && nativeJSON) {. // Explicitly delegate to the native `stringify` and `parse`. // implementations in CommonJS environments.. JSON3.stringify = nativeJSON.stringify;. JSON3.parse = nativeJSON.parse;. } else {. // Export for web browsers, JavaScript engines, and asyn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\leaflet[1].css

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14001
Entropy (8bit):	4.9957450862009605
Encrypted:	false
SSDEEP:	192:Lr2NJ5xZqXx5X02xvhVpHdAjT2rg39tD3uU96GhcAeeeOYMAMrHni:LyNJYE2vpmTv39teGhBeeeMi
MD5:	2AC05A881C68DBCED0C42A71FEE64FF4
SHA1:	C6597CDF63661BF552022A17E30EED72D9238E7F
SHA-256:	4A63465AEB2A2FFAAE2A6D9DE78241DC2CF0E78BCEDFC36F2C718C3489AC38B3
SHA-512:	0EFE91F6FA90BF34CC15535C0E90C21DA9768E9BF1A6B96B9F4715232CF8F71FAA4664EE6B989693C9EB7A884778D000AAE995BEFA60D1F8F3FB79D9790C1D9F
Malicious:	false
Preview:	/* required styles /...leaflet-pane,..leaflet-tile,..leaflet-marker-icon,..leaflet-marker-shadow,..leaflet-tile-container,..leaflet-pane > svg,..leaflet-pane > canvas,..leaflet-zoom-box,..leaflet-image-layer,..leaflet-layer {..position: absolute;..left: 0;..top: 0;..}..leaflet-container {..overflow: hidden;..}..leaflet-tile,..leaflet-marker-icon,..leaflet-marker-shadow {..-webkit-user-select: none;.. -moz-user-select: none;.. user-select: none;.. -webkit-user-drag: none;..}./ Prevents IE11 from highlighting tiles in blue /..leaflet-tile::selection {..background: transparent;.}./ Safari renders non-retina tile on retina better with this, but Chrome is worse /..leaflet-safari .leaflet-tile {..image-rendering: -webkit-optimize-contrast;..}./ hack that prevents hw layers "stretching" when loading new tiles */..leaflet-safari .leaflet-tile-container {..width: 1600px;..height: 1600px;..-webkit-transform-origin: 0 0;..}..leaflet-marker-icon,..leaflet-marker-shadow {..display:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\crosshair[1].gif

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.827283322474655
Encrypted:	false
SSDEEP:	3:CsXPQEsJctm27s/fpAin:NfQEsJcs27s/Rn
MD5:	07D30045544893C6FDBF5E5F23DB100C
SHA1:	DE0F6D67E9C33E963D33D612202361DF61D40321
SHA-256:	4E0595FD18E563310C4CA5490B210FA91567AC9F3E8BB6A94D6362628A9363E6
SHA-512:	6A3D5580E96B2B1EADA4BF684A83E1B4F3973EB24240FE1E4D4431FA3A40CDD0C737FACFAD526FF4A35B99C72758FBD40AC8624187520DBAB680E81EB0742017
Malicious:	false
Preview:	GIF89a.............!.......,.......... ......n....:W...H...q..........;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\map_google[1].htm

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	40487
Entropy (8bit):	5.312336167629293
Encrypted:	false
SSDEEP:	768:KkJ94bBBqH/YoU/JNuW8tfiWoJWPzq7X5oZ6c6zxyANeUyejPK1liIAtKcp4cyxD:Kj8dhejfuYh/vq
MD5:	07BEA47077010D173EACE817D7D4235D
SHA1:	AB8D2C58350800072EB18BE854CA920357F6ED26
SHA-256:	E0CEF019B275BEC49C50655AE6C8520E511CBCD3D41C591541F815FC4ECB129E
SHA-512:	23B0181874923A09275C3C035298685E88E5FB140884A9CA9F3E4DF693AFC684EC3C070D02CCBB171FFE56D7B2768F059C8A58ABED856D61779EB6EDD74B14FC
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="https://www.w3.org/1999/xhtml">.<head>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="expires" content="604800">..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<link rel="stylesheet" href="./leaflet/leaflet.css" integrity="sha256-kLaT2GOSpHechhsozzB+flnD+zUyjE2LlfWPgU04xyI="...crossorigin="" />.. Make sure you put this AFTER Leaflet's CSS -->..<script src="./leaflet/leaflet.js" integrity="sha256-WBkoXOwTeyKclOHuWtc+i2uENFpDZ9YPdf5Hf+D7ewM="...crossorigin=""></script>..<script src="json3.js"></script>..<script>...var map = null;...var geosetterVersion = null;...var mapWidth = null;...var mapHeight = null;....function showNotAvailableAtTheMoment() {....alert("Diese Funktion steht momentan noch nicht wieder zur Verf.gung. Ich arbeite dran...\n\nThis function is not yet available again. I am working on it...");.

C:\Users\user\AppData\Local\Temp\GeoSetter.log

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	115
Entropy (8bit):	5.122427146981225
Encrypted:	false
SSDEEP:	3:L/AWEIU9uFTXT/5SWEIhj3UXI:DioTjhtU4
MD5:	4A365EB9EBEE1861E38F19543346AFB2
SHA1:	2D38EFAC8A0E005E4CD79894D282CE3339E7F4E8
SHA-256:	8A9E5E2299DFF0288D16AF5C1C3EB4F8016C8043337B2CC73121C666E9E8AE99
SHA-512:	5B88ED66070F1664BF445E9EF0CF0CB10A5D373FBAA7A78F5A321C17349EFBE0AAC48FBF3A119F8F5814F5193CD2CE52572E2C939688F62D82E780E143BEFDB9
Malicious:	false
Preview:	17:24:19.134 [ERROR] TExifToolVersionInfo.Create("", 0, , ")..17:24:19.134 [ERROR] HTTP/1.1 301 Moved Permanently..

C:\Users\user\AppData\Local\Temp\is-BDALQ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp

Download File

Process:	C:\Users\user\Desktop\geosetter_setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713728
Entropy (8bit):	6.516598351135674
Encrypted:	false
SSDEEP:	12288:usMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyR:JMcMoi3rPR37dzHRA6G7WbuSEmK50syQ
MD5:	832DAB307E54AA08F4B6CDD9B9720361
SHA1:	EBD007FB7482040ECF34339E4BF917209C1018DF
SHA-256:	CC783A04CCBCA4EDD06564F8EC88FE5A15F1E3BB26CEC7DE5E090313520D98F3
SHA-512:	358D43522FD460EB1511708E4DF22EA454A95E5BC3C4841931027B5FA3FB1DDA05D496D8AD0A8B9279B99E6BE74220FE243DB8F08EF49845E9FB35C350EF4B49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@...............................&...........................................................0......................................................CODE............................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..P....@......................@..P.rsrc...............................@..P.....................r..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\045009c7.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	5.109232464002906
Encrypted:	false
SSDEEP:	24:TNKKQUAwXd/pM8ZQoW98JMY6W/UZ93XBAXPU5Am45sZ3XwN3XwY4:4KQUAwXd/pMaQoWKJMrWcZRXBAXPBytX
MD5:	03984E63BE462C3EE97BFB1917357016
SHA1:	1D83BD0A10E53384CBB1A29DDF7B771A0D644A61
SHA-256:	844D2B716100DCABD2C03E19BFB02F78FA325F333DCEAFD5889C851B17107D5B
SHA-512:	B47642C77236E71D9B58C6DE391C2D53E5902BC32A92C4C212F3CFA1BDB938A02C98A9CDD68E3196AC8B12C6EA94D823DA9FD65D2799074840712671C0C3BDFA
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/vars.pm".package vars;..use 5.006;..our $VERSION = '1.03';..use warnings::register;.use strict qw(vars subs);..sub import {. my $callpack = caller;. my (undef, @imports) = @_;. my ($sym, $ch);. foreach (@imports) {. if (($ch, $sym) = /^([\$\@\%\\&])(.+)/) {.. if ($sym =~ /\W/) {...# time for a more-detailed check-up...if ($sym =~ /^\w+[[{].[]}]$/) {... require Carp;... Carp::croak("Can't declare individual elements of hash or array");...} elsif (warnings::enabled() and length($sym) == 1 and $sym !~ tr/a-zA-Z//) {... warnings::warn("No need to declare built-in vars");...} elsif (($^H &= strict::bits('vars'))) {... require Carp;... Carp::croak("'$_' is not a valid variable name under strict vars");...}.. }.. $sym = "${callpack}::$sym" unless $sym =~ /::/;.. $sym =...( $ch eq "\$" ? \$$sym... : $ch eq "\@" ? \@$sym... : $ch eq "\%" ? \%$sym... : $ch eq "\" ? \*$sym... : $ch eq "\&" ? \&$sym ... : do {... require

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\04d2846b.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1882
Entropy (8bit):	5.188281597792163
Encrypted:	false
SSDEEP:	48:pdwWk4OOYvTTSZVfUIACUlQy1XKslKsIhsjNOTaRatCtv:pdwW5uTSnFfz+XVlVr50E
MD5:	A9A97B7BD733E2AC4E1F8A56FFE0CA3D
SHA1:	64EB26736EA4D5CB1E3D6093C956592BD1D6A587
SHA-256:	A0275E0DB8328B350EF77D74B4335EC6B1B37F5C514D3B5E02050BBE4EE32499
SHA-512:	BBB3C53A227C152D8C0D071737206386CEAA3013DB241B385E1E1D1F7C7583098A20207459630BE29B3681DD9908E9BBFFD44F56733D3B0641848E0129F5C813
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Glob.pm".package File::Glob;..use strict;.our($VERSION, @ISA, @EXPORT_OK, @EXPORT_FAIL, %EXPORT_TAGS, $DEFAULT_FLAGS);..require XSLoader;..@ISA = qw(Exporter);..# NOTE: The glob() export is only here for compatibility with 5.6.0..# csh_glob() should not be used directly, unless you know what you're doing...%EXPORT_TAGS = (. 'glob' => [ qw(. GLOB_ABEND..GLOB_ALPHASORT. GLOB_ALTDIRFUNC. GLOB_BRACE. GLOB_CSH. GLOB_ERR. GLOB_ERROR. GLOB_LIMIT. GLOB_MARK. GLOB_NOCASE. GLOB_NOCHECK. GLOB_NOMAGIC. GLOB_NOSORT. GLOB_NOSPACE. GLOB_QUOTE. GLOB_TILDE. bsd_glob. glob. ) ],.);.$EXPORT_TAGS{bsd_glob} = [@{$EXPORT_TAGS{glob}}];.pop @{$EXPORT_TAGS{bsd_glob}}; # no "glob"..@EXPORT_OK = (@{$EXPORT_TAGS{'glob'}}, 'csh_glob');..$VERSION = '1.26';..sub import {. require Exporter;. local $Exporter::ExportLevel = $Exporter::ExportLevel + 1;. Exporte

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\0afcf8e6.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8283
Entropy (8bit):	5.147603196792433
Encrypted:	false
SSDEEP:	192:dk/7ZFEMSeUZLpOe+VZpE40bM/s/y/Y/B/TqsagdasJn:d8ZxUNZCpib4YWkBTq4
MD5:	74FA4900C621759EF2F1EB511B30EDB1
SHA1:	245FD3831157E4515B9E17B3730C46AF27FA5379
SHA-256:	8B0E6C6404855D862EF90D19D58C148DA391D9594D64D195C0232C8239B590E4
SHA-512:	B2A038922EBF47866F79DA601A8BE05973D515EF100F8DE47AFD3D8AF46CF01AC7C4F95F6559F1552548D3A2A9B50EAC1AAE1A309E956488F07826D10D31CF30
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Handle.pm".package IO::Handle;..#line 262..use 5.006_001;.use strict;.our($VERSION, @EXPORT_OK, @ISA);.use Carp;.use Symbol;.use SelectSaver;.use IO ();.# Load the XS module..require Exporter;.@ISA = qw(Exporter);..$VERSION = "1.36";.$VERSION = eval $VERSION;..@EXPORT_OK = qw(. autoflush. output_field_separator. output_record_separator. input_record_separator. input_line_number. format_page_number. format_lines_per_page. format_lines_left. format_name. format_top_name. format_line_break_characters. format_formfeed. format_write.. print. printf. say. getline. getlines.. printflush. flush.. SEEK_SET. SEEK_CUR. SEEK_END. _IOFBF. _IOLBF. _IONBF.);..################################################.## Constructors, destructors..##..sub new {. my $class = ref($_[0]) \|\| $_[0] \|\| "IO::Handle";. if (@_ != 1) {..# Since perl will automatically require IO::File if needed, but..# also initial

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\0b174c5f.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.377107816646737
Encrypted:	false
SSDEEP:	384:R3U6HwD4L32QrEjysveWmcT8nJX3O4cdP8nP:R308WmcT8lV9n
MD5:	00056C438CC32A03F2D924119E3C40BE
SHA1:	0C034F4429EEBDED11F471A684E2B5A97ECC3613
SHA-256:	C665128E6271484B54B9870D64BB3B3C147646DD245F2FAB9911333BED178C6D
SHA-512:	72318C15327EE6278EF5D6D608769C1C0C596BB7EF4D5B6942C44929455C4694F0B798465F0BF4532533F151651A43CE6CDC87F7D1E726D49DC4B184B49FCDE1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W...........#.....(...B...... ........@.....d.................................B........ ......................p..................................................................................................4............................text....&.......(..................`.P`.data........@.......,..............@.0..rdata..\|....P......................@.`@.bss.........`........................`..edata.......p.......2..............@.0@.idata...............4..............@.0..CRT....,............>..............@.0..tls.... ............@..............@.0..reloc...............B..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\1178e293.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5781
Entropy (8bit):	5.19144383148323
Encrypted:	false
SSDEEP:	96:ZAZ+wXQPSdyGdrrzyXQdIEmt+BhEKiMCB9soCC3qqax6MVPZHxML/c5:SZDX4SdL+emsBhEKiNUqax63L/4
MD5:	E7ED72DA110769A0C05F36B816336387
SHA1:	9F9CF1C44AC4DC4893D616D8545895F1FE8884B8
SHA-256:	D5510E583106F2E47A380434802C379015E75574A6B1488EA3CECFF54014199B
SHA-512:	D7B4EB3441B68D3B3523E5C241F4F1932C8CF4FC1792C8961ED5FBB96E61B8218457D7C09742C1DEE788B7805273071252BBC522DE615690BF23B1C19E1C5DF1
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/constant.pm".package constant;.use 5.008;.use strict;.use warnings::register;..our $VERSION = '1.33';.our %declared;..#=======================================================================..# Some names are evil choices..my %keywords = map +($_, 1), qw{ BEGIN INIT CHECK END DESTROY AUTOLOAD };.$keywords{UNITCHECK}++ if $] > 5.009;..my %forced_into_main = map +($_, 1),. qw{ STDIN STDOUT STDERR ARGV ARGVOUT ENV INC SIG };..my %forbidden = (%keywords, %forced_into_main);..my $normal_constant_name = qr/^_?[^\W_0-9]\w\z/;.my $tolerable = qr/^[A-Za-z_]\w\z/;.my $boolean = qr/^[01]?\z/;..BEGIN {. # We'd like to do use constant _CAN_PCS => $] > 5.009002. # but that's a bit tricky before we load the constant module :-). # By doing this, we save several run time checks for every call. # to import.. my $const = $] > 5.009002;. my $downgrade = $] < 5.015004; # && $] >= 5.008. my $constarray = exists &_make_const;. if ($const) {..Internals::SvRE

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\11a6f85f.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5385
Entropy (8bit):	4.768921792452051
Encrypted:	false
SSDEEP:	96:7Q/YcNwfYYz29I/fcG0PA1KVIPNLSGbfGu4kHFgrHyiU9uqEnd/eSVxlq:7xgYz6I/f50I1K6OGbOuFsyiNqE5Vzlq
MD5:	1081348BD12E57A945DE8A8DA08DC272
SHA1:	04E7011B0FCAF36A73B0602172FC878F03BDF2FB
SHA-256:	3D23650D8843A58C708D2D97B856AA677496E7F18787EFBE376A1501185D83A5
SHA-512:	D8FAB794E885A2A37785FDFF60B43B85F2E741682C79D38BC4888F7145A5F7F9C219BEE2EC03C59EB34F679FA836B0E1A8F928BF4D3F9C2FD86B168FF6339455
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/base.pm".use 5.008;.package base;..use strict 'vars';.use vars qw($VERSION);.$VERSION = '2.23';.$VERSION =~ tr/_//d;..# constant.pm is slow.sub SUCCESS () { 1 }..sub PUBLIC () { 20 }.sub PRIVATE () { 21 }.sub INHERITED () { 22 }.sub PROTECTED () { 23 }...my $Fattr = \%fields::attr;..sub has_fields {. my($base) = shift;. my $fglob = ${"$base\::"}{FIELDS};. return( ($fglob && 'GLOB' eq ref($fglob) && $fglob{HASH}) ? 1 : 0 );.}..sub has_attr {. my($proto) = shift;. my($class) = ref $proto \|\| $proto;. return exists $Fattr->{$class};.}..sub get_attr {. $Fattr->{$_[0]} = [1] unless $Fattr->{$_[0]};. return $Fattr->{$_[0]};.}..if ($] < 5.009) {. get_fields = sub {. # Shut up a possible typo warning.. () = \%{$_[0].'::FIELDS'};. my $f = \%{$_[0].'::FIELDS'};.. # should be centralized in fields? perhaps. # fields::mk_FIELDS_be_OK. Peh. As long as %{ $package . '::FIELDS' }. # is used

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\16e95c68.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5547
Entropy (8bit):	4.976842472113415
Encrypted:	false
SSDEEP:	96:GnA9XEQ8taJmXjtHn3TKaEQUzaar9PGPLazs9qMzYfCei:IA9XEhaJIjtHn3/UuO9PGPGI9qMMfCei
MD5:	18181FDC1E1B8D5013B9D7A8596F9182
SHA1:	36FD829DBD788A6D52BAABB25EA04B03380D2C60
SHA-256:	474724769D3E0238B7E41F24D3A5F47E687EAF7D2C60E3CFD04BC2B3C1E03478
SHA-512:	A86FFA9C3DAC011872C02FA3CAB51461FE214FB4E34488A5E8D8C59C75BECF5DB3DABE644D4799CDB1156A7ED91536AE62DA08A63675F417AA04EF92AC2C3507
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Basename.pm"..#line 36...package File::Basename;..# File::Basename is used during the Perl build, when the re extension may.# not be available, but we only actually need it if running under tainting..BEGIN {. if (${^TAINT}) {. require re;. re->import('taint');. }.}...use strict;.use 5.006;.use warnings;.our(@ISA, @EXPORT, $VERSION, $Fileparse_fstype, $Fileparse_igncase);.require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(fileparse fileparse_set_fstype basename dirname);.$VERSION = "2.85";..fileparse_set_fstype($^O);...#line 102...sub fileparse {. my($fullname,@suffices) = @_;.. unless (defined $fullname) {. require Carp;. Carp::croak("fileparse(): need a valid pathname");. }.. my $orig_type = '';. my($type,$igncase) = ($Fileparse_fstype, $Fileparse_igncase);.. my($taint) = substr($fullname,0,0); # Is $fullname tainted?.. if ($type eq "VMS" and $fullname =~ m{/} ) {. # We're doing Unix emulation. $orig_type = $type;. $type =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\17d23068.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.124499262689635
Encrypted:	false
SSDEEP:	48:WnRQW5Nk5XsLQsdv5Km57Q5tGBk5+wdhWcEG5Qb6FBZBjHDkCc0JZZHp60bxp0Xw:WRQnXi5Km5k5j5+wlEG5E6FBTMCcw40j
MD5:	C5E041CA85C3220A127B1800DAC52B42
SHA1:	DE7FC21AB8083488D829C6A53870F2F9DB4D7F75
SHA-256:	F6EA00190AFC89445065D6C3D66D6B0C257C460294B2B743CEAFC2C89B2620AB
SHA-512:	0AAFD48DC71DA025B4C7CDD397207C8833CA7F5FF075A731C2DBA7A2169697D673FBE5CF3913A5C8A59B5EC7249A6A7E23D27CBBE19BFAF003D31F53E85BECED
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Exporter.pm".package Exporter;..require 5.006;..# Be lean..#use strict;.#no strict 'refs';..our $Debug = 0;.our $ExportLevel = 0;.our $Verbose \|\|= 0;.our $VERSION = '5.72';.our (%Cache);..sub as_heavy {. require Exporter::Heavy;. # Unfortunately, this does not work if the caller is aliased as name = \&foo. # Thus the need to create a lot of identical subroutines. my $c = (caller(1))[3];. $c =~ s/.:://;. \&{"Exporter::Heavy::heavy_$c"};.}..sub export {. goto &{as_heavy()};.}..sub import {. my $pkg = shift;. my $callpkg = caller($ExportLevel);.. if ($pkg eq "Exporter" and @_ and $_[0] eq "import") {. {$callpkg."::import"} = \&import;. return;. }.. # We need* to treat @{"$pkg\::EXPORT_FAIL"} since Carp uses it :-(. my $exports = \@{"$pkg\::EXPORT"};. # But, avoid creating things if they don't exist, which saves a couple of. # hundred bytes per package processed.. my $fail = ${$pkg . '::'}{EXPORT_FAIL} && \@{"$pkg\::EXPORT_FAIL"};. return exp

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\1ad88610.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	5.013993974058213
Encrypted:	false
SSDEEP:	24:TeCgqURKHmcFFBAa917VRBajB46TKauDwCTRgTdzCzR40akBBoN/0CBBoNa:yChUoHmK7d17Vna9XTewCT4dCz3oNV3f
MD5:	6AF8C14911F393BA434F81C470667EA7
SHA1:	1152765CA40F7D3F958FD0578E3BBC020F0A74AB
SHA-256:	D2B127DAAB17CE7A50C8E1F70E632F75ADEEB7AFCD0B6BF7D98D3F4044370ED8
SHA-512:	5A6CCC068AB1B8346A3E5E77CE5040AF31B0895D2B615CC207CA888FCC1BFAB19CFC67AF6F800E2E13C3A58B42488D39E0F32D4FDE7962022ED3708F74D420FF
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/SetupProgname.pm".package PAR::SetupProgname;.$PAR::SetupProgname::VERSION = '1.002';..use 5.006;.use strict;.use warnings;.use Config ();..#line 26..# for PAR internal use only!.our $Progname = $ENV{PAR_PROGNAME} \|\| $0;..# same code lives in PAR::Packer's par.pl!.sub set_progname {. require File::Spec;.. if (defined $ENV{PAR_PROGNAME} and $ENV{PAR_PROGNAME} =~ /(.+)/) {. $Progname = $1;. }. $Progname = $0 if not defined $Progname;.. if (( () = File::Spec->splitdir($Progname) ) > 1 or !$ENV{PAR_PROGNAME}) {. if (open my $fh, $Progname) {. return if -s $fh;. }. if (-s "$Progname$Config::Config{_exe}") {. $Progname .= $Config::Config{_exe};. return;. }. }.. foreach my $dir (split /\Q$Config::Config{path_sep}\E/, $ENV{PATH}) {. next if exists $ENV{PAR_TEMP} and $dir eq $ENV{PAR_TEMP};. my $name = File::Spec->catfile($dir, "$Progname$Config::Config{_exe}");.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\21cbf464.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.1500965487082
Encrypted:	false
SSDEEP:	12:TFupfIDVsQt2QpkQLeve/J//R/v/mbc/n/mq4AUrIN+UN/TwAoUoG6N/dSXpKOtJ:TsfKsQ39iW/J//t/m4/n/mqx+4+kT6Ns
MD5:	4158BFFF19BE4004C2F93A3A6EF21BD5
SHA1:	B3FE94927630C7D8AD5A6DA5B15247A3F7F5D059
SHA-256:	07FD8A1E48FBBE5CFA4B41E7772979B6D07AB7C37CED9B03775C862E155707D6
SHA-512:	6D75CBED2A796AFFF2EED603AE0E746BAB963D080661D5D6B5ADF1F260BD5DB23114C3778A7CBA1EF75B9E48F82E093F266F76637651AA167B3A1ECD323AE6D2
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Spec.pm".package File::Spec;..use strict;.use vars qw(@ISA $VERSION);..$VERSION = '3.63';.$VERSION =~ tr/_//d;..my %module = (MacOS => 'Mac',.. MSWin32 => 'Win32',.. os2 => 'OS2',.. VMS => 'VMS',.. epoc => 'Epoc',.. NetWare => 'Win32', # Yes, File::Spec::Win32 works on NetWare... symbian => 'Win32', # Yes, File::Spec::Win32 works on symbian... dos => 'OS2', # Yes, File::Spec::OS2 works on DJGPP... cygwin => 'Cygwin',.. amigaos => 'AmigaOS');...my $module = $module{$^O} \|\| 'Unix';..require "File/Spec/$module.pm";.@ISA = ("File::Spec::$module");..1;..__END__..#line 341.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\249772ec.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8115
Entropy (8bit):	4.519554475071996
Encrypted:	false
SSDEEP:	192:TKloMr/R5RtSUaq8xjpNHDKUFEK37Sp9AhRwEpFoXwHDCEKYZSpyJZHD6Fs4DknG:TKLWUevuZMu7+5/BXD8sj2efY
MD5:	322576AF7C6C03A7B1AE94FB57BBF487
SHA1:	65D2008D3DEA3787DE7776E78DD8F14559D9B84C
SHA-256:	1F098B2B76D157ED20D9F5F4BECAD01FDB2B9C1987628CDA388C40CDB34BEC2F
SHA-512:	2338645F924E61FE0E2BD42EED5AC14ED10DDD5871D65B67928CDD960F0C2683EBF32DA37C84CBE744F15AE3596A2CB4491B5DFFD91AE12433E9B019973F9F49
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/GlobMapper.pm".package File::GlobMapper;..use strict;.use warnings;.use Carp;..our ($CSH_GLOB);..BEGIN.{. if ($] < 5.006). { . require File::BSDGlob; import File::BSDGlob qw(:glob) ;. $CSH_GLOB = File::BSDGlob::GLOB_CSH() ;. globber = \&File::BSDGlob::csh_glob;. } . else. { . require File::Glob; import File::Glob qw(:glob) ;. $CSH_GLOB = File::Glob::GLOB_CSH() ;. #globber = \&File::Glob::bsd_glob;. globber = \&File::Glob::csh_glob;. } .}..our ($Error);..our ($VERSION, @EXPORT_OK);.$VERSION = '1.000';.@EXPORT_OK = qw( globmap );...our ($noPreBS, $metachars, $matchMetaRE, %mapping, %wildCount);.$noPreBS = '(?<!\\\)' ; # no preceding backslash.$metachars = '.?[](){}';.$matchMetaRE = '[' . quotemeta($metachars) . ']';..%mapping = (. '' => '([^/])',. '?' => '([^/])',. '.' => '\.',. '[' => '([',. '(' => '(',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\2559a606.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.680023654012153
Encrypted:	false
SSDEEP:	12:TFP+JvEIMlfMQCCQ4J4zE/liCZVusqolqL4YQe4kN/8lsqBTstwLFV:TR+JvEr5/rGCZosjU/qs8JUC
MD5:	E2E73EC90397B5FDE46B8E1BF60C4656
SHA1:	170B98C614859910EF0822CE981CD40C9702E55D
SHA-256:	D0F19EF015366A3C6DB9360F1AB9ADBDA28A91C0F5634484F8C29E00A7D42553
SHA-512:	0615CB35442B1E53DB85AD87FA282A394D85FBD3512268CFFCE9044ADB3A71DFA5BC1C7A37F4DA05D3554D536596968144D28C87D0F7A3686EF9677863FFE61A
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/parent.pm".package parent;.use strict;.use vars qw($VERSION);.$VERSION = '0.234';..sub import {. my $class = shift;.. my $inheritor = caller(0);.. if ( @_ and $_[0] eq '-norequire' ) {. shift @_;. } else {. for ( my @filename = @_ ) {. s{::\|'}{/}g;. require "$_.pm"; # dies if the file is not found. }. }.. {. no strict 'refs';. push @{"$inheritor\::ISA"}, @_;. };.};.."All your base are belong to us"..__END__....#line 120.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\25bbf886.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.934846636262196
Encrypted:	false
SSDEEP:	768:Tf6VlFS+8vQ5Ptw5IiBN+2MPv9yI7JkgJg:LMFqIVw5ly2PgJg
MD5:	F7DD47A068B7F3D5C64AD91B6A30E7C7
SHA1:	BEE60E09E8B17BCAA5A107CBE801C40543D13D3F
SHA-256:	7C6018DAEF31E150232CFB178F622213DCEE8482A581254BBB5846E3D7E6D82B
SHA-512:	3EF18B4040AF73452200EF39225980449B0B2629C999659650423C33531F79E7E1B2D3DDDFE165029F70D07C41CC4A61C037EEE7121A1B81D45CC08BD8F39C4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....>...f...... ........P.....b.......................................... .................................................................h....................................................................................text...D=.......>..................`.P`.data... ....P.......B..............@.0..rdata.......`.......D..............@.0@.bss.........p........................`..edata...............P..............@.0@.idata...............R..............@.0..CRT....,............`..............@.0..tls.... ............b..............@.0..reloc..h............d..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\29785c3a.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	30859
Entropy (8bit):	4.862088963279738
Encrypted:	false
SSDEEP:	768:SZe2g8LcTXLBKsauQ2CCpWql3irTKnEYyYjAcoN/MPKs2/CX0jsQr+rDSUfOzI/g:4ePrVPFuNjVr+7ad1P
MD5:	4D44F1B93B7C97857183FE69F8FDC499
SHA1:	7E309577889F88071F1296FB5F9870F6184C91A3
SHA-256:	482F03AD4E29BFC5279C0B5892F34A19E927796495CF528EA9F46FFD66883EB1
SHA-512:	E0CA528C36584790AD15E001CADB9342C701F420BC0B611453D8E814C8EADBF85ECC21D9D732B69AFA82AAE0B7C57AC4526D072D00D12B057D79D16EC94BCEBB
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/Archive.pm".package Archive::Zip::Archive;..# Represents a generic ZIP archive..use strict;.use File::Path;.use File::Find ();.use File::Spec ();.use File::Copy ();.use File::Basename;.use Cwd;..use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip );.. if ($^O eq 'MSWin32') {. require Win32;. require Encode;. Encode->import(qw{ encode_utf8 decode_utf8 });. }.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES. :PKZIP_CONSTANTS. :UTILITY_METHODS.);..our $UNICODE;..# Note that this returns undef on read errors, else new zip object...sub new {. my $class = shift;. my $self = bless(. {. 'diskNumber' => 0,. 'diskNumberWithStartOfCentralDirectory' => 0,. 'numberOfCentralDirectoriesOnThisDisk' =>. 0, # should be # of members. 'numberOfCentralDirectories' => 0, # should be # of members.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\29f8733b.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	725
Entropy (8bit):	5.2646102765737
Encrypted:	false
SSDEEP:	12:xKLEN25UyVMGHwqAGHmEoRtz+Fr3MkxWVVG78ItIDjSSFTWrL/Mwc6AODNan:wENkVMGH6CzUz+Fr8kIVYQIt4SShOg7n
MD5:	6FF0817DB4A5BB36FF6BE1E767CC1D3D
SHA1:	E48F527203B5372CAEC6D603A917288280119D78
SHA-256:	6783350D4336EDA13BDD54597CAB5D022B5572229D606B0C6E6616793DDB15E1
SHA-512:	DBEFDEC0E88A50A6311A1B4F20DB5FF66723BA97A40B7D28A6F5B16B9772C532366AC0DAC7983E76D65D382FB1642F71681A416D29A17E6D55EDE926E769DB72
Malicious:	false
Preview:	package main;.#line 1 "script/main.pl"..if (defined $ENV{PAR_APP_REUSE}) {. warn "Executable was created without the --reusable option. See 'perldoc pp'.\n";. exit(1);.}...my $zip = $PAR::LibCache{$ENV{PAR_PROGNAME}} \|\| Archive::Zip->new(__FILE__);.my $member = eval { $zip->memberNamed('script/exiftool') }. or die qq(main.pl: Can't open perl script "script/exiftool": No such file or directory ($zip));..# Remove everything but PAR hooks from @INC.my %keep = (. \&PAR::find_par => 1,. \&PAR::find_par_last => 1,.);.my $par_temp_dir = File::Spec->catdir( $ENV{PAR_TEMP} );.@INC =. grep {. exists($keep{$_}). or $_ =~ /^\Q$par_temp_dir\E/;. }. @INC;...PAR::_run_member($member, 1);..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\2acf1aa3.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6051
Entropy (8bit):	4.319092051831174
Encrypted:	false
SSDEEP:	96:NcQ9N/GIUpPfG5wbi1ciFLG5A0Q7Rt1ATgBCXBfV/b2nmltHRbaTvSc:SuFGE0Q7R/ATgBCXBxltxbauc
MD5:	A5FC3696840FF20E64F0182F3D29995B
SHA1:	D3FB5791C29805ECF8BFF1E3814D61346E03D541
SHA-256:	A466B23E062CED32735559A71D4EBCB76065D4179D762D04B23E0936CF7A67A0
SHA-512:	7FD9D7171B3E765223202942E801071C3C1FFEFA125FC6ADFFDEF2A8B09EE6AC278439DA3BFB522103BB999835667573428A9D759DAC31BD7670E51FD16D113E
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Encode/Config.pm".#.# Demand-load module list.#.package Encode::Config;.our $VERSION = do { my @r = ( q$Revision: 2.5 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };..use strict;.use warnings;..our %ExtModule = (.. # Encode::Byte. #iso-8859-1 is in Encode.pm itself. 'iso-8859-2' => 'Encode::Byte',. 'iso-8859-3' => 'Encode::Byte',. 'iso-8859-4' => 'Encode::Byte',. 'iso-8859-5' => 'Encode::Byte',. 'iso-8859-6' => 'Encode::Byte',. 'iso-8859-7' => 'Encode::Byte',. 'iso-8859-8' => 'Encode::Byte',. 'iso-8859-9' => 'Encode::Byte',. 'iso-8859-10' => 'Encode::Byte',. 'iso-8859-11' => 'Encode::Byte',. 'iso-8859-13' => 'Encode::Byte',. 'iso-8859-14' => 'Encode::Byte',. 'iso-8859-15' => 'Encode::Byte',. 'iso-8859-16' => 'Encode::Byte',. 'koi8-f' => 'Encode::Byte',

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\2b62678e.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with very long lines (316)
Category:	dropped
Size (bytes):	31085
Entropy (8bit):	4.929412905858634
Encrypted:	false
SSDEEP:	384:lDIT/YCm7hi1JzUC9a62K5j23x4fpzeuD4Mf9wr+JMsbfK9S+LeY4va4q4g+:lDoYCmVe79gb4fp8Mf9xJMsbfdYOg+
MD5:	D32CB793D6A1C4EFB88454FB3DFD374C
SHA1:	3BA5CA7A44FF7ABD7A89F739F03890288D717DD6
SHA-256:	E99817D763EF96CEE7F3A1B86899DD0FE7A6A5C22B75145162560358D2D74096
SHA-512:	6B3AB7545AD29DF33F3CA2099C7A11B28B7C24D0A55905128F36754838B22858D1BE14E4FA00FFBA9029AD1BA74D763F68E4BBFA561385D21143BF89792B8D23
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/Dist.pm".package PAR::Dist;.use 5.006;.use strict;.require Exporter;.use vars qw/$VERSION @ISA @EXPORT @EXPORT_OK $DEBUG/;..$VERSION = '0.49'; # Change version in POD, too!.@ISA = 'Exporter';.@EXPORT = qw/. blib_to_par. install_par. uninstall_par. sign_par. verify_par. merge_par. remove_man. get_meta. generate_blib_stub./;..@EXPORT_OK = qw/. parse_dist_name. contains_binaries./;..$DEBUG = 0;..use Carp qw/carp croak/;.use File::Spec;..#line 142..sub blib_to_par {. @_ = (path => @_) if @_ == 1;.. my %args = @_;. require Config;... # don't use 'my $foo ... if ...' it creates a static variable!. my $quiet = $args{quiet} \|\| 0;. my $dist;. my $path = $args{path};. $dist = File::Spec->rel2abs($args{dist}) if $args{dist};. my $name = $args{name};. my $version = $args{version};. my $suffix = $args{suffix} \|\| "$Config::Config{archname}-$Config::Config{version}.par";. my $cwd;.. if (defined

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\2d37d675.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7801
Entropy (8bit):	4.974791515276173
Encrypted:	false
SSDEEP:	192:xAaZ4IYIdsyxVxUxhxghFy2nWnKX+ha2SA4tW:xTP/STUFy8A9
MD5:	07804856D702BB673E3FC89F6A6443C1
SHA1:	24303250566E91DFBDC7014ADF274392A7D590A8
SHA-256:	3E0A17BE145DB0E6FB16C627E0ADC4A01F6CB512657DEC5D6584C348703A737D
SHA-512:	1D58A47D1A0895E089EFD4F22300AD627BA857F721D0C875D5AE2A30E68B17501A6C8CF19500D5D266C1A3B3A59A999315F65292B7F4766752EABE7BC4845A6B
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/Gzip.pm".package IO::Compress::Gzip ;..require 5.006 ;..use strict ;.use warnings;.use bytes;..require Exporter ;..use IO::Compress::RawDeflate 2.069 () ; .use IO::Compress::Adapter::Deflate 2.069 ;..use IO::Compress::Base::Common 2.069 qw(:Status );.use IO::Compress::Gzip::Constants 2.069 ;.use IO::Compress::Zlib::Extra 2.069 ;..BEGIN.{. if (defined &utf8::downgrade ) . { noUTF8 = \&utf8::downgrade }. else. { noUTF8 = sub {} } .}..our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $GzipError);..$VERSION = '2.069';.$GzipError = '' ;..@ISA = qw(Exporter IO::Compress::RawDeflate);.@EXPORT_OK = qw( $GzipError gzip ) ;.%EXPORT_TAGS = %IO::Compress::RawDeflate::DEFLATE_CONSTANTS ;..push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');..sub new.{. my $class = shift ;.. my $obj = IO::Compress::Base::Common::createSelfTiedObject($class, \$GzipError);.. $obj->_create(undef, @_);.}...sub gzip.{.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\2de0fc63.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	449
Entropy (8bit):	4.884600636103279
Encrypted:	false
SSDEEP:	12:TFYMsQUug0Bb2DC4ds5g5LCJP/JwXCBlBXPQ:TG7QUuIO6b5CP/J+Cd/Q
MD5:	413D0592917E8BA08E19B3FB04088EB2
SHA1:	478708F66B9BA094461DA7F1E4CD38B595F364E1
SHA-256:	954BF0E960C80C54BB112F3F421B4C472C22833DB92C476CE5A5F5536E4016E9
SHA-512:	6A5EB7698405206A898518F7EC87647DB863E2776F4C29E7EAAE9EC8DA7360D02C588E713309F8F8A0D71D1608DC153F52A6D1B754DB346B2753528F2120FFE0
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/PerlIO.pm".package PerlIO;..our $VERSION = '1.09';..# Map layer name to package that defines it.our %alias;..sub import.{. my $class = shift;. while (@_). {. my $layer = shift;. if (exists $alias{$layer}). {. $layer = $alias{$layer}. }. else. {. $layer = "${class}::$layer";. }. eval { require $layer =~ s{::}{/}gr . '.pm' };. warn $@ if $@;. }.}..sub F_UTF8 () { 0x8000 }..1;.__END__..#line 332.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\30e95417.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	5.863286063204077
Encrypted:	false
SSDEEP:	768:leTbtKSMdL07u3Ds156NLqow9UEX5xfEowY3Tzg0EfsgsD9LwBySkf9BbmStUHj1:lnn/4tJPs0EflsDsYmj1
MD5:	E640F383458838B613CC082ABE34AC76
SHA1:	A846C0486093BF3A976F6CE0267EF11D2AB437A1
SHA-256:	8E4F9505CAA50DB78056393C2E2B7655AFF2CF22FC1DE68D59796D23E6AC87CA
SHA-512:	652EF489CC08515A16FF43B5441AE93A5ADEDAE4FB38E568DD1DB548FB25491A7CF09EE9EDF471FF908CC6721199719BBA24AA5AEE9C0D27F5B9380A49E6E9C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#........."...... .............`e.......................................... ......................@.......P..T............................................................p.......................Q...............................text...............................`.P`.data...............................@.0..rdata..\|.... ......................@.0@.bss.........0........................`..edata.......@......................@.0@.idata..T....P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\3165f85e.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1648
Entropy (8bit):	4.771674230675402
Encrypted:	false
SSDEEP:	48:uLaQWwRqEoaqhRVsNRGFnZObG8iVyHneArJqU0:uLaQWk8aIOcFZOK8iYHT1k
MD5:	8E60F0E521CD93DC4BCD536111D6EBEF
SHA1:	0AC48BEFBA2C5E629FC7FD22ECD1F88748E5C5E1
SHA-256:	57E212B12D516AEBAD05E791C9318CB5817C32231CDA7988910F0E2C3693B7A2
SHA-512:	A94F2633FCBB865C0BCE25296FB55651A04347FEB24470BC62912D980870D9B3652950EE2BD1935D9DBC136798AB259ACEFC98B575AA0921121833E596EF966A
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/strict.pm".package strict;..$strict::VERSION = "1.11";..my ( %bitmask, %explicit_bitmask );..BEGIN {. # Verify that we're called correctly so that strictures will work.. # Can't use Carp, since Carp uses us!. # see also warnings.pm.. die sprintf "Incorrect use of pragma '%s' at %s line %d.\n", __PACKAGE__, +(caller)[1,2]. if __FILE__ !~ ( '(?x) \b '.__PACKAGE__.' \.pmc? \z' ). && __FILE__ =~ ( '(?x) \b (?i:'.__PACKAGE__.') \.pmc? \z' );.. %bitmask = (. refs => 0x00000002,. subs => 0x00000200,. vars => 0x00000400,. );.. %explicit_bitmask = (. refs => 0x00000020,. subs => 0x00000040,. vars => 0x00000080,. );.. my $bits = 0;. $bits \|= $_ for values %bitmask;.. my $inline_all_bits = $bits;. all_bits = sub () { $inline_all_bits };.. $bits = 0;. $bits \|= $_ for values %explicit_bitmask;.. my $inline_all_explicit_bits = $bits;. all_explicit_bits = sub () { $inlin

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\349957b9.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	809
Entropy (8bit):	5.138297346442176
Encrypted:	false
SSDEEP:	24:TlWUWPaNPCQU1cn9o1PKv0Uy0Ev0R0FW3QxJV9/GJlkU5LrzMGiOjLcuo/K:EnGPCQU1c9o1PKsiEsRmaQx7r0fzXi9U
MD5:	089971C080D38FF3A2E14F1F2A2D1C33
SHA1:	06AFB981F9D392857213FF3F5E58A584BC3C7161
SHA-256:	BD51792E348BA19142700D4FC6A04E8CE7A74240C51A8A45291A3DFDC6CB0A8F
SHA-512:	F529A670C3EED0E94BA294441BC8CC41C7F066047C913D10941D458CB8213E7FF0044D48F9698A1161B8219E89A8209A68C6047768B6ABD3D420E6DFD1756B0E
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Carp/Heavy.pm".package Carp::Heavy;..use Carp ();..our $VERSION = '1.40';.$VERSION =~ tr/_//d;..# Carp::Heavy was merged into Carp in version 1.12. Any mismatched versions.# after this point are not significant and can be ignored..if(($Carp::VERSION \|\| 0) < 1.12) {..my $cv = defined($Carp::VERSION) ? $Carp::VERSION : "undef";..die "Version mismatch between Carp $cv ($INC{q(Carp.pm)}) and Carp::Heavy $VERSION ($INC{q(Carp/Heavy.pm)}). Did you alter \@INC after Carp was loaded?\n";.}..1;..# Most of the machinery of Carp used to be here..# It has been moved in Carp.pm now, but this placeholder remains for.# the benefit of modules that like to preload Carp::Heavy directly..# This must load Carp, because some modules rely on the historical.# behaviour of Carp::Heavy loading Carp..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\377a5d44.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	5.222913493350141
Encrypted:	false
SSDEEP:	24:TTLf8DM0GSALEzJ+k5MXV1UeQ3fLQSulMQ8QOBRZBWOfxWg2MHgPxW1q2MHpAK6n:fLkDFq4J+k5MbTQ3DQSu98QkRZEOfxbh
MD5:	76F698FA03E8296FDDFC71176338CA03
SHA1:	954817633CA556F12C3FD41C749643D10A09D3F5
SHA-256:	A2B2E0EC487CF7218243F54E51306E232B88707BE33B860EF0CD26C197905937
SHA-512:	915316681AA8C3C83AD10CC7F793FD36B0CB36FB35A5CC82A98907A47113E85F5118F3E84937B67A63B8D9C8EF1606757438420401F3C8521B81D396601399E4
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Scalar/Util.pm".# Copyright (c) 1997-2007 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself..#.# Maintained since 2013 by Paul Evans <leonerd@leonerd.org.uk>..package Scalar::Util;..use strict;.use warnings;.require Exporter;..our @ISA = qw(Exporter);.our @EXPORT_OK = qw(. blessed refaddr reftype weaken unweaken isweak.. dualvar isdual isvstring looks_like_number openhandle readonly set_prototype. tainted.);.our $VERSION = "1.45";.$VERSION = eval $VERSION;..require List::Util; # List::Util loads the XS.List::Util->VERSION( $VERSION ); # Ensure we got the right XS version (RT#100863)..our @EXPORT_FAIL;..unless (defined &weaken) {. push @EXPORT_FAIL, qw(weaken);.}.unless (defined &isweak) {. push @EXPORT_FAIL, qw(isweak isvstring);.}.unless (defined &isvstring) {. push @EXPORT_FAIL, qw(isvstring);.}..sub export_fail {. if (grep { /^(?:we

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\3957efc2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5759
Entropy (8bit):	4.565565681657226
Encrypted:	false
SSDEEP:	96:2M+8oFAGQIaTt+P6XMPTjZmzTTKYyD24xDwJHfX2wGrxUvdvd/Mj:doFAGQIaTt+SXMPTjZmzNL4x0pjkqvdY
MD5:	2766B3CD524CECB25302A44F663355B7
SHA1:	A0E197FC702356EEC88B6E17A55944FFB5344BA9
SHA-256:	3FDBA88A89246427AC67BEB78FB721D6800346B0B20C1BDFC5E15CE1DB420C23
SHA-512:	570B1A495245F49C4577D698162D0B66C84B18E213B34E7DE082069EEE1C94A7FB912A646180F89E396186AC7C2C083DA246594FAF607FBA970698285217807C
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/Zlib/Extra.pm".package IO::Compress::Zlib::Extra;..require 5.006 ;..use strict ;.use warnings;.use bytes;..our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS);..$VERSION = '2.069';..use IO::Compress::Gzip::Constants 2.069 ;..sub ExtraFieldError.{. return $_[0];. return "Error with ExtraField Parameter: $_[0]" ;.}..sub validateExtraFieldPair.{. my $pair = shift ;. my $strict = shift;. my $gzipMode = shift ;.. return ExtraFieldError("Not an array ref"). unless ref $pair && ref $pair eq 'ARRAY';.. return ExtraFieldError("SubField must have two parts"). unless @$pair == 2 ;.. return ExtraFieldError("SubField ID is a reference"). if ref $pair->[0] ;.. return ExtraFieldError("SubField Data is a reference"). if ref $pair->[1] ;.. # ID is exactly two chars . return ExtraFieldError("SubField ID not two chars long"). unless length $pair->[0] == GZIP_FEXTRA_SUBFIELD_ID_SIZE ;.. # Check that the 2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\3adf7875.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	5.223747346184223
Encrypted:	false
SSDEEP:	24:T5rm8HcCaKGErRfm0VZLPG9sCKef7rXgl7tIdFO6BHbgBr83eGreCO5THUaJ/Wii:1meom7V5GrHQbIdFOo7gXFHUawi5bU3j
MD5:	2A30E99AE9A12796D63FA71892C06EB5
SHA1:	F112587128E1F4433E5C9D588C36BC91A29DD415
SHA-256:	51E53F45EC4F339600FA95D2CECA97FED7E744E35E58AC750DA662BD5D558300
SHA-512:	3780F238390AC44A849A2E38AE857164D595251784EC54A2ECF9771C25433CAC781B83D49A5816AA024B1EC3593AFCB34D70961161BC1002CB66B77835E53523
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/File.pm".#..package IO::File;..#line 126..use 5.006_001;.use strict;.our($VERSION, @EXPORT, @EXPORT_OK, @ISA);.use Carp;.use Symbol;.use SelectSaver;.use IO::Seekable;..require Exporter;..@ISA = qw(IO::Handle IO::Seekable Exporter);..$VERSION = "1.16";..@EXPORT = @IO::Seekable::EXPORT;..eval {. # Make all Fcntl O_XXX constants available for importing. require Fcntl;. my @O = grep /^O_/, @Fcntl::EXPORT;. Fcntl->import(@O); # first we import what we want to export. push(@EXPORT, @O);.};..################################################.## Constructor.##..sub new {. my $type = shift;. my $class = ref($type) \|\| $type \|\| "IO::File";. @_ >= 0 && @_ <= 3..or croak "usage: $class->new([FILENAME [,MODE [,PERMS]]])";. my $fh = $class->SUPER::new();. if (@_) {..$fh->open(@_).. or return undef;. }. $fh;.}..################################################.## Open.##..sub open {. @_ >= 2 && @_ <= 4 or croak 'usage: $fh->open(FILENAME

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\3b049f92.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	18482
Entropy (8bit):	5.123898532862219
Encrypted:	false
SSDEEP:	384:HIG88xXYCsaIiawNM0BQbh2DVmiVhOiIk7miTPRldpXF9hHj8:HIG88X1a1fiSiIkqiTPRldpXrhHw
MD5:	6578D0EA1FD8363C60D6D78FCEC040A8
SHA1:	97EFDFD375C0912CDE1BC379FD8B17F83E22C3A9
SHA-256:	11AA21EDC22B663F771900915D04C7E6B220E7AB4F454E300742C1E48CE61659
SHA-512:	F88D142B346228183816422C7C19B361F13251588F3F66437CBC08DFCE502C5B8FA8D9706C0410B9B53DE1C06AB444860ABBB90B3BA279B264AFC8A3982D33C9
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Cwd.pm".package Cwd;.use strict;.use Exporter;.use vars qw(@ISA @EXPORT @EXPORT_OK $VERSION);..$VERSION = '3.63';.my $xs_version = $VERSION;.$VERSION =~ tr/_//d;..@ISA = qw/ Exporter /;.@EXPORT = qw(cwd getcwd fastcwd fastgetcwd);.push @EXPORT, qw(getdcwd) if $^O eq 'MSWin32';.@EXPORT_OK = qw(chdir abs_path fast_abs_path realpath fast_realpath);..# sys_cwd may keep the builtin command..# All the functionality of this module may provided by builtins,.# there is no sense to process the rest of the file..# The best choice may be to have this in BEGIN, but how to return from BEGIN?..if ($^O eq 'os2') {. local $^W = 0;.. cwd = defined &sys_cwd ? \&sys_cwd : \&_os2_cwd;. getcwd = \&cwd;. fastgetcwd = \&cwd;. fastcwd = \&cwd;.. fast_abs_path = \&sys_abspath if defined &sys_abspath;. abs_path = \&fast_abs_path;. realpath = \&fast_abs_path;. fast_realpath = \&fast_

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\3b9419e9.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with very long lines (1843), with CRLF line terminators
Category:	dropped
Size (bytes):	39040
Entropy (8bit):	5.283260729412827
Encrypted:	false
SSDEEP:	768:FkDmO+qYRH5qru6XMCcCgKlLAJkG12wBBo0fe:apYRHMM/Sk1c
MD5:	1FD71BE7C8835DC9E4901BD1DA0015E8
SHA1:	CF1E9A760AE7DB002CF180FAF1FE770127D2CEB4
SHA-256:	3DAFD9F149AC3D8AAD7497E0E116C30D43565447434AEDB64A65195A66392F8D
SHA-512:	82593B96BEDD511539B7A8327EF5EF1AE2119CCA7EC936B080640BBC95EFA4702D93F508D39C71090B2EFC1FD212E06A73B73D6D7C4A468CE4392B6B62788151
Malicious:	false
Preview:	# This file was created by configpm when Perl was built. Any changes..# made to this file will be lost the next time perl is built.....package Config;..use strict;..use warnings;..use vars '%Config';....sub bincompat_options {.. return split ' ', (Internals::V())[0];..}....sub non_bincompat_options {.. return split ' ', (Internals::V())[1];..}....sub compile_date {.. return (Internals::V())[2]..}....sub local_patches {.. my (undef, undef, undef, @patches) = Internals::V();.. return @patches;....}....BEGIN {.. unless ($ENV{ACTIVEPERL_CONFIG_DISABLE}) {.. eval {.. require ActivePerl::Config;.. };.. die $@ if $@ && $@ !~ /^Can't locate ActivePerl\/Config\.pm/;.. }..}....sub _V {.. die "Perl lib was built for 'MSWin32' but is being run on '$^O'".. unless "MSWin32" eq $^O;.... my ($bincompat, $non_bincompat, $date, @patches) = Internals::V();.... my $opts = join ' ', sort split ' ', "$bincompat $non_bincompat";....

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\3f264ab3.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	4.831834587865022
Encrypted:	false
SSDEEP:	48:psTKNQOUQU9CKOkTT9D0osphAkeArQpWTtcZahrtf0eEbvlAs:psTKNQOUQKxs1eyQpWOaD037n
MD5:	6747162A60FC497FCB4CF4CD03FA37D5
SHA1:	56C032D7060B2420244A9D73EDBF77D51CA0E84B
SHA-256:	4F9BA5D8DE20424265F92FD2A07E2EA71CF8395BA3EC3A2D57EA699771A57A5F
SHA-512:	26228E010C6BCC98B222A796E39015807E0E27B6F2CC165D5ABC0A42DBD39FD5B553E1CDD387942B24349F13EF082F8EDB01FEB4429A124F0F155CA9DB1975DB
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/DirectoryMember.pm".package Archive::Zip::DirectoryMember;..use strict;.use File::Path;..use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip::Member );.}..use Archive::Zip qw(. :ERROR_CODES. :UTILITY_METHODS.);..sub _newNamed {. my $class = shift;. my $fileName = shift; # FS name. my $newName = shift; # Zip name. $newName = _asZipDirName($fileName) unless $newName;. my $self = $class->new(@_);. $self->{'externalFileName'} = $fileName;. $self->fileName($newName);.. if (-e $fileName) {.. # -e does NOT do a full stat, so we need to do one now. if (-d _ ) {. my @stat = stat(_);. $self->unixFileAttributes($stat[2]);. my $mod_t = $stat[9];. if ($^O eq 'MSWin32' and !$mod_t) {. $mod_t = time();. }. $self->setLastModFileDateTimeFromUnix($mod_t);.. } else { # hmm.. trying to add a n

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\4026afd7.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	4.983022007365258
Encrypted:	false
SSDEEP:	48:YbXySkCBD9tbJkPc9wMAxHDxKXVOEaO0iXkrIFGvbqdxJEPdgY3U6FhwFpU:AvDt+B8YEaiqbqdxJEPWP6wFe
MD5:	3148B2AE512047849FA6299881F40272
SHA1:	2A1C050E99835F5417AC79DCF5B8C562D5D605BE
SHA-256:	2572836037A10B70CAB41DBC4467D284AC5969AEF7E6D2FE02F9467D14FDECB1
SHA-512:	2DFF5F34E6647A268538C6AD62B4B39898E50E58EDCF120A930DDDCFF3EF743F45E48C68D65CD7BA89E0789EF5F9307461DB410C947C96F3B78800ABA51392F2
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/XSLoader.pm".# Generated from XSLoader.pm.PL (resolved %Config::Config value)..# This file is unique for every OS....package XSLoader;....$VERSION = "0.21";....#use strict;....package DynaLoader;....# No prizes for guessing why we don't say 'bootstrap DynaLoader;' here...# NOTE: All dl_*.xs (including dl_none.xs) define a dl_error() XSUB..boot_DynaLoader('DynaLoader') if defined(&boot_DynaLoader) &&.. !defined(&dl_error);..package XSLoader;....sub load {.. package DynaLoader;.... my ($caller, $modlibname) = caller();.. my $module = $caller;.... if (@_) {.. $module = $_[0];.. } else {.. $_[0] = $module;.. }.... # work with static linking too.. my $boots = "$module\::bootstrap";.. goto &$boots if defined &$boots;.... goto \&XSLoader::bootstrap_inherit;.... my @modparts = split(/::/,$module);.. my $modfname = $modparts[-1];.... my $modpname = join('/',@modparts);.. my $c = () = spli

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\43d13a5e.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7697
Entropy (8bit):	5.121980771342344
Encrypted:	false
SSDEEP:	192:h+17oy09NRWQaaVRkRKeaiRkRH0pRlMW3BxRSIDo+qvIKcHmbEBpuFKSkyQmJ:h+Ika7WhaoW0OWxx0IDDqAruFphJ
MD5:	AA6083BC0A0C47A037F5E5D83C9A0B3E
SHA1:	EE79F9C9AF541197E82EE2CF3A62D4AAAF3E0EB5
SHA-256:	3296640FD36D55F284CA7E04980ACB35567083FE5D290EBD856FD013062779FE
SHA-512:	B6E5680D70409E089A797E510A3B6AA491FB63FC1DD1CAB569AD495473EF1FC81C93BEBD2A13DD7AF1855C298DF70291C681703FE43577DAC30175CF1946F681
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Spec/Win32.pm".package File::Spec::Win32;..use strict;..use vars qw(@ISA $VERSION);.require File::Spec::Unix;..$VERSION = '3.63';.$VERSION =~ tr/_//d;..@ISA = qw(File::Spec::Unix);..# Some regexes we use for path splitting.my $DRIVE_RX = '[a-zA-Z]:';.my $UNC_RX = '(?:\\\\\\\\\|//)[^\\\\/]+[\\\\/][^\\\\/]+';.my $VOL_RX = "(?:$DRIVE_RX\|$UNC_RX)";...#line 40..sub devnull {. return "nul";.}..sub rootdir { '\\' }...#line 69..sub tmpdir {. my $tmpdir = $_[0]->_cached_tmpdir(qw(TMPDIR TEMP TMP));. return $tmpdir if defined $tmpdir;. $tmpdir = $_[0]->_tmpdir( map( $ENV{$_}, qw(TMPDIR TEMP TMP) ),.... 'SYS:/temp',.... 'C:\system\temp',.... 'C:/temp',.... '/tmp',.... '/' );. $_[0]->_cache_tmpdir($tmpdir, qw(TMPDIR TEMP TMP));.}..#line 91..sub case_tolerant {. eval { require Win32API::File; } or return 1;. my $drive = shift \|\| "C:";. my $osFsType = "\0"x256;. my $osVolName = "\0"x256;. my $ouFsFlags = 0;. Win32API::File::GetV

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\45e7adef.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	36871
Entropy (8bit):	4.646395447877672
Encrypted:	false
SSDEEP:	384:Nl9H9dOnojrrOpbpbE1tGRPWfSYimII8/iR98NTI6W9jtyXjV:Nl9H9AojrrOp1bwYAbiPiRyYZtqV
MD5:	B6DDB05ACF5C486D44FCF7E6B51E5A75
SHA1:	949C2EF257E2B2331A0BAC166D61BA106FC80C56
SHA-256:	8D059928C4E37A688E504AE345DFCE0DC10F3BBE85C3F0D158EF049313DAE7FE
SHA-512:	980E6FCA9C8D8CDDE62D1E7EE050E7F49A0A48D7E95082C3A4B87691E914E327CAD0B9C163A6BCD50C5A01D7B0B57E3074DECE33F06164CC37C8C8650F505DAC
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Uncompress/Base.pm"..package IO::Uncompress::Base ;..use strict ;.use warnings;.#use bytes;..our (@ISA, $VERSION, @EXPORT_OK, %EXPORT_TAGS);.@ISA = qw(Exporter IO::File);...$VERSION = '2.069';..use constant G_EOF => 0 ;.use constant G_ERR => -1 ;..use IO::Compress::Base::Common 2.069 ;..use IO::File ;.use Symbol;.use Scalar::Util ();.use List::Util ();.use Carp ;..%EXPORT_TAGS = ( );.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;..sub smartRead.{. my $self = $_[0];. my $out = $_[1];. my $size = $_[2];. $$out = "" ;.. my $offset = 0 ;. my $status = 1;... if (defined $self->{InputLength}) {. return 0. if $self->{InputLengthRemaining} <= 0 ;. $size = List::Util::min($size, $self->{InputLengthRemaining});. }.. if ( length $self->{Prime} ) {. $$out = substr($self->{Prime}, 0, $size) ;. substr($self->{Prime}, 0, $size) = '' ;. if (length $$out == $size) {. *$self->{InputLengthRema

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\4645d576.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	17992
Entropy (8bit):	4.249662469446003
Encrypted:	false
SSDEEP:	192:8CtjfvySlS14X0VnioOEOgXW233yNRay2mbNQRu7DapICsCyJtICyiQKqtZVdoPM:8Ct7a4eILkS6eH04e5uPX5YS7OPrhtv
MD5:	D5B153A0A25FB0833069D78B296C233A
SHA1:	8274BF502B49B927634DF756191B41F59ED97DE1
SHA-256:	EFE3502C4A7A608CC3B88842D21F0CADF19E7E22EE0C78F748B772B23C89D45C
SHA-512:	72E5D3B9EB0BB4E91BF49C7CA383CFCEBE022D78A3F795AC655E71B4F9A15003ECE3BFA4878A6D181A3FF1E802BDE597229093BDD0638AF8C92CF5599674646E
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Path.pm".package File::Path;..use 5.005_04;.use strict;..use Cwd 'getcwd';.use File::Basename ();.use File::Spec ();..BEGIN {. if ( $] < 5.006 ) {.. # can't say 'opendir my $dh, $dirname'. # need to initialise $dh. eval 'use Symbol';. }.}..use Exporter ();.use vars qw($VERSION @ISA @EXPORT @EXPORT_OK);.$VERSION = '2.12_01';.$VERSION = eval $VERSION;.@ISA = qw(Exporter);.@EXPORT = qw(mkpath rmtree);.@EXPORT_OK = qw(make_path remove_tree);..BEGIN {. for (qw(VMS MacOS MSWin32 os2)) {. no strict 'refs';. {"_IS_\U$_"} = $^O eq $_ ? sub () { 1 } : sub () { 0 };. }.. # These OSes complain if you want to remove a file that you have no. # write permission to:. _FORCE_WRITABLE = (. grep { $^O eq $_ } qw(amigaos dos epoc MSWin32 MacOS os2). ) ? sub () { 1 } : sub () { 0 };.. # Unix-like systems need to stat each directory in order to detect. # race condition. MS-Windows is immune to this particular attack..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\468d9f90.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2197
Entropy (8bit):	5.146221748859256
Encrypted:	false
SSDEEP:	48:5rWUPzbvUFKGuujRu7sdkR3uB85dLGq44/okT6HWQRJEIpsSf:xWCvUFsul6uB8ff44/oS6HWMOIpZ
MD5:	A4161BBE841D963A2926EA80A0E2199E
SHA1:	A3D2CF9D87DB1E3C30E71CDE93BC74CC3422651B
SHA-256:	E03C0D53C857B3D689507658C82D810ECA95433B0F1D8B8B07D44AB87EE79D0B
SHA-512:	6AAAEECB44A818406C7C623B5184C35CA83407D21570512311BE6497C8771FF9A193FE17FF3AB9892BFBFA3FC6B0DA9F3B3FE09BB8F5D7ED298967DD90E5CCC8
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Fcntl.pm".package Fcntl;..#line 57..use strict;.our($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);..require Exporter;.require XSLoader;.@ISA = qw(Exporter);.$VERSION = '1.13';..XSLoader::load();..# Named groups of exports.%EXPORT_TAGS = (. 'flock' => [qw(LOCK_SH LOCK_EX LOCK_NB LOCK_UN)],. 'Fcompat' => [qw(FAPPEND FASYNC FCREAT FDEFER FDSYNC FEXCL FLARGEFILE... FNDELAY FNONBLOCK FRSYNC FSYNC FTRUNC)],. 'seek' => [qw(SEEK_SET SEEK_CUR SEEK_END)],. 'mode' => [qw(S_ISUID S_ISGID S_ISVTX S_ISTXT... _S_IFMT S_IFREG S_IFDIR S_IFLNK... S_IFSOCK S_IFBLK S_IFCHR S_IFIFO S_IFWHT S_ENFMT... S_IRUSR S_IWUSR S_IXUSR S_IRWXU... S_IRGRP S_IWGRP S_IXGRP S_IRWXG... S_IROTH S_IWOTH S_IXOTH S_IRWXO... S_IREAD S_IWRITE S_IEXEC... S_ISREG S_ISDIR S_ISLNK S_ISSOCK... S_ISBLK S_ISCHR S_ISFIFO... S_ISWHT S_ISENFMT..... S_IFMT S_IMODE. )],.);..# Items to export into callers namespace by default.# (move in

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\468fc7f6.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	17479
Entropy (8bit):	5.130140439004776
Encrypted:	false
SSDEEP:	384:/GDejwzeKEp/q1+P0uV2JaiTG2ca8emk0cO2m3nC5zN:/GDeGecRuV2JaiTG2Jak0cO53nG
MD5:	D584F8F35A36F78548C72BAE52D6294E
SHA1:	A21DE949C4839A04F549E72B9C8401CCD3C5FB92
SHA-256:	5B8365A82868497481E5F405E403F99EE1A288BE133B061F6F0F42CC61E1AE6D
SHA-512:	AEBA56965B4260D5C8043B44ACED1193FE825D24B68C109210178136236C2117E70E4B67FA75A904DA727385C989E1F2B04324892808D859C8D6982294606D23
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip.pm".package Archive::Zip;..use 5.006;.use strict;.use Carp ();.use Cwd ();.use IO::File ();.use IO::Seekable ();.use Compress::Raw::Zlib ();.use File::Spec ();.use File::Temp ();.use FileHandle ();..use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';.. require Exporter;. @ISA = qw( Exporter );.}..use vars qw( $ChunkSize $ErrorHandler );..BEGIN {. # This is the size we'll try to read, write, and (de)compress.. # You could set it to something different if you had lots of memory. # and needed more speed.. $ChunkSize \|\|= 32768;.. $ErrorHandler = \&Carp::carp;.}..# BEGIN block is necessary here so that other modules can use the constants..use vars qw( @EXPORT_OK %EXPORT_TAGS );..BEGIN {. @EXPORT_OK = ('computeCRC32');. %EXPORT_TAGS = (. CONSTANTS => [. qw(. FA_MSDOS. FA_UNIX. GPBF_ENCRYPTE

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\49975809.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	5.198529015627829
Encrypted:	false
SSDEEP:	24:TC2QJS8jmHAUqbibx3sl7P5j4lL5MYVd7P9S8Hbbv:fQxjXWpsl7Zjud748H/v
MD5:	F0C1C7BB5C88CA3EC9C32BE4FB0892F4
SHA1:	C8EBC0F4B21BDFA6484DEB4979AA1F80ADEF8DFC
SHA-256:	76954E70283ACFB0F5D410F2546A36F6317C00DF120842A6B6CB348A18E4D8FB
SHA-512:	6290A9A573412C9DCA88322FA0214CEBCA64E809CA13781D67386FCD430804CFE1D717D6264C4C48D203DAC7A34140582D6FE26600FCDB7F73C13972E3C090CB
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/overloading.pm".package overloading;.use warnings;..our $VERSION = '0.02';..my $HINT_NO_AMAGIC = 0x01000000; # see perl.h..require 5.010001;..sub _ops_to_nums {. require overload::numbers;.. map { exists $overload::numbers::names{"($_"}..? $overload::numbers::names{"($_"}..: do { require Carp; Carp::croak("'$_' is not a valid overload") }. } @_;.}..sub import {. my ( $class, @ops ) = @_;.. if ( @ops ) {..if ( $^H{overloading} ) {.. vec($^H{overloading} , $_, 1) = 0 for _ops_to_nums(@ops);..}...if ( $^H{overloading} !~ /[^\0]/ ) {.. delete $^H{overloading};.. $^H &= ~$HINT_NO_AMAGIC;..}. } else {..delete $^H{overloading};..$^H &= ~$HINT_NO_AMAGIC;. }.}..sub unimport {. my ( $class, @ops ) = @_;.. if ( exists $^H{overloading} or not $^H & $HINT_NO_AMAGIC ) {..if ( @ops ) {.. vec($^H{overloading} \|\|= '', $_, 1) = 1 for _ops_to_nums(@ops);..} else {.. delete $^H{overloading};..}. }.. $^H \|= $HINT_NO_AMAGIC;.}..1;.__END__.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\4a13db57.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	80080
Entropy (8bit):	5.033749362248497
Encrypted:	false
SSDEEP:	1536:vFvLHk6SThgeGrz6u/RdrBRjxXtBanGn1JJrb1T5w+PN8CZc0BcWvOiDseuFr9e:vFvLjltjJVLK99e
MD5:	0075748A654F73C59FEE583A9E270105
SHA1:	F6E3DAAA39052B3BCB111B686E35E760C927F1EA
SHA-256:	EDD0BEE7BED143011EC6C768CC89A241A2B9D46D2EC053C223D64BB55BDBC257
SHA-512:	6ED11797D84E711C189962238DF87D09809E7BF60D2C549090776D3893D0F277946D08FCE94EBC795685516B97669CC9D1A57A307911BD58B1E6736526049110
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Errno.pm".# -- buffer-read-only: t --..#..# This file is auto-generated. *ANY* changes here will be lost..#....package Errno;..require Exporter;..use strict;....use Config;.."$Config{'archname'}-$Config{'osvers'}" eq.."MSWin32-x86-multi-thread-64int-6.1" or...die "Errno architecture (MSWin32-x86-multi-thread-64int-6.1) does not match executable architecture ($Config{'archname'}-$Config{'osvers'})";....our $VERSION = "1.25";..$VERSION = eval $VERSION;..our @ISA = 'Exporter';....my %err;....BEGIN {.. %err = (...ENUM_REGISTRY_SETTINGS => -2,...ENUM_CURRENT_SETTINGS => -1,...EXCEPTION_CONTINUE_EXECUTION => -1,...EC_ENABLEALL => 0,...ELF_CULTURE_LATIN => 0,...ELF_VERSION => 0,...EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X => 0,...EMARCH_ENC_I17_IMM7B_VAL_POS_X => 0,...EMBDHLP_CREATENOW => 0,...EMBDHLP_INPROC_HANDLER => 0,...ERROR => 0,...ERROR_BIDI_STATUS_OK => 0,...ERROR_SEVERITY_SUCCESS => 0,...ERROR_SUCCESS => 0,...ESB_ENABLE_BOTH => 0,...ES_LEFT => 0,...EVENTLOG_

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\4c9ab222.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.145528339715507
Encrypted:	false
SSDEEP:	6:TF2p1+c7EKJ/NfvRsQFdbNpA26QlBMhh1F:TFYJEkFfvRsQ3bNuYBMxF
MD5:	3D20D34C9F93CFDA5F33555A5ED7199E
SHA1:	4CF5A9CFDFE53E7A812D7EA6E8B38A8CD2539DA9
SHA-256:	E0B6316855D79525620065B36325DD3CC36471D44D2B50D02E48700C7A7FCD7D
SHA-512:	AC7D4C5D77FC422CBBDA6330631A5A99F719D274830393750BA0E1ECA0ABE170175A02E7D926D660BDE6912C8BB42F22D3308187B3CCB255D41FA2AB74F005BC
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Tie/Hash/NamedCapture.pm".use strict;.package Tie::Hash::NamedCapture;..our $VERSION = "0.09";..require XSLoader;.XSLoader::load(); # This returns true, which makes require happy...__END__..#line 50.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\4c9f24be.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2237
Entropy (8bit):	5.136536068812638
Encrypted:	false
SSDEEP:	48:eK4QOUQU900pCzm/7tI91cgktQL5ycwZtvhjjNBvRio/o4NpHOZAD6:eK4QOUQopC6If5r5ycwnvhTvRiowYpHc
MD5:	A0DD76EEFB681B46352713997747F853
SHA1:	093F542D8F5743442F458D8E2B54143EAFBFA4D3
SHA-256:	F1C3719273A808B889C09C966421AF8B5D0AD601B429F94622A9F44F92BD93A4
SHA-512:	94EC52B25B0C354204644DF8FD1200A30239766601D1F11E2BAD9A69A1C73D2F4F25941E7BF107DACBBE0CC400575D5BB14CD2E82EDA8D8A9BF252B46BD3ACE3
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/NewFileMember.pm".package Archive::Zip::NewFileMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw ( Archive::Zip::FileMember );.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES. :UTILITY_METHODS.);..# Given a file name, set up for eventual writing..sub _newFromFileNamed {. my $class = shift;. my $fileName = shift; # local FS format. my $newName = shift;. $newName = _asZipDirName($fileName) unless defined($newName);. return undef unless (stat($fileName) && -r _ && !-d _ );. my $self = $class->new(@_);. $self->{'fileName'} = $newName;. $self->{'externalFileName'} = $fileName;. $self->{'compressionMethod'} = COMPRESSION_STORED;. my @stat = stat(_);. $self->{'compressedSize'} = $self->{'uncompressedSize'} = $stat[7];. $self->desiredCompressionMethod(. ($self->compressedSize() > 0). ? COMPRESSION_DEFLATED. : COMPRESSION_STORED. )

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\52e5967c.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1221
Entropy (8bit):	5.296304555359562
Encrypted:	false
SSDEEP:	24:T+W5f8DM0GSALUJ+kX4f1fQxBQ0tZQS0bQFOIIEGMbLzjN2mcRBdH:SW5kDFqUJ+kIFQxBQ0tZQS0cFqEGMnXC
MD5:	5EAAC634B8A926E79D7557699B3FFFC4
SHA1:	592F6261F96006D8426CCB965AE1A30F144123C3
SHA-256:	8DDA1690444A6E709D177A02253182479CE9B9623B7C87BAF9B3728154F6E6F6
SHA-512:	E26FB7473EA31E908537656C7BB5493AF5965DB1D018787F7E487E74B563F710B865B9D5B3A2A0A962DBEB56B52163E888B78F123455DB459A4D735AB599ED67
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/List/Util.pm".# Copyright (c) 1997-2009 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself..#.# Maintained since 2013 by Paul Evans <leonerd@leonerd.org.uk>..package List::Util;..use strict;.use warnings;.require Exporter;..our @ISA = qw(Exporter);.our @EXPORT_OK = qw(. all any first min max minstr maxstr none notall product reduce sum sum0 shuffle uniq uniqnum uniqstr. pairs unpairs pairkeys pairvalues pairmap pairgrep pairfirst.);.our $VERSION = "1.45";.our $XS_VERSION = $VERSION;.$VERSION = eval $VERSION;..require XSLoader;.XSLoader::load('List::Util', $XS_VERSION);..sub import.{. my $pkg = caller;.. # (RT88848) Touch the caller's $a and $b, to avoid the warning of. # Name "main::a" used only once: possible typo" warning. no strict 'refs';. ${"${pkg}::a"} = ${"${pkg}::a"};. ${"${pkg}::b"} = ${"${pkg}::b"};.. goto &Exporter::im

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\54f7af00.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.8478100353465265
Encrypted:	false
SSDEEP:	384:60TBwFN+qN6tznAWOP7Eckb5yOa7qjHWRF21HJG06+oYTfuO4q0v:6O9ICyOa75F21HJG0aYTfkq
MD5:	A8AE9002EAE09AB963E604F92D1510E4
SHA1:	46A6EDFBB61B25D70C01D6812C38C7960533E9BF
SHA-256:	AC8FA59812BFF98BBDC147E5F5C92A5A58DC51D1192BE55B9B5C20735C1601D0
SHA-512:	C41B5FBDD5E1A31CB6A16F8A03F67EA2A5C1DE9623230E8012F187FD8200AA7E84A6E7CE6020806BC84E766465AB89974A162E24EA4C7493B5ED59706957BE49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........#.....B...`...... ........`....\|p.......................................... .................................................................p.......................................................p............................text....@.......B..................`.P`.data... ....`.......F..............@.0..rdata.......p.......H..............@.`@.bss..................................`..edata...............N..............@.0@.idata...............P..............@.0..CRT....,............\..............@.0..tls.... ............^..............@.0..reloc..p............`..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\5af8b25a.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	16562
Entropy (8bit):	5.3822628135585395
Encrypted:	false
SSDEEP:	384:F7WuhUZ/HC1hDUqRlfk+i9pLqRrtmw8jyI:FQhHu7XkqNtmbjyI
MD5:	F9D1D06662D8B31A2B6DEB0F5D4C2D2C
SHA1:	0B157506DF7EEF7FC35694C103A382EF4A981B33
SHA-256:	04240F535272923523CCB9DA6F1EFA0464328BCC3EAD7DD2FF4C40D4A0A6FC6F
SHA-512:	734FB3FE2F5AFBB72173D91C9C83B483918691AED233149AB7D905A0AA18590625695C26C317ECB0BD27380FE8A9B6F8087D1685336AB84AB9EFEA3AB26A8092
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/ActivePerl/Config.pm".package ActivePerl::Config;....use strict;..my %OVERRIDE;....# Make sure all the symbols overridden in this module are excluded..# from the tied cache in Config.pm (configpm in the Perl sources).....my %COMPILER_ENV = map { $_ => 1 } qw(.. cc.. ccflags.. cccdlflags.. ccname.. ccversion.. gccversion.. ar.. cpp.. cppminus.. cpprun.. cppstdin.. dlltool.. ld.. lddlflags.. ldflags.. lib_ext.. libc.. libs.. make.. optimize.. perllibs.. _a.. _o.. obj_ext.. i64type.. u64type.. quadtype.. uquadtype.. d_casti32..);..$COMPILER_ENV{libpth} = 1 if $^O eq "linux";..my $compiler_env_initialized;....use Config ();..my $CONFIG_OBJ = tied %Config::Config;....sub override {.. return 0 if $ENV{ACTIVEPERL_CONFIG_DISABLE};.... my $key = shift;.... if (exists $ENV{"ACTIVEPERL_CONFIG_\U$key"}) {...$_[0] = $ENV{"ACTIVEPERL_CONFIG_\U$key"};...return 1;.. }.... if (exis

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\5e4a9ee7.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4512
Entropy (8bit):	5.029268710659303
Encrypted:	false
SSDEEP:	96:wQkzz20DhoA23Jc0ikGxaFgS3o8y3wjlGcwgSlJxyvkzauiL/JQv:wVO0toA2ZUkGxaFgS3fy3clag4PniL/s
MD5:	0716207C039B0D0FBFE2B836C4F2B3E9
SHA1:	CF1A1AEA4E8B50E25727E88D470553BF6A7BEBDD
SHA-256:	FCFED08E4715546AF8AFC83882E54F7F2AA88281032289FCF56B0505E0C31B93
SHA-512:	6E20644DCF78A07F2750FD6989D1B6A4FAE8EBE7070DBDC8BDE254B75140A0DAF45E8A961D1DEEB005C0A04C90E6BEC63EC9BF1F137AD84ED9A1B227F530EBAA
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/overload.pm".package overload;..our $VERSION = '1.26';..%ops = (. with_assign => "+ - * / % ** << >> x .",. assign => "+= -= = /= %= = <<= >>= x= .=",. num_comparison => "< <= > >= == !=",. '3way_comparison' => "<=> cmp",. str_comparison => "lt le gt ge eq ne",. binary => '& &= \| \|= ^ ^= &. &.= \|. \|.= ^. ^.=',. unary => "neg ! ~ ~.",. mutators => '++ --',. func => "atan2 cos sin exp abs log sqrt int",. conversion => 'bool "" 0+ qr',. iterators => '<>',. filetest => "-X",. dereferencing => '${} @{} %{} &{} {}',. matching => '~~',. special => 'nomethod fallback =',.);..my %ops_seen;.for $category (keys %ops) {. $ops_seen{$_}++ for (split /\s+/, $ops{$category});.}..sub nil {}..sub OVERLOAD {. $package = shift;. my %arg = @_;. my $sub;. *{$package . "::(("} = \&nil; # M

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6b6f046e.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	13819
Entropy (8bit):	4.9468986304917175
Encrypted:	false
SSDEEP:	384:eK4eST2MFysq2kJAq+UJqfY2OUg4TbgUJ8fUiUKS2uyLdefVc7RgE+MhVGvq:eK4eE/FaAq+iAY2OR4TbgimUifhuyZeW
MD5:	61D9994E8BBDC422660335338851C293
SHA1:	678EA504C2AAF0B6203EB6A95E2681B8848746AB
SHA-256:	1B6446C3F399676FB563923CEE6902F1C01AFCFA18118C357F568A187EB7253E
SHA-512:	18E921312E5B9A643C002F67DF4DB6AF6661833802C4BDB80F4C99ACC5EC63FA3823F8B699E510247C102E3E86AE00FBC0361F026E3012111B79F06028AC2ABD
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/ZipFileMember.pm".package Archive::Zip::ZipFileMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw ( Archive::Zip::FileMember );.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES. :PKZIP_CONSTANTS. :UTILITY_METHODS.);..# Create a new Archive::Zip::ZipFileMember.# given a filename and optional open file handle.#.sub _newFromZipFile {. my $class = shift;. my $fh = shift;. my $externalFileName = shift;. my $possibleEocdOffset = shift; # normally 0.. my $self = $class->new(. 'crc32' => 0,. 'diskNumberStart' => 0,. 'localHeaderRelativeOffset' => 0,. 'dataOffset' => 0, # localHeaderRelativeOffset + header length. @_. );. $self->{'externalFileName'} = $externalFileName;. $self->{'fh'} = $fh;. $self->{'possibleEocdOffset'} = $possibleEocdOffset;. return $self;.}

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6b9bcbc1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	6.020354158187508
Encrypted:	false
SSDEEP:	768:MwYkmL0oXxkjGgx9r2oVxUjjsCdkT5pjLIW/ymyQOH5WkSUl/3TkLuF0TOO8eAAY:MwoL0o69CoCjjdc5pB/ymqWTU53TkLuN
MD5:	83E4A46C2DA50A551469DF4C299570FC
SHA1:	2A7AD11E09581CFB4351CDF60D92498F874DBB02
SHA-256:	9C0FA5A8BF5A0DCF7777C32A4DE912DC1844296995F7468C1152CACC2A8E2AC3
SHA-512:	34D41FEBAEDA6FF34EC03207B94C69D4EE7C24C3452B83283F77273D94754D650F1EA7D3F8136D6061BF07C1704966822382F8852016E733DEE298188F47FF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....\|.......... ..............p.........................0......hh........ .............................................................. .. .......................................................0............................text...T{.......\|..................`.P`.data... ...........................@.0..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc.. .... ......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6bc3ec17.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	20177
Entropy (8bit):	4.8547280105742185
Encrypted:	false
SSDEEP:	384:Ewmyq0duubwKLMQJGYdrvd67B3ybcXmFpO/pMQln:EwPq0duubwKLl96yO/pzln
MD5:	75AAFAF50168A3C6CBA70DB8E68C44DD
SHA1:	2C25C97ADA1700F8D93946ED54D4FB16445A0F3E
SHA-256:	2C8151EED953A979BBE8BE6B2C3C6435026C49E38C939D2C10B74B135D602EBD
SHA-512:	E01CEEB6AC748F2BCFA1BFFC6EE4D19D2DEABC51C2ECC3B1B015A80711A0B47F3307B730B4600DE01AC29C685BC8D8AC821502CB0DC6B9BC9DA6FD5FE75B45FB
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Carp.pm".package Carp;..{ use 5.006; }.use strict;.use warnings;.BEGIN {. # Very old versions of warnings.pm load Carp. This can go wrong due. # to the circular dependency. If warnings is invoked before Carp,. # then warnings starts by loading Carp, then Carp (above) tries to. # invoke warnings, and gets nothing because warnings is in the process. # of loading and hasn't defined its import method yet. If we were. # only turning on warnings ("use warnings" above) this wouldn't be too. # bad, because Carp would just gets the state of the -w switch and so. # might not get some warnings that it wanted. The real problem is. # that we then want to turn off Unicode warnings, but "no warnings. # 'utf8'" won't be effective if we're in this circular-dependency. # situation. So, if warnings.pm is an affected version, we turn. # off all warnings ourselves by directly setting ${^WARNING_BITS}.. # On unaffected versions, we turn off ju

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6dfbd852.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	936
Entropy (8bit):	5.091742114941939
Encrypted:	false
SSDEEP:	24:TekKHrHp6eiZEuENuMyluEyeK4tdb+ubi5wQtxtNt:yNHrJQ/MylGp4tIuMwgn
MD5:	D4537E7E928CC77D5BD7B113798B1804
SHA1:	ACAAC451FEFB9A0B8C112ACB876DF321606514F0
SHA-256:	01074991FB3D78C55675CD721299091772A010A92715518156FE8A7B213F48A2
SHA-512:	6D22FD9B89F659A9901479BC116943E3F37690DBE7E2A10F146EAC03BD90A48C5AFF82276CCD0CD6AFEDEEED92A6FC8BDEB0F0946BA70BE93F72149A29857A5E
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/Filter/PodStrip.pm".package PAR::Filter::PodStrip;.use 5.006;.use strict;.use warnings;.use base 'PAR::Filter';..#line 22..sub apply {. my ($class, $ref, $filename, $name) = @_;.. no warnings 'uninitialized';.. my $data = '';. $data = $1 if $$ref =~ s/((?:^__DATA__\r?\n).)//ms;.. my $line = 1;. if ($$ref =~ /^=(?:head\d\|pod\|begin\|item\|over\|for\|back\|end\|cut)\b/) {. $$ref = "\n$$ref";. $line--;. }. $$ref =~ s{(..(.?\n)..(?:=(?:head\d\|pod\|begin\|item\|over\|for\|back\|end)\b. .?\n)..(?:=cut[\t ][\r\n]?\|\Z)..(\r?\n)?. )}{..my ($pre, $post) = ($2, $3);. "$pre#line " . (.. $line += ( () = ( $1 =~ /\n/g ) )..) . $post;. }gsex;.. $$ref =~ s{^=encoding\s+\S+\s$}{\n}mg;.. $$ref = '#line 1 "' . ($filename) . "\"\n" . $$ref. if length $filename;. $$ref =~ s/^#line 1 (.\n)(#!.\n)/$2#line 2 $1/g;. $$ref .= $data;.}..1;..#line 85.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\72279688.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.105799136611243
Encrypted:	false
SSDEEP:	768:FK5STJ8OnSw5qvIC6Q+qtJbpIkICl/y0Mx1RBa0EiYr2OWTPv9tBVv+:FKAT6OlqaQ+iJbzM0MBQ0EiYr2OW
MD5:	716DC81D2B39810FA28B8F14BA41D014
SHA1:	F38D7E2D701F8CEBC51E456BFC1E25450F972444
SHA-256:	3B7654EAC8A06F4D172BFA90A06C35336E3085AE4AFD8065DD523F7865B59CBD
SHA-512:	BE3C7AED665280F2F33620F632E886667F4054B38B291EBE78D1F6120FBF9D62723509DD3955BCEAE432F6AEEAECAE173B4498EA9F5B87C6372563D194B14EA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#................ ..............b......................... ................ .....................................................................................................................8................................text...D...........................`.P`.data...............................@.0..rdata..d...........................@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\72e7eaee.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	23148
Entropy (8bit):	4.790073060780081
Encrypted:	false
SSDEEP:	384:gOFmpu5vf5iV624ADQEPT6mfxhyXgkdQPB7pc6y7:4r5PT6mfxcXgkdQ1w
MD5:	E13353CD4F0015A96485749F164335F7
SHA1:	3221428C339B26D9610DF489BBD1D9570CDD16BE
SHA-256:	6D4F94E90DF39100848FB4B6B6C5FD83CD31BC10F496C76BD2BB244778B09239
SHA-512:	C13009E83D024C9856628B9AD6BC34A7ED05C54966A932BE58EA4049A41DC4AF5A999A02A014F5FB1E8931DC859318789D9D6CB3C6B5EB4489F68C3BEBFABB6F
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/Base/Common.pm".package IO::Compress::Base::Common;..use strict ;.use warnings;.use bytes;..use Carp;.use Scalar::Util qw(blessed readonly);.use File::GlobMapper;..require Exporter;.our ($VERSION, @ISA, @EXPORT, %EXPORT_TAGS, $HAS_ENCODE);.@ISA = qw(Exporter);.$VERSION = '2.069';..@EXPORT = qw( isaFilehandle isaFilename isaScalar. whatIsInput whatIsOutput . isaFileGlobString cleanFileGlobString oneTarget. setBinModeInput setBinModeOutput. ckInOutParams . createSelfTiedObject. . isGeMax32.. MAX32.. WANT_CODE. WANT_EXT. WANT_UNDEF. WANT_HASH.. STATUS_OK. STATUS_ENDSTREAM. STATUS_EOF. STATUS_ERROR. ); ..%EXPORT_TAGS = ( Status => [qw( STATUS_OK. STATUS_ENDSTREAM. STATUS_EOF.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\74517a94.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4399
Entropy (8bit):	4.905062578161121
Encrypted:	false
SSDEEP:	96:IXHYN3yh5tVeXCdfonHW6oYOAAT2cvgFlhiQc:IXHYNCjtVeXCdf2voYO7yPhiQc
MD5:	B1268DD71591363913E0CF576E654CE8
SHA1:	8F2E949E20D85D5D427744139623AE39C86706A1
SHA-256:	8BF23EB0F4C3CEBDD45773E722D0626AF2283211E221E7622EAE6A6CB5A611F2
SHA-512:	BCAD9936BE509666CD28CD05A9F204A0CB26DF81A14FB3926D6C15E0AC87AF4F48C2E74381B2C328A0C77FCFB52CE45D421CEA67B6E652D8081C837CCA6A8378
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/Filter/PatchContent.pm".package PAR::Filter::PatchContent;.use 5.006;.use strict;.use warnings;.use base 'PAR::Filter';..#line 22..sub PATCH_CONTENT () { +{. map { ref($_) ? $_ : lc($_) }. 'AutoLoader.pm' => [. '$is_dosish = ' =>. '$is_dosish = $^O eq \'cygwin\' \|\| ',. ],. 'MIME/Types.pm' => [. 'File::Spec->catfile(dirname(__FILE__),' =>. 'File::Spec->catfile($ENV{PAR_TEMP}, qw(inc lib MIME),',. ],. 'Mozilla/CA.pm' => [. 'File::Spec->catfile(dirname(__FILE__), "CA", "cacert.pem")' =>. 'File::Spec->catfile($ENV{PAR_TEMP}, qw(inc lib Mozilla CA cacert.pem))',. ],. 'Pod/Usage.pm' => [. ' = $0' =>. ' = $ENV{PAR_0} \|\| $0',. ],. # Some versions of Spreadsheet::ParseExcel have a weird non-POD construct =cmmt. # that is used to comment out a block of code. perl treats it as POD and strips it.. # Since it's not POD, POD parsers ignore it.. # PAR::Filter::PodStrip only str

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\754a1dd1.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8765
Entropy (8bit):	4.879177694288677
Encrypted:	false
SSDEEP:	192:KAQ4DgFT4NW1MAWLdiIeXMssdiZFnZcYK0y2w4HE/hweLknLWZjz:KAlgFr3kZweLJ
MD5:	10F2E26C440225BA97CC6A28CDEA9DAB
SHA1:	66E4E2BEC0AE2958953F01242893D73AD8B47A8D
SHA-256:	521CDE7576853BBD34289CADB657A696630189F3A58B8077FCC5F108F1ADB6B4
SHA-512:	CAE974C609A57D219F7FA191811AA92B7BF17A849BEC56FAC1F8773830F20A0CC775A1665BBCF461764F3607F4E653CCE5425FF80CA8B79EC011ABC5C3891D62
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Uncompress/RawInflate.pm".package IO::Uncompress::RawInflate ;.# for RFC1951..use strict ;.use warnings;.#use bytes;..use Compress::Raw::Zlib 2.069 ;.use IO::Compress::Base::Common 2.069 qw(:Status );..use IO::Uncompress::Base 2.069 ;.use IO::Uncompress::Adapter::Inflate 2.069 ;..require Exporter ;.our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $RawInflateError);..$VERSION = '2.069';.$RawInflateError = '';..@ISA = qw( Exporter IO::Uncompress::Base );.@EXPORT_OK = qw( $RawInflateError rawinflate ) ;.%DEFLATE_CONSTANTS = ();.%EXPORT_TAGS = %IO::Uncompress::Base::EXPORT_TAGS ;.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');..#{.# # Execute at runtime .# my %bad;.# for my $module (qw(Compress::Raw::Zlib IO::Compress::Base::Common IO::Uncompress::Base IO::Uncompress::Adapter::Inflate)).# {.# my $ver = ${ $module . "::VERSION"} ;.# .# $bad{$module} = $ver.# if $ver ne $V

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\783170a4.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	37484
Entropy (8bit):	5.026603983810129
Encrypted:	false
SSDEEP:	768:+4efLdwctPDnPDIcC5IE2xocfxWPsqBl1oLyIodYl/fF9GWl/H8qbrg4ZK8VIvse:XefrPDIcA9+Z1F9YfrDH
MD5:	BC5DF0749AF5FA0B3A3703194729D50A
SHA1:	136115650D74AEC571C1489F9BAD5CD735510413
SHA-256:	43E4037DAFD313BD84C4D15151F39A249980CDDB115E24BEE8E8F10483000D3B
SHA-512:	6F05244D697336044168222CD77EAF52B5B45047FBBCFEF757A1569C5B79BF3AF2A6A20F7E57236D73F85D1626A5D32238AE3158147CAFA0AEE42A61D295BC3E
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/Member.pm".package Archive::Zip::Member;..# A generic member of an archive..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip );.. if ($^O eq 'MSWin32') {. require Win32;. require Encode;. Encode->import(qw{ decode_utf8 });. }.}..use Archive::Zip qw(. :CONSTANTS. :MISC_CONSTANTS. :ERROR_CODES. :PKZIP_CONSTANTS. :UTILITY_METHODS.);..use Time::Local ();.use Compress::Raw::Zlib qw( Z_OK Z_STREAM_END MAX_WBITS );.use File::Path;.use File::Basename;..# Unix perms for default creation of files/dirs..use constant DEFAULT_DIRECTORY_PERMISSIONS => 040755;.use constant DEFAULT_FILE_PERMISSIONS => 0100666;.use constant DIRECTORY_ATTRIB => 040000;.use constant FILE_ATTRIB => 0100000;..# Returns self if successful, else undef.# Assumes that fh is positioned at beginning of central directory file header..# Leaves fh positioned immediately after

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\7988408f.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	4.9151592845886505
Encrypted:	false
SSDEEP:	192:/2nu+Mvss1iHTSxGN9KTqiqbqdJFWUhzgzWEtplZI7V5U:cNBbGxGbivEqdJFWGgzZlm7V6
MD5:	49F05C36F8A9E9793022151D13899850
SHA1:	59B8A8125D967BD53F1FFF6637D8588329F740AE
SHA-256:	CF474851D14FCF71C33D906576620CA092123AE4E9B2F2D80B92F24FB365BEA9
SHA-512:	F6972906CEA32B369D4D69A3B3C9DDCF02FE2F6CD6CE15CE1218F0E4CA7F01C07AFAAF9A963D123885430C19C331448DDE697E7557F6DA5A402AAC791B8F6DA7
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/DynaLoader.pm"...# Generated from DynaLoader_pm.PL, this file is unique for every OS....package DynaLoader;....# And Gandalf said: 'Many folk like to know beforehand what is to..# be set on the table; but those who have laboured to prepare the..# feast like to keep their secret; for wonder makes the words of..# praise louder.'....# (Quote from Tolkien suggested by Anno Siegel.)..#..# See pod text at end of file for documentation...# See also ext/DynaLoader/README in source tree for other information...#..# Tim.Bunce@ig.co.uk, August 1994....BEGIN {.. $VERSION = '1.38';.. $XS_VERSION = '1.38';..}....use Config;....# enable debug/trace messages from DynaLoader perl code..$dl_debug = $ENV{PERL_DL_DEBUG} \|\| 0 unless defined $dl_debug;....#..# Flags to alter dl_load_file behaviour. Assigned bits:..# 0x01 make symbols available for linking later dl_load_file's...# (only known to work on Solaris 2 using dlopen(RTLD_GLOBAL))..# (ignored

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\79c8e6ca.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	488
Entropy (8bit):	5.213596920685722
Encrypted:	false
SSDEEP:	12:TFIGsQU6gAWzFYOCxsztyJtwl4sgFqlf0jx+VMjJ9KEqYPsn:TKQU6gVz4sEw4ffxWWKEqY0n
MD5:	9B6342AAD4231CE4D8499DFCED0283F9
SHA1:	EF805B5000CF8B345CBF602FD3593C7ED0561875
SHA-256:	CA84EF78388694503ACF45F84ECF3C628D7E9FBF2EBD529C4C7E1A87B689461F
SHA-512:	49353EB22CE0BF23131F899EADA2E376A78FFD029A6D67B5F710C388923D9E5DEA506AB086A05D8208880BEBDF747C7A8AA43D8049D33D21C42CAA6280D86729
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/bytes.pm".package bytes;..our $VERSION = '1.05';..$bytes::hint_bits = 0x00000008;..sub import {. $^H \|= $bytes::hint_bits;.}..sub unimport {. $^H &= ~$bytes::hint_bits;.}..sub AUTOLOAD {. require "bytes_heavy.pl";. goto &$AUTOLOAD if defined &$AUTOLOAD;. require Carp;. Carp::croak("Undefined subroutine $AUTOLOAD called");.}..sub length (_);.sub chr (_);.sub ord (_);.sub substr ($$;$$);.sub index ($$;$);.sub rindex ($$;$);..1;.__END__..#line 127.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\79c927d5.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1386
Entropy (8bit):	4.943763915726761
Encrypted:	false
SSDEEP:	24:TVMK4QOUQUkiO4806cMI64ss2PEnNwTRnLtElg6yB7Zyg0Fo3T7VXhA4vAy0tw:eK4QOUQU9Oj06LI6hwQ/mg6Ng0FK7VXp
MD5:	77598482D793C14467FF173E395C515D
SHA1:	EF6CFE367CACDCE197FA89CF88C3A6E89DA4CCA7
SHA-256:	EC9F521C51D49F688FED9BB63756FC31E76ABDAF4BB29DE1134CBDA50DC7CDE7
SHA-512:	ACA01959991584474466E85B5BC06E1E0645163D81E5741471856990C48B5BF92C24B59C979F6FD27D457971AD27520FCC4A2AC243C0BE99B80AF923AA9AD5AF
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/FileMember.pm".package Archive::Zip::FileMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw ( Archive::Zip::Member );.}..use Archive::Zip qw(. :UTILITY_METHODS.);..sub externalFileName {. shift->{'externalFileName'};.}..# Return true if I depend on the named file.sub _usesFileNamed {. my $self = shift;. my $fileName = shift;. my $xfn = $self->externalFileName();. return undef if ref($xfn);. return $xfn eq $fileName;.}..sub fh {. my $self = shift;. $self->_openFile(). if !defined($self->{'fh'}) \|\| !$self->{'fh'}->opened();. return $self->{'fh'};.}..# opens my file handle from my file name.sub _openFile {. my $self = shift;. my ($status, $fh) = _newFileHandle($self->externalFileName(), 'r');. if (!$status) {. _ioError("Can't open", $self->externalFileName());. return undef;. }. $self->{'fh'} = $fh;. _binmode($fh);. return $fh;.}..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\7be8a16e.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	293466
Entropy (8bit):	4.598527552400872
Encrypted:	false
SSDEEP:	3072:VW7XQgmRCEZMl9O+s7RYq8/7p+oUw2XF6arA6X3UwDmzH+qNMAdDDS9eTwOtJ7:V4X7+MSxmNzNGFPrAgzmZxdfB7
MD5:	4955851FAAD3AC46B5A51D71D8D50332
SHA1:	62748ECCF7914AC7CFA9B7F687816DC3711AB5BF
SHA-256:	59BBB758B60A0D3B5C1F6DA1802601B9D157ADE37DB9B251FE8D79A8D705D0B4
SHA-512:	F482C949E39D140E14A796B50254055B86C8BAF1953835B04E7DE6A221FDA6A870FB92CF306ED2F72945320053487EDF391EAD0B2118DF2B04EB9C08187C6BFD
Malicious:	false
Preview:	package main;.#line 1 "script/exiftool".#!/usr/bin/perl -w.#------------------------------------------------------------------------------.# File: windows_exiftool.#.# Description: exiftool version for Windows EXE bundle.#.# Revisions: Nov. 12/03 - P. Harvey Created.# (See html/history.html for revision history).#.# References: ATV - Alexander Vonk, private communication.#------------------------------------------------------------------------------.use strict;.require 5.004;..my $version = '10.96';..# add our 'lib' directory to the include list BEFORE 'use Image::ExifTool'.my $exeDir;.BEGIN {. # get exe directory. $exeDir = ($0 =~ /(.*)[\\\/]/) ? $1 : '.';. # add lib directory at start of include path. unshift @INC, "$exeDir/lib";. # load or disable config file if specified. if (@ARGV and lc($ARGV[0]) eq '-config') {. shift;. $Image::ExifTool::configFile = shift;. }.}.use Image::ExifTool qw{:Public};..# function prototypes

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\7f720997.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.974894250716047
Encrypted:	false
SSDEEP:	768:X3/x3HZfPnfRHv/5nBBtR8aROd+nQPJEGvQg1fGeJ:X3/x3HZfPnfRHv/5Bx88OiQBQg
MD5:	F7992DB1F844A2D9C263C2627BB8A945
SHA1:	E110B856C647C2CDB1C1C5C0FBB76630F942917B
SHA-256:	5CC5AB3445E73175471EDAA84984B3C94DD638877E585DFF084829AC27D78DC3
SHA-512:	1082EBB1C150F70E18220360B0FC8472530B91AE0C756D64FEBF204F256594A9001C5AE9FAFF5E598EE1652FC218E80D72D64833CA249EC350D10B3004DFBB09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{..W...........#.....`.......... ........p....Tj.......................................... .........................I...........................................................................................................................text....^.......`..................`.P`.data........p.......d..............@.0..rdata...............f..............@.`@.bss..................................`..edata..I............v..............@.0@.idata...............x..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\8787f619.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2151
Entropy (8bit):	5.178726793713288
Encrypted:	false
SSDEEP:	48:kGjof/YCFqcWRZoBvJrLWm5l0Ly76Pqo/5siRtMod:kGjlCFqFboJJXWm5l0O7Q
MD5:	64218F22678E19487632FDA3DF8165CB
SHA1:	8F331D1D1895EE61DA1A0B5EE15842D80ED2F5A9
SHA-256:	BFC12F57754C6336B31F18FC29A93C4740604B5811155EC3A4372F47CD23D641
SHA-512:	BBF5EEFF44C925F79F8B077D16FED2ECC786616EA2A3D4CCAAC5A8A8BD9A98F6BE8E644EF166CC9CDDE9AA016F698FD23906FE942C1868898C244D3D52BC3565
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/FileHandle.pm".package FileHandle;..use 5.006;.use strict;.our($VERSION, @ISA, @EXPORT, @EXPORT_OK);..$VERSION = "2.02";..require IO::File;.@ISA = qw(IO::File);..@EXPORT = qw(_IOFBF _IOLBF _IONBF);..@EXPORT_OK = qw(. pipe.. autoflush. output_field_separator. output_record_separator. input_record_separator. input_line_number. format_page_number. format_lines_per_page. format_lines_left. format_name. format_top_name. format_line_break_characters. format_formfeed.. print. printf. getline. getlines.);..#.# Everything we're willing to export, we must first import..#.import IO::Handle grep { !defined(&$_) } @EXPORT, @EXPORT_OK;..#.# Some people call "FileHandle::function", so all the functions.# that were in the old FileHandle class must be imported, too..#.{. no strict 'refs';.. my %import = (..'IO::Handle' =>.. [qw(DESTROY new_from_fd fdopen close fileno getc ungetc gets...eof flush error clearerr setbuf setvb

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\8b4e2b00.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.565146780074246
Encrypted:	false
SSDEEP:	384:fE1uF2cJshlAB9s+22Kz83cKcnOqAB/BmhzNJCVZhaDA:lshM9sN22OqABQhzNJCVf
MD5:	707F6CD0BA39238095A7CA6925708223
SHA1:	C7B8FDCF4660F28D53F5A53F8D74E63A5495B31D
SHA-256:	FA2960FE31C5DC687D11A93C22DDF03BE20714E7EE038BCEB54EC035CAC086A5
SHA-512:	B88FD8F08AE0833FB86F719B23AD6A58341DF256B11AE5E902662E7038A39604A78FA34FB674D17F04AFBD36CA8FE0DCC12D77B00D0669695806EB1C970ACA50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d..W...........#.........H...... ........@....Xb................................'3........ ......................p..........h............................... .......................................................D............................text....,..........................`.P`.data... ....@.......2..............@.0..rdata.......P.......4..............@.0@.bss.........`........................`..edata.......p.......8..............@.0@.idata..h............:..............@.0..CRT....,............D..............@.0..tls.... ............F..............@.0..reloc.. ............H..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\8fb705b3.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	22609
Entropy (8bit):	4.7043388849600625
Encrypted:	false
SSDEEP:	192:wy4J7DRVG0CHMWn+oNxT2YnWW8fTmrxaOgL6IwShru6D+CeVFhFgacmpW0FetZM8:N4DPCHCegDVuSWVFhiSnVWKeNDave
MD5:	EB5CD59C9DF37ACE8DE1AD077902E004
SHA1:	5A916B51166A862E2CDB21ABEFA7019376572D19
SHA-256:	4DED9777A45BCED63E651E3E74B26F89D00066C1FAF466A1F7BBCD5A6C2CCDE9
SHA-512:	97E1C2B78E323E89DEEA9DD267464FB52CD8952EDD198A8DEE7D699BFBA8EFDF39B59AAA75554E39A27F7DDF9E7C381A6A8477939FEA84D381A848E8594B301F
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/Base.pm"..package IO::Compress::Base ;..require 5.006 ;..use strict ;.use warnings;..use IO::Compress::Base::Common 2.069 ;..use IO::File (); ;.use Scalar::Util ();..#use File::Glob;.#require Exporter ;.use Carp() ;.use Symbol();.#use bytes;..our (@ISA, $VERSION);.@ISA = qw(Exporter IO::File);..$VERSION = '2.069';..#Can't locate object method "SWASHNEW" via package "utf8" (perhaps you forgot to load "utf8"?) at .../ext/Compress-Zlib/Gzip/blib/lib/Compress/Zlib/Common.pm line 16...sub saveStatus.{. my $self = shift ;. ${ $self->{ErrorNo} } = shift() + 0 ;. ${ $self->{Error} } = '' ;.. return ${ $self->{ErrorNo} } ;.}...sub saveErrorString.{. my $self = shift ;. my $retval = shift ;. ${ $self->{Error} } = shift ;. ${ *$self->{ErrorNo} } = shift() + 0 if @_ ;.. return $retval;.}..sub croakError.{. my $self = shift ;. $self->saveErrorString(0, $_[0]);. Carp::croak $_[0];.}..sub closeError.{. my $self = shi

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9063d34b.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.9396760320807935
Encrypted:	false
SSDEEP:	6:TF2pK2MOwsQFa83GY5sFYRanWswYyvswYkw:TFM7wsQU82Y5sFYMWstyvstkw
MD5:	581512DF454B28BC650CBF7CBB18C820
SHA1:	F975BB98FF55B82E076D988DADD14EAFCABF2675
SHA-256:	8B091132F2B7A61F609662268C6888094676FB385CD60365641A6472C89572A3
SHA-512:	E8A5396F54EA850C0121EB8DBF22419E10614BB89360860EC44D4C713F6B89B9CBD0EB8A892069C5BD920B2E3C28BAFA01C839ED8C3136B596FAF6D3BB56A8ED
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/integer.pm".package integer;..our $VERSION = '1.01';..#line 82..$integer::hint_bits = 0x1;..sub import {. $^H \|= $integer::hint_bits;.}..sub unimport {. $^H &= ~$integer::hint_bits;.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\907352b2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1548
Entropy (8bit):	5.029331307999178
Encrypted:	false
SSDEEP:	48:cqSQ9n//ej5v+CEpZkbTCGvpUKD+WD+zMn:cqSQ9n/wBzEpZCCGPDHDpn
MD5:	57F531F484FBEDBA94329C5521A3105C
SHA1:	517ED9CD4DBC1EED271C53B2DBF13D27799F3E17
SHA-256:	3C877649B7C6B3A3CC06F660397250AD9B285DF81606B2BEEFE7ACCBB501E352
SHA-512:	75AFE7116CD3D1A0E6D65D59C2C526490004859CB1D591F105448D8A31B2ABBEF419BE5247F53C11D86259DA83198140435A2308F9A44EAA3DDE58786CE25454
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Encode/Encoding.pm".package Encode::Encoding;..# Base class for classes which implement encodings.use strict;.use warnings;.our $VERSION = do { my @r = ( q$Revision: 2.7 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };..require Encode;..sub DEBUG { 0 }..sub Define {. my $obj = shift;. my $canonical = shift;. $obj = bless { Name => $canonical }, $obj unless ref $obj;.. # warn "$canonical => $obj\n";. Encode::define_encoding( $obj, $canonical, @_ );.}..sub name { return shift->{'Name'} }..sub mime_name{. require Encode::MIME::Name;. return Encode::MIME::Name::get_mime_name(shift->name);.}..# sub renew { return $_[0] }..sub renew {. my $self = shift;. my $clone = bless {%$self} => ref($self);. $clone->{renewed}++; # so the caller can see it. DEBUG and warn $clone->{renewed};. return $clone;.}..sub renewed { return $_[0]->{renewed} \|\| 0 }..*new_sequence = \&renew;..sub needs_lines { 0 }..sub perlio_ok {. eval { require

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9086f052.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	4.595545651350636
Encrypted:	false
SSDEEP:	96:YFf/SoaYOBLQ9VFo3r3W6MRD+40414SBnA7r:YFyoaYqLQ9VFo7G6MF+4vnA7r
MD5:	936CC0A6C1505AB68351D880BF6E66BC
SHA1:	8A9B7AAEE06EFCD977EC86C19402C4F58553ED29
SHA-256:	CEF4062BD337EC8CEAA095C044B355DFC53FEF3124274ADEE753CCD1171FC07A
SHA-512:	8AE0D02FE2CF5247229550DF58E2E6CFDA878DD2398E71AA62912EF22AA3135749DD8741B6893597F287CEA537DBAEFB727C892801CCC6AB3190A522B3D9743B
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Uncompress/Adapter/Inflate.pm".package IO::Uncompress::Adapter::Inflate;..use strict;.use warnings;.#use bytes;..use IO::Compress::Base::Common 2.069 qw(:Status);.use Compress::Raw::Zlib 2.069 qw(Z_OK Z_BUF_ERROR Z_STREAM_END Z_FINISH MAX_WBITS);..our ($VERSION);.$VERSION = '2.069';....sub mkUncompObject.{. my $crc32 = shift \|\| 1;. my $adler32 = shift \|\| 1;. my $scan = shift \|\| 0;.. my $inflate ;. my $status ;.. if ($scan). {. ($inflate, $status) = new Compress::Raw::Zlib::InflateScan. #LimitOutput => 1,. CRC32 => $crc32,. ADLER32 => $adler32,. WindowBits => - MAX_WBITS ;. }. else. {. ($inflate, $status) = new Compress::Raw::Zlib::Inflate. AppendOutput => 1,. LimitOutput => 1,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9a5ed9f6.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	28031
Entropy (8bit):	5.084436300654959
Encrypted:	false
SSDEEP:	768:aMn5YUzdMyTP3IU9dUH2yosTBF4/vNYPgC3sdb4LCfPCpE12/GQytYbxg/a7FRJ+:D5YUzd5TP3IU9dUH2yosTBF4/vNYPgCI
MD5:	C7C6023F22090471A90A0FA605A3E1BB
SHA1:	918BC9BE6A58E3382075D7A49DA818D301F9B692
SHA-256:	A543FADCAD63CEE40A8C1F28CFBCD5CC52D1EC5D84CE1D5EFAF5BEE72E43D7B6
SHA-512:	7C3EB6B5314703F69C6BB88C4052B1FF736A498551C1E3B0FE2607445B3DCAAE6CF568278A6B10345E9AD1C31FFC651590B98738FBE2D528697343A994BE6D74
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Win32.pm".package Win32;..# BEGIN {. use strict;. use vars qw\|$VERSION $XS_VERSION @ISA @EXPORT @EXPORT_OK\|;.. require Exporter;. require DynaLoader;.. @ISA = qw\|Exporter DynaLoader\|;. $VERSION = '0.52';. $XS_VERSION = $VERSION;. $VERSION = eval $VERSION;.. @EXPORT = qw(..NULL..WIN31_CLASS..OWNER_SECURITY_INFORMATION..GROUP_SECURITY_INFORMATION..DACL_SECURITY_INFORMATION..SACL_SECURITY_INFORMATION..MB_ICONHAND..MB_ICONQUESTION..MB_ICONEXCLAMATION..MB_ICONASTERISK..MB_ICONWARNING..MB_ICONERROR..MB_ICONINFORMATION..MB_ICONSTOP. );. @EXPORT_OK = qw(. GetOSName. SW_HIDE. SW_SHOWNORMAL. SW_SHOWMINIMIZED. SW_SHOWMAXIMIZED. SW_SHOWNOACTIVATE.. CSIDL_DESKTOP. CSIDL_PROGRAMS. CSIDL_PERSONAL. CSIDL_FAVORITES. CSIDL_STARTUP. CSIDL_RECENT. CSIDL_SENDTO. CSIDL_STARTMENU. CSIDL_MYMUSIC. CSIDL_MYVIDEO. CSIDL_DESKTOPDIRECTORY.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9e2b3cdd.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.3581909776902625
Encrypted:	false
SSDEEP:	1536:O/bZcrCZIdS0EhZz8taSZsKUw/5G2FANu4+4jxXqDASOhw6KRaAjGRHdGNKFO28x:ibZcGZIs0GzZKF5G2FctOD80flec2I
MD5:	A532ADE5F427A88EADA72EBAD34801A4
SHA1:	7F322E3F8D06E0DF314C488F1DD056971E1B9E96
SHA-256:	A8346E9C165D21A9A99313D32C3704DCAAB01F142C3BE0FBC0DEDD39756E3BD5
SHA-512:	83344E7ECB4197B325735E1CDCF72DFC403711457CF232E61EC34761C58BEB6455B403948B565707F1F31954129E0DEAAFD26E99C81690D1A16AF5104A453585
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..W...........#.....:.......... ........P.....f.................................h........ .................................d.......................................................................................`............................text....8.......:..................`.P`.data........P.......>..............@.0..rdata...B...`...D...@..............@.`@.bss..................................`..edata..............................@.0@.idata..d...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\a09139d7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.309267839947675
Encrypted:	false
SSDEEP:	384:rcMxypKtbmvusult23aBSkdgvlWlwd6ejXl:rNmvusS25kdGlkwdHbl
MD5:	3B6B94455B45924FA688ECAD75EC182C
SHA1:	3FBB2F8F6594185FA8FE006A2A92EBC88B7B7B84
SHA-256:	D3FECA741DDC93F8646E74740BAB7DB17569A7A2594A8FFEA40A73F07B418870
SHA-512:	76BCE5C6810D1D72B6BBF19A81CEB9EA2BC1E6BC9BCD5811AC85BEF29870D44DD00F9E1D702EFA75CD3E6ADE41C9AAB4C95FA9E4DC5E66D3CFBFB62224D5325B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#....."...:...... ........@....`h.................................O........ ......................p..............................................................................................T................................text...$ ......."..................`.P`.data........@.......&..............@.0..rdata..P....P.......(..............@.0@.bss.........`........................`..edata.......p.......,..............@.0@.idata..............................@.0..CRT....,............6..............@.0..tls.... ............8..............@.0..reloc...............:..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\a1570d38.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3388
Entropy (8bit):	5.262077297957315
Encrypted:	false
SSDEEP:	96:8t79V6CB4rkZELjXuwv+bdehWVCHUt07YICuVQD+b1bRbQV9L:VCB4CEHewqd8WA0a7YICuC+ht+N
MD5:	7F8AF43FF96E21875B28BF4BA7733CB9
SHA1:	B534700A2769AA79AE47F2019F99164219B6A7BD
SHA-256:	39C825F52CCD99D7AF53BDF34163FE33763784C77A4A2CC985EB2874503E66E5
SHA-512:	FD5A1917A7EAF2564D83A11C02633E7E777B3FB12BFA8E7E5537585F4BC154CC923C2AD3C00597C47953210F7E5609C801B511B621EFEC1B5E2BFEA76F7CD5F9
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Config.pm".# This file was created by configpm when Perl was built. Any changes..# made to this file will be lost the next time perl is built.....# for a description of the variables, please have a look at the..# Glossary file, as written in the Porting folder, or use the url:..# http://perl5.git.perl.org/perl.git/blob/HEAD:/Porting/Glossary....package Config;..use strict;..use warnings;..use vars '%Config', '$VERSION';....$VERSION = "5.024000";....# Skip @Config::EXPORT because it only contains %Config, which we special..# case below as it's not a function. @Config::EXPORT won't change in the..# lifetime of Perl 5...my %Export_Cache = (myconfig => 1, config_sh => 1, config_vars => 1,.... config_re => 1, compile_date => 1, local_patches => 1,.... bincompat_options => 1, non_bincompat_options => 1,.... header_files => 1);....@Config::EXPORT = qw(%Config);..@Config::EXPORT_OK = keys %Export_Cache;....# Need to stub all the functions to make code such as prin

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\a2f5f87c.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	620
Entropy (8bit):	5.034420642110602
Encrypted:	false
SSDEEP:	12:TFpI3sNeKHSQy4Z8LyiRVRoKlfBFMoMBnp+ID2WlfNZKd99yyvxx:Te5KHSQL8GivRb5BFEBn9D2WlfjyvH
MD5:	9C5BEA50A2EF291566473BE37B82AB6E
SHA1:	42002FC648457A032F2AB3B032353936ABDD2BB4
SHA-256:	1C58105438B614B790BA332B4B3E760A12D637D707EB395922F73E9044F293C5
SHA-512:	043B9A2E641CE7397C236430692C7D8B3D5250FE1B6E8658E62038FF61D70BF35AC0699C9A759D35AC298F36AF9F2D2CCB2128DD08771EB115DEC22A4FB33E65
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/Filter.pm".package PAR::Filter;.use 5.006;.use strict;.use warnings;.our $VERSION = '0.03';..#line 64..sub new {. my $class = shift;. require "PAR/Filter/$_.pm" foreach @_;. bless(\@_, $class);.}..sub apply {. my ($self, $ref, $name) = @_;. my $filename = $name \|\| '-e';.. if (!ref $ref) {..$name \|\|= $filename = $ref;..local $/;..open my $fh, $ref or die $!;..binmode($fh);..my $content = <$fh>;..$ref = \$content;..return $ref unless length($content);. }.. "PAR::Filter::$_"->new->apply( $ref, $filename, $name ) foreach @$self;.. return $ref;.}..1;..#line 106.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\ab8b3e5d.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7469
Entropy (8bit):	5.021808941773792
Encrypted:	false
SSDEEP:	96:qb5YP9sooyhWqW5jfrdx1AW6iHsH3amWngwCRgbeCB7Yr4nm6XI6/gWxp0vXX3:qd4+obWz5jfbl640cnx354II6/gWz6X3
MD5:	F0FE9A781EE0A105F8F66AC431F445F0
SHA1:	9CD4545AFFB2A82AF4014BE45293E9844F1F3785
SHA-256:	C26AF147720B5698A14D5C515DED8F3F1DAC264359332FB4054D3235C0EBC7AE
SHA-512:	F2E5ACC584DF96E73631C9882674562044BCFDC08311F24B9BDBF64A4E2870D3F34375E775ACE8222D00803E7C0C3E43F625047C25005248DD7089EC94D18C17
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Uncompress/Gunzip.pm"..package IO::Uncompress::Gunzip ;..require 5.006 ;..# for RFC1952..use strict ;.use warnings;.use bytes;..use IO::Uncompress::RawInflate 2.069 ;..use Compress::Raw::Zlib 2.069 () ;.use IO::Compress::Base::Common 2.069 qw(:Status );.use IO::Compress::Gzip::Constants 2.069 ;.use IO::Compress::Zlib::Extra 2.069 ;..require Exporter ;..our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, $GunzipError);..@ISA = qw( Exporter IO::Uncompress::RawInflate );.@EXPORT_OK = qw( $GunzipError gunzip );.%EXPORT_TAGS = %IO::Uncompress::RawInflate::DEFLATE_CONSTANTS ;.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');..$GunzipError = '';..$VERSION = '2.069';..sub new.{. my $class = shift ;. $GunzipError = '';. my $obj = IO::Compress::Base::Common::createSelfTiedObject($class, \$GunzipError);.. $obj->_create(undef, 0, @_);.}..sub gunzip.{. my $obj = IO::Compress::Base::Common::createSelfTiedObject(undef, \$GunzipError);. ret

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\aff11a74.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5246
Entropy (8bit):	4.931012737152993
Encrypted:	false
SSDEEP:	96:ElQhNAtP7KoK1YBG3+YYFNPK6gyeHVLxayEj7b/JJdR36K+dZDPWpPrB47zGOk:El+sTlK1YBG3rYFNPK6e1LsyEjBJz6K1
MD5:	28ACBE610722FFAF5CD5BB75E693774F
SHA1:	C3DEDD5E9318DB273121C0A2B09CA371AE958756
SHA-256:	CCBA66786DBA5A94C693FE1459BC895FB392287CE28BD4F811418F71A5CAC4D5
SHA-512:	202878947738D7493460C3855DED123182F560A76A1F58470FD57D0629B4A7197FDCDC0B22EE2752961AAAF4D83791D21935872BC04C33B6C93F5DC86175E4FE
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Time/Local.pm".package Time::Local;..require Exporter;.use Carp;.use Config;.use strict;..use vars qw( $VERSION @ISA @EXPORT @EXPORT_OK );.$VERSION = '1.2300';..@ISA = qw( Exporter );.@EXPORT = qw( timegm timelocal );.@EXPORT_OK = qw( timegm_nocheck timelocal_nocheck );..my @MonthDays = ( 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 );..# Determine breakpoint for rolling century.my $ThisYear = ( localtime() )[5];.my $Breakpoint = ( $ThisYear + 50 ) % 100;.my $NextCentury = $ThisYear - $ThisYear % 100;.$NextCentury += 100 if $Breakpoint < 50;.my $Century = $NextCentury - 100;.my $SecOff = 0;..my ( %Options, %Cheat );..use constant SECS_PER_MINUTE => 60;.use constant SECS_PER_HOUR => 3600;.use constant SECS_PER_DAY => 86400;..my $MaxDay;.if ($] < 5.012000) {. my $MaxInt;. if ( $^O eq 'MacOS' ) {. # time_t is unsigned.... $MaxInt = ( 1 << ( 8 * $Config{ivsize} ) ) - 1;. }. else {. $MaxInt = ( ( 1 << ( 8 * $Config

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\b0050406.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	28881
Entropy (8bit):	4.739523698404894
Encrypted:	false
SSDEEP:	768:7aZ3WSwXAF60JTTdC9O100B702ClHd21TRoAgf:ZRXA1Tva2ClI1TVgf
MD5:	4FAF9860765406DA7A054443ABD210E8
SHA1:	C52960A5A07B5809D01D191D1E95286BE5F16423
SHA-256:	83E1827AF3C74A548CFC32B27E336F2696C02D1FAF0EE5FBC0C5A3426E877CC2
SHA-512:	48F3A968155C45957A8F3A348B14B8BDFB110E6C11BA46E9126936BFBE4976F3D85E2FE60A6054B6D115272395B3B27B5DC3D12F18CFA9FF76BD8C2D52655DF9
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR.pm".package PAR;.$PAR::VERSION = '1.010';..use 5.006;.use strict;.use warnings;.use Config '%Config';.use Carp qw/croak/;..# If the 'prefork' module is available, we.# register various run-time loaded modules with it..# That way, there is more shared memory in a forking.# environment..BEGIN {. if (eval 'require prefork') {. prefork->import($_) for qw/. Archive::Zip. File::Glob. File::Spec. File::Temp. LWP::Simple. PAR::Heavy. /;. # not including Archive::Unzip::Burst which only makes sense. # in the context of a PAR::Packer'ed executable anyway.. }.}..use PAR::SetupProgname;.use PAR::SetupTemp;..#line 311..use vars qw(@PAR_INC); # explicitly stated PAR library files (preferred).use vars qw(@PAR_INC_LAST); # explicitly stated PAR library files (fallback).use vars qw(%PAR_INC); # sets {$par}{$file} for require'd modules.use va

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\b1f1d539.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.11933007634727
Encrypted:	false
SSDEEP:	12:TF8dhhEsQUZe5S9rOe+IONQiaXwsfFN8dj6B:TKdfjQUZP+IOiJXvok
MD5:	988F251E7699E3A850069A2166645E39
SHA1:	72C5FAEBA15DF191A31E962F3276FA388E3F7D9D
SHA-256:	565D54195BF105046C04A4D47C3B2D48FF7B1715CCB383C7F81D7096F3FF7CD4
SHA-512:	68BE2828C49BA2132CB79C56E42BF0E349005E01AA780038DE467A7E2D7606862B2A66276D8A4C8CC6939C1AF4A3F428C0C7975EDF58F1AB044A5C65D3D648F1
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/SelectSaver.pm".package SelectSaver;..our $VERSION = '1.02';..#line 36..require 5.000;.use Carp;.use Symbol;..sub new {. @_ >= 1 && @_ <= 2 or croak 'usage: SelectSaver->new( [FILEHANDLE] )';. my $fh = select;. my $self = bless \$fh, $_[0];. select qualify($_[1], caller) if @_ > 1;. $self;.}..sub DESTROY {. my $self = $_[0];. select $$self;.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\b2f30932.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	733
Entropy (8bit):	5.41545821730517
Encrypted:	false
SSDEEP:	12:TFROFLGDpR4QFqrOQDCK7/OSANd0rGQw/Q0SNZGQfkt12Qy7QbQ5L2H73WKKMYLO:T3OFmpn0QK7murGPorzGrhXbQ5I3W5JC
MD5:	F50A234C2F0EB0B80161070BAE515757
SHA1:	7108BA6460AE6C0CEFE6D74681F44C0D4D3047C7
SHA-256:	D885A1AB803693610AC0861C7BE581CE2D9F0B7E87FDE45F6CCC63AB8C5F719E
SHA-512:	73ECE8FB5BC47B4904F8B61366B54C4D6CA553DD565840722CE8416EE8500EC835C369A06EA1EF7D52E5DB43000824F7521DAF262F0BD856DDD827DA077C07B4
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Seekable.pm".#..package IO::Seekable;..#line 96..use 5.006_001;.use Carp;.use strict;.our($VERSION, @EXPORT, @ISA);.use IO::Handle ();.# XXX we can't get these from IO::Handle or we'll get prototype.# mismatch warnings on C<use POSIX; use IO::File;> :-(.use Fcntl qw(SEEK_SET SEEK_CUR SEEK_END);.require Exporter;..@EXPORT = qw(SEEK_SET SEEK_CUR SEEK_END);.@ISA = qw(Exporter);..$VERSION = "1.10";.$VERSION = eval $VERSION;..sub seek {. @_ == 3 or croak 'usage: $io->seek(POS, WHENCE)';. seek($_[0], $_[1], $_[2]);.}..sub sysseek {. @_ == 3 or croak 'usage: $io->sysseek(POS, WHENCE)';. sysseek($_[0], $_[1], $_[2]);.}..sub tell {. @_ == 1 or croak 'usage: $io->tell()';. tell($_[0]);.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\b8008417.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4877
Entropy (8bit):	4.96772947313154
Encrypted:	false
SSDEEP:	96:HWUtqP2kyrQrhepeYsu8qNGcqe02Ti7O0A2tzUJlBrQ8bxDKMjQ79YYd:z4P2kKQ6su8qD02TizA2tsjrQGxBrYd
MD5:	93C9AA1A67225C4216C582F53DC6A0DC
SHA1:	6B5BE2A0863CFC2C510D0237C8B065FC1B5E5F63
SHA-256:	93D4BD5E9462BFEBDC7CF12F915F6DEB62AA3595CB27A17341E45F5B1F9F79DF
SHA-512:	4CFD5E0FB9228A5B096E24603B5FFF1DCA3B8FD4DF2054B348EDF5B65713E8D9DAD184C5C78D22C69BF986027D27C72F9CDC012EAEF34EE440E7E8DC96453A5D
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/Heavy.pm".package PAR::Heavy;.$PAR::Heavy::VERSION = '0.12';..#line 17..########################################################################.# Dynamic inclusion of XS modules..my ($bootstrap, $dl_findfile); # Caches for code references.my ($cache_key); # The current file to find.my $is_insensitive_fs = (. -s $0. and (-s lc($0) \|\| -1) == (-s uc($0) \|\| -1). and (-s lc($0) \|\| -1) == -s $0.);..# Adds pre-hooks to Dynaloader's key methods.sub _init_dynaloader {. return if $bootstrap;. return unless eval { require DynaLoader; DynaLoader::dl_findfile(); 1 };.. $bootstrap = \&DynaLoader::bootstrap;. $dl_findfile = \&DynaLoader::dl_findfile;.. local $^W;. {'DynaLoader::dl_expandspec'} = sub { return };. {'DynaLoader::bootstrap'} = \&_bootstrap;. *{'DynaLoader::dl_findfile'} = \&_dl_findfile;.}..# Return the cached location of .dll inside PAR first, if possible..sub _dl_findfile {. return $

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\b9ab5c31.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6456
Entropy (8bit):	5.149614768712312
Encrypted:	false
SSDEEP:	192:gEfOHViyR9CMGd4PjyjrwLsgvna8oxMCQl6C:gaCiyniKmjMLsgvnanxFWj
MD5:	7CE589410DDE5B3AFFBD133690565EAA
SHA1:	2B1B43CFD2CA289D3CF0E51C64A085CF52B9A436
SHA-256:	990E62476D3F25FD2C7939761D1658C0ECEAEAB98EC64A90A4693230CB707E92
SHA-512:	2590CED71CCAAD49C6E250CCE423DDDADCB66FE2BFE6A008BB2EAF2CCECFF98E8990F0A9F9F420363B7956FD96D5396E95D76A05C61A7E4130B037DD240A9A0B
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Exporter/Heavy.pm".package Exporter::Heavy;..use strict;.no strict 'refs';..# On one line so MakeMaker will see it..require Exporter; our $VERSION = $Exporter::VERSION;..#line 22..#.# We go to a lot of trouble not to 'require Carp' at file scope,.# because Carp requires Exporter, and something has to give..#..sub _rebuild_cache {. my ($pkg, $exports, $cache) = @_;. s/^&// foreach @$exports;. @{$cache}{@$exports} = (1) x @$exports;. my $ok = \@{"${pkg}::EXPORT_OK"};. if (@$ok) {..s/^&// foreach @$ok;..@{$cache}{@$ok} = (1) x @$ok;. }.}..sub heavy_export {.. # Save the old __WARN__ handler in case it was defined. my $oldwarn = $SIG{__WARN__};.. # First make import warnings look like they're coming from the "use".. local $SIG{__WARN__} = sub {..# restore it back so proper stacking occurs..local $SIG{__WARN__} = $oldwarn;..my $text = shift;..if ($text =~ s/ at \SExporter\S.pm line \d+.*\n//) {.. require Carp;.. local $Carp::CarpL

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bb11a8f0.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	47006
Entropy (8bit):	4.7876131480203865
Encrypted:	false
SSDEEP:	768:l9/m4You+BhjIeuvRdVJVWRlvCj7jq96QMnuuDq1w7cSvonO7OgHP858d5:nxnIeuvhbWR6dQMnfOwAcoZukK5
MD5:	BC0F4F4B2AA2E78B6D793DA9F7BA6B17
SHA1:	8D47DBCFE58B4D28F99182E281C20B2E3C76638A
SHA-256:	14BC5E0B6A1121286D83827CBD287553D8BF9E9BDAFF63F5FFDDBFE90EE6A160
SHA-512:	B0B7144C0E227F67CC8C14AAEB2A24FE76FBFF4587E677B47CC68DE507B778CD3A4480B869F23C7BBB26CBE4D8A46BA3EF964A826D39C0D9FAB5AE8390C4A022
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Temp.pm".package File::Temp;.# ABSTRACT: return name and handle of a temporary file safely.our $VERSION = '0.2304'; # VERSION...# Toolchain targets v5.8.1, but we'll try to support back to v5.6 anyway..# It might be possible to make this v5.5, but many v5.6isms are creeping.# into the code and tests..use 5.006;.use strict;.use Carp;.use File::Spec 0.8;.use Cwd ();.use File::Path 2.06 qw/ rmtree /;.use Fcntl 1.03;.use IO::Seekable; # For SEEK_*.use Errno;.use Scalar::Util 'refaddr';.require VMS::Stdio if $^O eq 'VMS';..# pre-emptively load Carp::Heavy. If we don't when we run out of file.# handles and attempt to call croak() we get an error message telling.# us that Carp::Heavy won't load rather than an error telling us we.# have run out of file handles. We either preload croak() or we.# switch the calls to croak from _gettemp() to use die..eval { require Carp::Heavy; };..# Need the Symbol package if we are running older perl.require Symbol if $]

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bbb12565.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9518
Entropy (8bit):	4.938601997656733
Encrypted:	false
SSDEEP:	192:4dueoCyJDnZBC6yiYprQxFE5MECyPC7OFn6cIPR8gI6hBOkx0V583P:4duH/WISLsOvY3P
MD5:	44822EC6A8340EB4E49891D489A4B6CB
SHA1:	F72E7500C7ED484DB1A79C1C904F8F03B40EEA08
SHA-256:	1D83E0C23C91875180D1B5B4D2FCEB9F95A26836C4FDA7FE0CC7A5675A2DB19C
SHA-512:	22A6B3A7315DAE0870EFCBDABA3BE7F5382E5CAF85AE1512D31DF97980AC045A51CC61D30281E5E170B26BE482C0253B408A384B3AA1C82FFC13D2F03B7DADBD
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Encode/Alias.pm".package Encode::Alias;.use strict;.use warnings;.no warnings 'redefine';.our $VERSION = do { my @r = ( q$Revision: 2.20 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };.use constant DEBUG => !!$ENV{PERL_ENCODE_DEBUG};..use Exporter 'import';..# Public, encouraged API is exported by default..our @EXPORT =. qw (. define_alias. find_alias.);..our @Alias; # ordered matching list.our %Alias; # cached known aliases..sub find_alias {. require Encode;. my $class = shift;. my $find = shift;. unless ( exists $Alias{$find} ) {. $Alias{$find} = undef; # Recursion guard. for ( my $i = 0 ; $i < @Alias ; $i += 2 ) {. my $alias = $Alias[$i];. my $val = $Alias[ $i + 1 ];. my $new;. if ( ref($alias) eq 'Regexp' && $find =~ $alias ) {. DEBUG and warn "eval $val";. $new = eval $val;. DEBUG and $@ and warn "$val, $@";. }.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bc3918b8.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.656581726826691
Encrypted:	false
SSDEEP:	384:f7ExypKw9VFsca1uNDveFFkayfrmbgr7GDL7jp9dSci48eHl:fp3scQuN7eXkangrQLlSR4B
MD5:	B5915CE10B208305ADE35E9E336F8547
SHA1:	9FB2888E33D3CFB02C3BD1ADBAA79E5B8B6CBFB3
SHA-256:	AD40E880026B5E3C4C66FD1542D1786C79C3F8523E9D3A65CA22A4D74FAB0643
SHA-512:	04C5D399A4AA848EA7580A806B06CE2AC1108EB1C5644F2D8794B32C8A04846A62838AFF198A09D56F33648134BEB65353806B23EE8336C050A91B6FB3F4E1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#..... ...B...... ........0.....f.......................................... ......................`.......p......................................................................................\q...............................text............ ..................`.P`.data........0.......$..............@.0..rdata.......@.......&..............@.`@.bss.........P........................`..edata.......`.......4..............@.0@.idata.......p.......6..............@.0..CRT....,............>..............@.0..tls.... ............@..............@.0..reloc...............B..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bf6d9a1a.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16943
Entropy (8bit):	4.777234945725361
Encrypted:	false
SSDEEP:	384:cPRSIVMTA0UtOK3F1W2rgyg257Ufbsz1ogXQXJJkCsUTchTt3HP0k:cPR30A0UtOYF1W2rgyg257UfbszegXQm
MD5:	FEA182D1143B2F270FD38A714DFEC242
SHA1:	F7BAEC32BF1A4B17823B9F280EA821086254BAC2
SHA-256:	8620CCF935684B552EA943BD5AD38EB0051236AB8424EFC0EFC1AC513386AF82
SHA-512:	321A46B6B1F35A6E83FC4FFDA712EFB4BBAAF023D4C522617C85234E1ACD6D93E7B56A0617FD6B0D7890A0CED4C316ED95BD329674A4100BBB24D0942029423F
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Compress/Raw/Zlib.pm"..package Compress::Raw::Zlib;..require 5.006 ;.require Exporter;.use Carp ;..use strict ;.use warnings ;.use bytes ;.our ($VERSION, $XS_VERSION, @ISA, @EXPORT, %EXPORT_TAGS, @EXPORT_OK, $AUTOLOAD, %DEFLATE_CONSTANTS, @DEFLATE_CONSTANTS);..$VERSION = '2.069';.$XS_VERSION = $VERSION; .$VERSION = eval $VERSION;..@ISA = qw(Exporter);.%EXPORT_TAGS = ( flush => [qw{ . Z_NO_FLUSH. Z_PARTIAL_FLUSH. Z_SYNC_FLUSH. Z_FULL_FLUSH. Z_FINISH. Z_BLOCK. }],. level => [qw{ . Z_NO_COMPRESSION. Z_BEST_SPEED. Z_BEST_COMPRESSION. Z_DEFAULT_COMPRESSION.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\c085c1f8.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	22277
Entropy (8bit):	4.981465816686292
Encrypted:	false
SSDEEP:	384:jiwg6lz9EHY4Vtxz9eV+IdliPHOg2Knc1LHnAcZFbTyTRmULq6:jib6lBE44VZQMX
MD5:	CBA2F8570EEF9FA564E70FCA2B904A83
SHA1:	98A520754289F1840CEA021105943FC979B48782
SHA-256:	E92227F808CF994295BFB815BCDB38C1FFF1B9B11ABD806D12973722DAF0F0B4
SHA-512:	7E0B9EA9194F4F595331457CD4C46D58271D7A5CDCC47FE78F923FA6E50A123622B6C0281D6F46D556F38F4858D279C4858DBB58D51711E8C8E4E8568D1FA8C7
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Find.pm".package File::Find;.use 5.006;.use strict;.use warnings;.use warnings::register;.our $VERSION = '1.34';.require Exporter;.require Cwd;..our @ISA = qw(Exporter);.our @EXPORT = qw(find finddepth);...use strict;.my $Is_VMS;.my $Is_Win32;..require File::Basename;.require File::Spec;..# Should ideally be my() not our() but local() currently.# refuses to operate on lexicals..our %SLnkSeen;.our ($wanted_callback, $avoid_nlink, $bydepth, $no_chdir, $follow,. $follow_skip, $full_check, $untaint, $untaint_skip, $untaint_pat,. $pre_process, $post_process, $dangling_symlinks);..sub contract_name {. my ($cdir,$fn) = @_;.. return substr($cdir,0,rindex($cdir,'/')) if $fn eq $File::Find::current_dir;.. $cdir = substr($cdir,0,rindex($cdir,'/')+1);.. $fn =~ s\|^\./\|\|;.. my $abs_name= $cdir . $fn;.. if (substr($fn,0,3) eq '../') {. 1 while $abs_name =~ s!/[^/]*/\.\./+!/!;. }.. return $abs_name;.}..sub PathCombine($$) {. my ($Base,$N

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\c314314f.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	5.296826735590187
Encrypted:	false
SSDEEP:	6:TF2HBettQl0CUsFYusQFa4dln0dUswYyd3UswYwyFoWeT7CFqlQ00wQy0+VAKkmE:TFweG03sFYusQU4D0ystyystwlxGFqlm
MD5:	2F8B28D88F9F16F55DE9519863B7EB4D
SHA1:	F96A0734FE3E2BE0BE5F812F221996E9BE9BD06F
SHA-256:	4B8C6705A95C91DA33D4C2E6C59FA4ABBF1E3355791C041B03D7258FA7C5D5DF
SHA-512:	902BB1E0132A190C4C80DFB426DF005DFCE54616DC2E0315C1C77EDA2675D433EF0C4394D266084495BA3931250DC55FACFAECAC8F0744FB8A86EDB08B4B43D0
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/utf8.pm".package utf8;..$utf8::hint_bits = 0x00800000;..our $VERSION = '1.19';..sub import {. $^H \|= $utf8::hint_bits;.}..sub unimport {. $^H &= ~$utf8::hint_bits;.}..sub AUTOLOAD {. require "utf8_heavy.pl";. goto &$AUTOLOAD if defined &$AUTOLOAD;. require Carp;. Carp::croak("Undefined subroutine $AUTOLOAD called");.}..1;.__END__..#line 246.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\c67b85ca.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	5.099167222483091
Encrypted:	false
SSDEEP:	48:0zygneQskObQkVYmCA8lcgIBsMdWAt3eSW3VbNp0jJNQAt3chdg63D/RGfv3P0Mf:0zygneQzObQYD82gIB7v3fW3VbNyjZ3j
MD5:	F1542E219E189D36010094FA0052E3D3
SHA1:	DB7D5861E32CB5F402670D53B7B79E0F20AF0E59
SHA-256:	BA16D2BA7504CE8541251720F91EFE071B5AF49F361F152F11960BA597D5DC5B
SHA-512:	75CCB2607ED28662577749F0A86472DA7DF076FBA17092BAA6B8710A49A73DEB838C4D6508A55CBCF15C8CDC7E0084F4433561F6B11E37AAB8D70031B8233DBF
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/lib.pm".package lib;....# THIS FILE IS AUTOMATICALLY GENERATED FROM lib_pm.PL...# ANY CHANGES TO THIS FILE WILL BE OVERWRITTEN BY THE NEXT PERL BUILD.....use Config;....use strict;....my $archname = $Config{archname};..my $version = $Config{version};..my @inc_version_list = reverse split / /, $Config{inc_version_list};......our @ORIG_INC = @INC;.# take a handy copy of 'original' value..our $VERSION = '0.63';....sub import {.. shift;.... my %names;.. foreach (reverse @_) {...my $path = $_;..# we'll be modifying it, so break the alias...if ($path eq '') {... require Carp;... Carp::carp("Empty compile time value given to use lib");...}.....if ($path !~ /\.par$/i && -e $path && ! -d _) {... require Carp;... Carp::carp("Parameter to use lib must be directory, not file");...}...unshift(@INC, $path);...# Add any previous version directories we found at configure time...foreach my $incver (@inc_version_list)...{... my $dir = "$path/

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\c6bedb53.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10263
Entropy (8bit):	4.882601142261936
Encrypted:	false
SSDEEP:	192:jJ5Mmaq9XbCPUQox49lQxTQt5QLcSMKmoQ1C4MtVhe8ww5TZfpQZjvi4Agh8HKBd:jJOA01D+8QNcjvipghUdvc
MD5:	BC2D803B75230F28A438C12A9B6B8007
SHA1:	FBB1A744F2B6305150139C8CDB493310E8AB9D39
SHA-256:	6367DA0D740D9188B64D9F22E7A0A28B7FB0B3552BF2C9EB61F47C0B962E3AC2
SHA-512:	6FE5A4DF3B5AAAA74029A5289F19D44C5036DFA24B4AAAC85A99EEC76A87603C4CE3A60068F523A9B12842A42983A4C58F273C2BA8F523A037076E8900DADA6F
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Spec/Unix.pm".package File::Spec::Unix;..use strict;.use vars qw($VERSION);..$VERSION = '3.63';.my $xs_version = $VERSION;.$VERSION =~ tr/_//d;..#dont try to load XSLoader and DynaLoader only to ultimately fail on miniperl.if(!defined &canonpath && defined &DynaLoader::boot_DynaLoader) {. eval {#eval is questionable since we are handling potential errors like. #"Cwd object version 3.48 does not match bootstrap parameter 3.50. #at lib/DynaLoader.pm line 216." by having this eval. if ( $] >= 5.006 ) {..require XSLoader;..XSLoader::load("Cwd", $xs_version);. } else {..require Cwd;. }. };.}..#line 57..sub _pp_canonpath {. my ($self,$path) = @_;. return unless defined $path;. . # Handle POSIX-style node names beginning with double slash (qnx, nto). # (POSIX says: "a pathname that begins with two successive slashes. # may be interpreted in an implementation-defined manner, although. # more than two leading slashes shall

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\c7a3bee2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	5.231065816543672
Encrypted:	false
SSDEEP:	48:IUxL/8rd4J8QJCAA8fMyhlt29XalxPF9IacSFH1nGo/FBOw:Iq/4WJ8w3tCsFfIacS5tN/vOw
MD5:	F745BCDD16D9B4CD01BB1D01128E4671
SHA1:	99568544414F4B9E678710A47F8D4D4E682A1746
SHA-256:	BCCA75B36BBD14E6C53EC602CBE5822BFAB362ABBCFB442736847EEC198FCDE2
SHA-512:	7F35531FB8E9D1A7DB160C4FBD307E5B2C3346E2534D9505C3345A53D05C174134B0C8BD37735E6F3F816E41FB44BB80349D41F058972DB95CA4BAD51778635F
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Symbol.pm".package Symbol;..#line 80..BEGIN { require 5.005; }..require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(gensym ungensym qualify qualify_to_ref);.@EXPORT_OK = qw(delete_package geniosym);..$VERSION = '1.07';..my $genpkg = "Symbol::";.my $genseq = 0;..my %global = map {$_ => 1} qw(ARGV ARGVOUT ENV INC SIG STDERR STDIN STDOUT);..#.# Note that we never _copy_ the glob; we just make a ref to it..# If we did copy it, then SVf_FAKE would be set on the copy, and.# glob-specific behaviors (e.g. C<$ref = \&func>) wouldn't work..#.sub gensym () {. my $name = "GEN" . $genseq++;. my $ref = \{$genpkg . $name};. delete $$genpkg{$name};. $ref;.}..sub geniosym () {. my $sym = gensym();. # force the IO slot to be filled. select(select $sym);. *$sym{IO};.}..sub ungensym ($) {}..sub qualify ($;$) {. my ($name) = @_;. if (!ref($name) && index($name, '::') == -1 && index($name, "'") == -1) {..my $pkg;..# Global names: special character, "^xyz"

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\d24ed0ef.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3197
Entropy (8bit):	4.760211539732808
Encrypted:	false
SSDEEP:	48:0y6WWsvtZIjXoLZfah3akpVM/ooJ25B2J2bsmJ23U0UOUz2P:0yzWGt2afa0KVM/ou2Q2gs2M2P
MD5:	8CB8723FCA9DE8AF5FD1C82ADE7FA5F7
SHA1:	D9F1F5C39052CF4C14C103CE9842D1D18FAB2B3E
SHA-256:	A67DEBD3288FFBD3184A1004EA28D31A20B6EF19FD6600FE820B569C240774EF
SHA-512:	42886352B12EC292C242C631E7352247B6F8FF74F0EAEB5CE9D9864DEEC8D4BA6709B6A713445B0A37A1FB92A2998CC948860BA28536BC013FBE1727B744B207
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/Adapter/Deflate.pm".package IO::Compress::Adapter::Deflate ;..use strict;.use warnings;.use bytes;..use IO::Compress::Base::Common 2.069 qw(:Status);.use Compress::Raw::Zlib 2.069 qw( !crc32 !adler32 ) ;. .require Exporter; .our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, @EXPORT, %DEFLATE_CONSTANTS);..$VERSION = '2.069';.@ISA = qw(Exporter);.@EXPORT_OK = @Compress::Raw::Zlib::DEFLATE_CONSTANTS;.%EXPORT_TAGS = %Compress::Raw::Zlib::DEFLATE_CONSTANTS;.@EXPORT = @EXPORT_OK;.%DEFLATE_CONSTANTS = %EXPORT_TAGS ;..sub mkCompObject.{. my $crc32 = shift ;. my $adler32 = shift ;. my $level = shift ;. my $strategy = shift ;.. my ($def, $status) = new Compress::Raw::Zlib::Deflate. -AppendOutput => 1,. -CRC32 => $crc32,. -ADLER32 => $adler32,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\d41d2520.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3955
Entropy (8bit):	4.9817015168373935
Encrypted:	false
SSDEEP:	96:zijHjI3uT33lhcPVroHQ9ZEkHm0q2NgzfhFCmoNRoVxo1NC2FCy:zmHBlGdr0QHbHm92NgzfhFCtNRYy1Uzy
MD5:	C7F206662327CD3E7628700C520854B3
SHA1:	FE11513FAC780CE746609EF823D45B7C0ED5502F
SHA-256:	9F93AF05705287C45A215D51E15F3D42D86DD6D91C416CF7EF07BA69A6B12040
SHA-512:	11D0BFF15DDE85A8B5BD233A868B02459C9BFAE9BB10DBA160A74373AC1DBF4E266AB285ED95121AB9BCDDF7A6E42D4D39886ED2D7984713D75BBEF2F7938F4E
Malicious:	false
Preview:	#line 1 "C:/Perl/site/lib/PAR/SetupTemp.pm".package PAR::SetupTemp;.$PAR::SetupTemp::VERSION = '1.002';..use 5.006;.use strict;.use warnings;..use Fcntl ':mode';..use PAR::SetupProgname;..#line 31..# for PAR internal use only!.our $PARTemp;..# name of the canary file.our $Canary = "_CANARY_.txt";.# how much to "date back" the canary file (in seconds).our $CanaryDateBack = 24 * 3600; # 1 day..# The C version of this code appears in myldr/mktmpdir.c.# This code also lives in PAR::Packer's par.pl as _set_par_temp!.sub set_par_temp_env {. PAR::SetupProgname::set_progname(). unless defined $PAR::SetupProgname::Progname;.. if (defined $ENV{PAR_TEMP} and $ENV{PAR_TEMP} =~ /(.+)/) {. $PARTemp = $1;. return;. }.. my $stmpdir = _get_par_user_tempdir();. die "unable to create cache directory" unless $stmpdir;.. require File::Spec;. if (!$ENV{PAR_CLEAN} and my $mtime = (stat($PAR::SetupProgname::Progname))[9]) {. my $ctx = _get_digester();.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\d4702f47.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10454
Entropy (8bit):	4.732673726862704
Encrypted:	false
SSDEEP:	192:q4SjhHMYkEKgcQljyiQvz8MQgQy3iQfRxZNrVO09ukC9R7jXC5utoCkxK04eds3X:jSjF4WgT7vDO0GKC6zrIX
MD5:	C4C7A5292010AE994AA11FF640281FD2
SHA1:	977C2395E6A65B8154830BC9BA561565F04C9800
SHA-256:	83EFA289369D7F74BB228B27808C0BB6358F3738DC0BA1FA92148CD6C1BC0A0F
SHA-512:	18F8F68E83E6B88E6D1F8BB06ACBACCCF3126D2A5CE365EE1CFF1D89053907B03370CA1100BA2AA4E30091D0027D227095868FAAA1690DC607A85F82399CF408
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Encode.pm".#.# $Id: Encode.pm,v 2.82 2016/02/06 20:16:42 dankogai Exp $.#.package Encode;.use strict;.use warnings;.our $VERSION = sprintf "%d.%02d", q$Revision: 2.82 $ =~ /(\d+)/g;.use constant DEBUG => !!$ENV{PERL_ENCODE_DEBUG};.use XSLoader ();.XSLoader::load( __PACKAGE__, $VERSION );..use Exporter 5.57 'import';..# Public, encouraged API is exported by default..our @EXPORT = qw(. decode decode_utf8 encode encode_utf8 str2bytes bytes2str. encodings find_encoding clone_encoding.);.our @FB_FLAGS = qw(. DIE_ON_ERR WARN_ON_ERR RETURN_ON_ERR LEAVE_SRC. PERLQQ HTMLCREF XMLCREF STOP_AT_PARTIAL.);.our @FB_CONSTS = qw(. FB_DEFAULT FB_CROAK FB_QUIET FB_WARN. FB_PERLQQ FB_HTMLCREF FB_XMLCREF.);.our @EXPORT_OK = (. qw(. _utf8_off _utf8_on define_encoding from_to is_16bit is_8bit. is_utf8 perlio_ok resolve_alias utf8_downgrade utf8_upgrade. ),. @FB_FLAGS, @FB_CONSTS,.);..our %EXPORT_TAGS = (. all => [ @EXPORT, @EXPORT_OK ],. d

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\d93ed23f.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	15897
Entropy (8bit):	4.806581521162563
Encrypted:	false
SSDEEP:	384:VoRzVdRjvXESeM+p6IB0LXW4NLHBnkBnOS80Cdv6+jE9/zSeP+b0:VoRxdRzUDM+p6IB0LXW4NFkaljEFdPm0
MD5:	8A83E446AC883938A67253415ED59B24
SHA1:	38DA3513B9FFC503C96282DB0C8F8F0E3EC91146
SHA-256:	8BB22F982FB7CA16B6F9E14A4E10220E172383A400B251C9D7B7C91E47E6A841
SHA-512:	1881D6779B307F9853308DC89B6A352AA017FE0631F0B283A1A7AB25A176939CEB2B1E8C7834BAF222499033827E6582C8195C2E217F6F048700BC3D0B6A3CC1
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Compress/Zlib.pm"..package Compress::Zlib;..require 5.006 ;.require Exporter;.use Carp ;.use IO::Handle ;.use Scalar::Util qw(dualvar);..use IO::Compress::Base::Common 2.069 ;.use Compress::Raw::Zlib 2.069 ;.use IO::Compress::Gzip 2.069 ;.use IO::Uncompress::Gunzip 2.069 ;..use strict ;.use warnings ;.use bytes ;.our ($VERSION, $XS_VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);..$VERSION = '2.069';.$XS_VERSION = $VERSION; .$VERSION = eval $VERSION;..@ISA = qw(Exporter);.# Items to export into callers namespace by default. Note: do not export.# names by default without a very good reason. Use EXPORT_OK instead..# Do not simply export all your public functions/methods/constants..@EXPORT = qw(. deflateInit inflateInit.. compress uncompress.. gzopen $gzerrno. );..push @EXPORT, @Compress::Raw::Zlib::EXPORT ;..@EXPORT_OK = qw(memGunzip memGzip zlib_version);.%EXPORT_TAGS = (. ALL => \@EXPORT.);..BEGIN.{. *zlib_version = \&Compres

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\db3a8f47.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21619
Entropy (8bit):	4.638391130743563
Encrypted:	false
SSDEEP:	192:fspqfWO3DzdF/x7czS45Cgk8v4BRWyzy5YdkYWoxjjrPb5oRzRQRIRE4:f4ZQ9F/x4G+CvWVswW0NyKE4
MD5:	44805CDE6A6B41E34D1CFE88452CBFCE
SHA1:	82EE19951828E4864694B954ADF04A1A91BED3DD
SHA-256:	F93FE254786F63D5A527F05BFD48A6B6A3FC5DD383420129C3AA0C736FD3BF5D
SHA-512:	69AD4626A06F5AA66E521B6475E267A7C90D12D5525918BD7F1A793C23477E2E85F5AA9D2613A1A24549B46FACDAF898859BFD4F5405D1A76B4BB2509FB6D5F6
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/warnings.pm".# -- buffer-read-only: t --.# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!.# This file is built by regen/warnings.pl..# Any changes made here will be lost!..package warnings;..our $VERSION = "1.36";..# Verify that we're called correctly so that warnings will work..# Can't use Carp, since Carp uses us!.# String regexps because constant folding = smaller optree = less memory vs regexp literal.# see also strict.pm..die sprintf "Incorrect use of pragma '%s' at %s line %d.\n", __PACKAGE__, +(caller)[1,2]. if __FILE__ !~ ( '(?x) \b '.__PACKAGE__.' \.pmc? \z' ). && __FILE__ =~ ( '(?x) \b (?i:'.__PACKAGE__.') \.pmc? \z' );..our %Offsets = (. # Warnings Categories added in Perl 5.008. 'all'....=> 0,. 'closure'....=> 2,. 'deprecated'...=> 4,. 'exiting'....=> 6,. 'glob'....=> 8,. 'io'....=> 10,. 'closed'....=> 12,. 'exec'....=> 14,. 'layer'....=> 16,. 'newline'....=> 18,. 'pipe'....=> 20,. 'unopened'....=> 22,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\de029105.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	451
Entropy (8bit):	5.17395508445928
Encrypted:	false
SSDEEP:	12:TF7qD45TVsQVPYQDp10elBwYcLGJAaXrM/lLzKXB3:T8qT2QpYQdqesLeAqrM/4R3
MD5:	40EF413F0A595F7C4F28DFB96A0C5351
SHA1:	BF806A0DAA002985CD310A29C88CC07F92A5E302
SHA-256:	286BB803C26B302FAEF4A4FB0D4924D9997D42E1764A647647B67E9BF71A5146
SHA-512:	5C61E866EDE64A850D8A66D514B93D95CF88978C0B3536E420AAE83F78C3636AA5FB21D9B504F7AF8B50E94F2F0271DD7B30BB77EA883A51B705367D76CAC288
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO.pm".#..package IO;..use XSLoader ();.use Carp;.use strict;.use warnings;..our $VERSION = "1.36";.XSLoader::load 'IO', $VERSION;..sub import {. shift;.. warnings::warnif('deprecated', qq{Parameterless "use IO" deprecated}). if @_ == 0 ;. . my @l = @_ ? @_ : qw(Handle Seekable File Pipe Socket Dir);.. eval join("", map { "require IO::" . (/(\w+)/)[0] . ";\n" } @l)..or croak $@;.}..1;..__END__..#line 68..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e5acedbf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.401442762539576
Encrypted:	false
SSDEEP:	384:VK5Othi5BA62gh0scml6Aqk7BCRopoUG89hej:qt2AMAqk7BCRopoUG89w
MD5:	8AB3CDA349CB7B08D5B072587AE2721F
SHA1:	7EB84454AC4BC688ED398438ECF14130A1FF4942
SHA-256:	26F03B8D47D94A478728EFD0DEBB1F90C8CEFDC25AF54B8D624BF2848E2784C6
SHA-512:	E865BA45D0382DB5750298C57C119C7E204F7DAC9E343FCF785210CE6373EDD5E98BBDE5078315E1BF2BF87A229F685057C2882037FEC156E00C09A2FF9EBB46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#..... ...8...... ........0.....b......................................... ......................`.......p..x...............................p...................................................Lq...............................text............ ..................`.P`.data........0.......$..............@.0..rdata.......@.......&..............@.0@.bss.........P........................`..edata.......`.......*..............@.0@.idata..x....p.......,..............@.0..CRT....,............4..............@.0..tls.... ............6..............@.0..reloc..p............8..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e65dd41e.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	540
Entropy (8bit):	4.988138096695623
Encrypted:	false
SSDEEP:	12:TFyLJfnwBGsQUzMEAqXN56R6lz2KIFMXQlVBt6A4JhfnwGB96nwGBYM+HwJv:T4JwBhQUwEAqdC6plIJRMAOwWgwWh+H8
MD5:	9FA4D4D95FD5FBF3AE7DF6D831A9BC21
SHA1:	AA64B3ABA73C9BD9FB39401EA8AB9B7546A97500
SHA-256:	00FF2EB0D52B2C9533E2AA29C85F710B02469FE0FFC08495E33C54E18D640DE8
SHA-512:	AE5268505420EB0BF90AA6963E9036F8E02AE1EC598BFB3C498822869BFBBD18EBD0262DB3C7746BF3669B48FD6850CD70FFEE153C9222F085DA8505033B6FA9
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/warnings/register.pm".package warnings::register;..our $VERSION = '1.04';.require warnings;..# left here as cruft in case other users were using this undocumented routine.# -- rjbs, 2010-09-08.sub mkMask.{. my ($bit) = @_;. my $mask = "";.. vec($mask, $bit, 1) = 1;. return $mask;.}..sub import.{. shift;. my @categories = @_;.. my $package = (caller(0))[0];. warnings::register_categories($package);.. warnings::register_categories($package . "::$_") for @categories;.}.1;.__END__..#line 47.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e8ce9e63.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.649395333316567
Encrypted:	false
SSDEEP:	384:whY3bHejSRGOIZlMRZXUcEKzjuJruGsiywPv9QO4HjzS:wwXUD+jC7ywPv9GDz
MD5:	0708E9C00B837F9FFB609802A0DFC554
SHA1:	17C9B11FC9BA756C4AD1151FD1DBECF78872DFF6
SHA-256:	16E220DE234AFAD379BD5AE434542DF2ADA7100AE47E14A97797F3491CA903AD
SHA-512:	83137FD0009C756D204B3992579A81ED79E1D95C795CED9DC84E0CFDEFA9621963D449ECE249A77106C5AE1B0DD9C295F521D435E288D2E5B9E4AD438257A3A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........#.....2...P...... ........P....Lg................................D......... .................................,.......................................................................................X............................text...$1.......2..................`.P`.data........P.......6..............@.0..rdata..`....`.......8..............@.0@.bss.........p........................`..edata...............>..............@.0@.idata..,............@..............@.0..CRT....,............L..............@.0..tls.... ............N..............@.0..reloc...............P..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\eb2860e2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3955
Entropy (8bit):	4.993696763131946
Encrypted:	false
SSDEEP:	48:V72lbXFpqhfzuYLTgeu7WS8phRFimkkCS1Vk86pZTGXpgdO8jisnxim0t6IcuEMS:IlLZmL20fsnR0E8M
MD5:	A4F1C35BE4031E3C5CB8690B80802D50
SHA1:	D95068201641EA1BF84A54C7CE25BA205A8EC174
SHA-256:	B480664C4C0BBF901F468FBBE845F0F7F0FA646A150458E6D7CF0EA8A1A2CB20
SHA-512:	A4AF26D7F4B464A94CBE3DAFBB9FFA941B48209F2F52704A257CE73AEDC31857D388ADA059A315DB69F722D0BB179738597B2999CA27E5C568A9B5A63CF98E1E
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/Gzip/Constants.pm".package IO::Compress::Gzip::Constants;..use strict ;.use warnings;.use bytes;..require Exporter;..our ($VERSION, @ISA, @EXPORT, %GZIP_OS_Names);.our ($GZIP_FNAME_INVALID_CHAR_RE, $GZIP_FCOMMENT_INVALID_CHAR_RE);..$VERSION = '2.069';..@ISA = qw(Exporter);..@EXPORT= qw(.. GZIP_ID_SIZE. GZIP_ID1. GZIP_ID2.. GZIP_FLG_DEFAULT. GZIP_FLG_FTEXT. GZIP_FLG_FHCRC. GZIP_FLG_FEXTRA. GZIP_FLG_FNAME. GZIP_FLG_FCOMMENT. GZIP_FLG_RESERVED.. GZIP_CM_DEFLATED.. GZIP_MIN_HEADER_SIZE. GZIP_TRAILER_SIZE.. GZIP_MTIME_DEFAULT. GZIP_XFL_DEFAULT. GZIP_FEXTRA_HEADER_SIZE. GZIP_FEXTRA_MAX_SIZE. GZIP_FEXTRA_SUBFIELD_HEADER_SIZE. GZIP_FEXTRA_SUBFIELD_ID_SIZE. GZIP_FEXTRA_SUBFIELD_LEN_SIZE. GZIP_FEXTRA_SUBFIELD_MAX_SIZE.. $GZIP_FNAME_INVALID_CHAR_RE. $GZIP_FCOMMENT_INVALID_CHAR_RE.. GZIP_FHCRC_SIZE.. GZIP_ISIZE_MAX. GZIP_ISIZE_MOD_VALUE... GZIP_NULL_BYTE.. GZIP_OS_DEFAULT.. %GZIP

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\ec189ba7.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9048
Entropy (8bit):	4.914507645047987
Encrypted:	false
SSDEEP:	192:xXc7LHSFKrPrPWWECfxZ5hSDWMfbGVWsrECfvmHQvH4QxO3kiyjHb+gtF+4KM:xXqMKnfJSH4InwIHecA
MD5:	8F7D385510059AD61A28C1249005CC5D
SHA1:	D4C7323762411E46F4FED94050FC40B59668C3CE
SHA-256:	E59A48F77B46A490FBE021CE1B7C13398097FD0E30287E7D6678380367DA245B
SHA-512:	8ADFF7226780DC5296CD6B43478C067FC742E42479B44759B945744AAB9C122D742A78A1645BB676F12118EC0FFAEDDCC760A4E576BDA2F060FFBCCABD02A346
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/File/Copy.pm".# File/Copy.pm. Written in 1994 by Aaron Sherman <ajs@ajs.com>. This.# source code has been placed in the public domain by the author..# Please be kind and preserve the documentation..#.# Additions copyright 1996 by Charles Bailey. Permission is granted.# to distribute the revised code under the same terms as Perl itself...package File::Copy;..use 5.006;.use strict;.use warnings; no warnings 'newline';.use File::Spec;.use Config;.# During perl build, we need File::Copy but Scalar::Util might not be built yet.# And then we need these games to avoid loading overload, as that will.# confuse miniperl during the bootstrap of perl..my $Scalar_Util_loaded = eval q{ require Scalar::Util; require overload; 1 };.our(@ISA, @EXPORT, @EXPORT_OK, $VERSION, $Too_Big, $Syscopy_is_copy);.sub copy;.sub syscopy;.sub cp;.sub mv;..$VERSION = '2.31';..require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(copy move);.@EXPORT_OK = qw(cp mv);..$Too_Big = 1024 * 1024 * 2;..sub

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\ed3edee5.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5266
Entropy (8bit):	5.009027024456625
Encrypted:	false
SSDEEP:	96:2yXwgni0YPI2Y7EyBL1c/j/GYWAkv0df8QWMn9b2i3c5OLJXptCNAGKEuiWXY:agni04I2Y7EUc/j/GYNzvWyb4YhptM8+
MD5:	6DF93714DED112CB7DA0705DC21EAD15
SHA1:	8F5C786ED50DC58AEE2A8AA82D5A6E6BAD3A2D8B
SHA-256:	5B8C99EA8FDE1AD4E62DF91B96778F0E20750261360560FD81A9C3AA8497E000
SHA-512:	6506108427381D6A05606A0A0E656ACB81CB0EA9B5F9D61E7BA0F59CEFF1028E4D3A964504CE0F2DFBDCCDB6C10960F1340FB56A9E91C421FE29DABC661D52CD
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/IO/Compress/RawDeflate.pm".package IO::Compress::RawDeflate ;..# create RFC1951.#.use strict ;.use warnings;.use bytes;..use IO::Compress::Base 2.069 ;.use IO::Compress::Base::Common 2.069 qw(:Status );.use IO::Compress::Adapter::Deflate 2.069 ;..require Exporter ;..our ($VERSION, @ISA, @EXPORT_OK, %DEFLATE_CONSTANTS, %EXPORT_TAGS, $RawDeflateError);..$VERSION = '2.069';.$RawDeflateError = '';..@ISA = qw(Exporter IO::Compress::Base);.@EXPORT_OK = qw( $RawDeflateError rawdeflate ) ;.push @EXPORT_OK, @IO::Compress::Adapter::Deflate::EXPORT_OK ;..%EXPORT_TAGS = %IO::Compress::Adapter::Deflate::DEFLATE_CONSTANTS;...{. my %seen;. foreach (keys %EXPORT_TAGS ). {. push @{$EXPORT_TAGS{constants}}, . grep { !$seen{$_}++ } . @{ $EXPORT_TAGS{$_} }. }. $EXPORT_TAGS{all} = $EXPORT_TAGS{constants} ;.}...%DEFLATE_CONSTANTS = %EXPORT_TAGS;..#push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;..Exporter::export_ok_tags('all');.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe

Download File

Process:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	6.321335412582209
Encrypted:	false
SSDEEP:	768:IN/N7A8TjtXOHplS1MXra6RtSY5GuwAGJ2zG0AiPOgcISFMjCJ9JAFjt7w:4XTjTmeGS8xwncHjcd6Cmjt7
MD5:	44D73F3664153A38A9CD02F9DE9C3E69
SHA1:	C557FFA33DCF3949CF13BA78BB97F70DFEFC5BDF
SHA-256:	190FA21BCA88E2C4AC0EBEA467BE79F2FDA63CCD45915D72A2582CA30A3C7C67
SHA-512:	C8397FF966FD720311CADFE08FA664339104FEFA7A0867E5A78B8509BBE52B6E913332DCEB571ABD37FB234A80C9EC57C53E1EA416D3B10C96DA1393D7549964
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....%X.................\...................p....@..........................`.......<........ .........................P............ ...#...................P..H....................................................................................text...$[.......\..................`.P`.data...4....p.......`..............@.0..rdata...C.......D...b..............@.0@.bss....,.............................`..edata..P...........................@.0@.idata..............................@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc....#... ...$..................@.0..reloc..H....P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\f0d492b4.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	421
Entropy (8bit):	4.272989918166514
Encrypted:	false
SSDEEP:	6:aE8mPMFDK+ymPieemrjS/z7QBvh3iLvjw230vOayyuD:RfMDKj9ee+S/QFxnfO7D
MD5:	6759074FBCFAC87FB3332F43CFE64379
SHA1:	14CBC0AB1177B572D8153C59C657B3DC15C9F655
SHA-256:	3A32B99BFC9B3D6D353DD0C873E483A31823E99F5D84F847CC7CED9C759AD913
SHA-512:	C58E651992131B5F2D574C7B26A48E56CC911CEB9C2A06D7EBEFD94322D11390E5B7E21E2DD2D280C996F112151E930B8F23F81280794DAA78066BD2C80DDEFB
Malicious:	false
Preview:	######################################################################..# WARNING: 'lib/Config_git.pl' is generated by make_patchnum.pl..# DO NOT EDIT DIRECTLY - edit make_patchnum.pl instead..######################################################################..$Config::Git_Data=<<'ENDOFGIT';..git_commit_id=''..git_describe=''..git_branch=''..git_uncommitted_changes=''..git_commit_id_title=''....ENDOFGIT..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\f29f117f.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.133471736089271
Encrypted:	false
SSDEEP:	3:TF2ua/HPeEJEXhE71yiqm++a7qrF5XvB2XIOpAXeeYJvGRXv:TF2pegEXmaQFlB2NpARYhg
MD5:	70CECED066C3AAEA52BCCD3AD12C18E4
SHA1:	BB28F963E891107F929DD611F8EA04B41D94692B
SHA-256:	82283503DCF2D6738891BC5905F8F062CC6A801A1C7FD05DE6CA6A658598D725
SHA-512:	26963AACC7EBEA8612623293DC053E594FE0C64A6D910A0259A7D6AF7700EE580C8AEDB62AE6EDE9024277867E9A3783EA9F0CC7DA07298D6DC851479EEAE28F
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/PerlIO/scalar.pm".package PerlIO::scalar;.our $VERSION = '0.24';.require XSLoader;.XSLoader::load();.1;.__END__..#line 42.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\fea1f3e7.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3064
Entropy (8bit):	5.2011080699387
Encrypted:	false
SSDEEP:	48:uQAMSr2ziut4R0MjyhvNSTrIGUlFkTdoNPR63RxtIM2aoKXsrT0o5yRMw1eMSFFA:uQpSr2enR0MMkT8xIT8pc2ajXsn0o5y/
MD5:	87791A596D4D6342C28F06777C46AC00
SHA1:	C701F7D3698D10FDD0A3EA484499A0B64666C876
SHA-256:	A009FA29FA6D8DAA7BE0C1D647406030B24DF58C0AFB47503CD803F39F317898
SHA-512:	7B068490C92E9CD86D2A7D50FAD027E6EB72D0325C94510697916E8358DADC337A51F25C8BFD8F19436B38BC9E32CD1B5D946F2E46624A33B010D2E9FB1272C0
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/attributes.pm".package attributes;..our $VERSION = 0.27;..@EXPORT_OK = qw(get reftype);.@EXPORT = ();.%EXPORT_TAGS = (ALL => [@EXPORT, @EXPORT_OK]);..use strict;..sub croak {. require Carp;. goto &Carp::croak;.}..sub carp {. require Carp;. goto &Carp::carp;.}..my %deprecated;.$deprecated{CODE} = qr/\A-?(locked)\z/;.$deprecated{ARRAY} = $deprecated{HASH} = $deprecated{SCALAR}. = qr/\A-?(unique)\z/;..my %msg = (. lvalue => 'lvalue attribute applied to already-defined subroutine',. -lvalue => 'lvalue attribute removed from already-defined subroutine',. const => 'Useless use of attribute "const"',.);..sub _modify_attrs_and_deprecate {. my $svtype = shift;. # Now that we've removed handling of locked from the XS code, we need to. # remove it here, else it ends up in @badattrs. (If we do the deprecation in. # XS, we can't control the warning based on our caller's lexical settings,. # and the warned line is in this package). gre

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\ff4fd2ad.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	5.0764548152872235
Encrypted:	false
SSDEEP:	48:AK4QOUQU9C0p7PtBke7VXfF0b11zemTREJcMQAZjNBvRipf:AK4QOUQ0pjgeV90bjRsrQkTvRipf
MD5:	C6EF60DF1629CB6E9218EC5788C15F0D
SHA1:	B244EBAA76E4ECBF99C1D3DAEB5509D3D65F0356
SHA-256:	634F2FB9133B9F2CBC2591CF3496645BDA6D36BD920BE367937F90E5C27FBF10
SHA-512:	EB4FB219750F7D0C1F61F0321FD90EACAA54D8C09BFD5F82C16500C688A444F8CE9FB2AD26EAA020EACAD498B43D44AADBD85F8F414A146983BFA937769B16DB
Malicious:	false
Preview:	#line 1 "C:/Perl/lib/Archive/Zip/StringMember.pm".package Archive::Zip::StringMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip::Member );.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES.);..# Create a new string member. Default is COMPRESSION_STORED..# Can take a ref to a string as well..sub _newFromString {. my $class = shift;. my $string = shift;. my $name = shift;. my $self = $class->new(@_);. $self->contents($string);. $self->fileName($name) if defined($name);.. # Set the file date to now. $self->setLastModFileDateTimeFromUnix(time());. $self->unixFileAttributes($self->DEFAULT_FILE_PERMISSIONS);. return $self;.}..sub _become {. my $self = shift;. my $newClass = shift;. return $self if ref($self) eq $newClass;. delete($self->{'contents'});. return $self->SUPER::_become($newClass);.}..# Get or set my contents. Note that we do not call the superclass.# version of

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\MANIFEST

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	exported SGML document, ASCII text, with very long lines (305)
Category:	dropped
Size (bytes):	22823
Entropy (8bit):	4.796745871320196
Encrypted:	false
SSDEEP:	384:gG4shlY5FDOm4bSRGgZn1WUDIvP6bWo83bLSAEXQ/srZn5zCbNKVFHWJwz2X/sVZ:gw+5FDOm4bSRGgZn1WUDIvP6bWo83bL+
MD5:	0593140A9FE3E46C6BF05AF3B5964D41
SHA1:	3D9169680C2DFF4FC81B2DBE77B5A80E79C956A4
SHA-256:	613B6408CCA802E2A19C592E65DFD01A3BBD5D15F7D1B31CBD45757913A8521B
SHA-512:	F4D89EE420655E9D84656577591911A14E06C17175BF1A951DA5E8786CC80256172676F0785EC2B7E3C56626D22A4D6893D4FF5922F49F8FFB51E57ACA0A27CA
Malicious:	false
Preview:	accessible as jar:file:///NAME.par!/MANIFEST in compliant browsers -->.MANIFEST.META.yml.lib/ActivePerl/Config.pm.lib/Archive/Zip.pm.lib/Archive/Zip/Archive.pm.lib/Archive/Zip/DirectoryMember.pm.lib/Archive/Zip/FileMember.pm.lib/Archive/Zip/Member.pm.lib/Archive/Zip/NewFileMember.pm.lib/Archive/Zip/StringMember.pm.lib/Archive/Zip/ZipFileMember.pm.lib/Carp.pm.lib/Class/Struct.pm.lib/Compress/Raw/Bzip2.pm.lib/Compress/Raw/Zlib.pm.lib/Compress/Zlib.pm.lib/Config.pm.lib/Config_git.pl.lib/Config_heavy.pl.lib/Cwd.pm.lib/Digest/MD5.pm.lib/Digest/SHA.pm.lib/Digest/base.pm.lib/DynaLoader.pm.lib/Encode.pm.lib/Encode/Alias.pm.lib/Encode/Config.pm.lib/Encode/Encoding.pm.lib/Encode/MIME/Name.pm.lib/Errno.pm.lib/Exporter.pm.lib/Exporter/Heavy.pm.lib/Fcntl.pm.lib/File/Basename.pm.lib/File/Copy.pm.lib/File/Find.pm.lib/File/Glob.pm.lib/File/GlobMapper.pm.lib/File/Path.pm.lib/File/RandomAccess.pm.lib/File/Spec.pm.lib/File/Spec/Unix.pm.lib/File/Spec/Win32.pm.lib/File/Temp.pm.lib/File/stat.pm.lib

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\META.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	4.761916614117991
Encrypted:	false
SSDEEP:	6:Of/v86+PJ3eCtV+scfTxDAZNq/sDeICAtbfU2vv:O3Tc3d+scfTOZ0035A23
MD5:	B3777EA6047BBE526AADB11859511927
SHA1:	5F42B7DFDD6BBAF02457912FAD413150823B2554
SHA-256:	59CDDD6CC1743B97A493C5060B3BFCD3FA06AC80D7FBCDE3D998AA8D76E07653
SHA-512:	2B48378D87BA16C601CD48983C196F1CCC1C795372C9BDFFBF12F3E62514E2F5581B51800C30F980A8E1F0E0C702420142C01F02C35FFA2754792EF99BEBF544
Malicious:	false
Preview:	build_requires: {}.conflicts: {}.dist_name: exiftool.exe.distribution_type: par.dynamic_config: 0.generated_by: 'PAR::Packer version 1.035'.license: unknown.par:. clean: 0. signature: ''. verbatim: 0. version: 1.010.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\ActivePerl\Config.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	16550
Entropy (8bit):	5.381632518029376
Encrypted:	false
SSDEEP:	384:p7WuhUZ/HC1hDUqRlfk+i9pLqRrtmw8jyI:hQhHu7XkqNtmbjyI
MD5:	9529DC68364ED73EFF918289453A6B74
SHA1:	2DFCCC8D0A620E6BAB11BE4F0C303273A62ED17C
SHA-256:	E835A3382D776F522DCE4DA57C92B66129055839416968F481F850B4D9193439
SHA-512:	42D83A60C71FFBE16819CC0E7F58B4A57E1C306068E0DF022225720043626882C4A9E51994C8EA5154C3BFD844DF9CB29709C3F4EBEF453119EB429EA617D47F
Malicious:	false
Preview:	#line 1 "ActivePerl/Config.pm".package ActivePerl::Config;....use strict;..my %OVERRIDE;....# Make sure all the symbols overridden in this module are excluded..# from the tied cache in Config.pm (configpm in the Perl sources).....my %COMPILER_ENV = map { $_ => 1 } qw(.. cc.. ccflags.. cccdlflags.. ccname.. ccversion.. gccversion.. ar.. cpp.. cppminus.. cpprun.. cppstdin.. dlltool.. ld.. lddlflags.. ldflags.. lib_ext.. libc.. libs.. make.. optimize.. perllibs.. _a.. _o.. obj_ext.. i64type.. u64type.. quadtype.. uquadtype.. d_casti32..);..$COMPILER_ENV{libpth} = 1 if $^O eq "linux";..my $compiler_env_initialized;....use Config ();..my $CONFIG_OBJ = tied %Config::Config;....sub override {.. return 0 if $ENV{ACTIVEPERL_CONFIG_DISABLE};.... my $key = shift;.... if (exists $ENV{"ACTIVEPERL_CONFIG_\U$key"}) {...$_[0] = $ENV{"ACTIVEPERL_CONFIG_\U$key"};...return 1;.. }.... if (exists $OVERRIDE

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	17467
Entropy (8bit):	5.1290723626837496
Encrypted:	false
SSDEEP:	384:TGDejwzeKEp/q1+P0uV2JaiTG2ca8emk0cO2m3nC5zN:TGDeGecRuV2JaiTG2Jak0cO53nG
MD5:	1EA84469B0F4AEA728515D42B2D11165
SHA1:	E271528BB9E1CA0BBA7AE852C9D46261A1CF9E2F
SHA-256:	6CB2DA38DEE9A57086ECEEEB1C790DC28A5BCB0F7A0C566A375487EF0CECF97D
SHA-512:	EC552D3F883154A389A799D8CD1E81779A17E76F71237755FA723E129B97CCDE38675D4C1E061A20C9622B01E8B55F9C61CF9866740A1B8EE8CCEBA9B0F57BC7
Malicious:	false
Preview:	#line 1 "Archive/Zip.pm".package Archive::Zip;..use 5.006;.use strict;.use Carp ();.use Cwd ();.use IO::File ();.use IO::Seekable ();.use Compress::Raw::Zlib ();.use File::Spec ();.use File::Temp ();.use FileHandle ();..use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';.. require Exporter;. @ISA = qw( Exporter );.}..use vars qw( $ChunkSize $ErrorHandler );..BEGIN {. # This is the size we'll try to read, write, and (de)compress.. # You could set it to something different if you had lots of memory. # and needed more speed.. $ChunkSize \|\|= 32768;.. $ErrorHandler = \&Carp::carp;.}..# BEGIN block is necessary here so that other modules can use the constants..use vars qw( @EXPORT_OK %EXPORT_TAGS );..BEGIN {. @EXPORT_OK = ('computeCRC32');. %EXPORT_TAGS = (. CONSTANTS => [. qw(. FA_MSDOS. FA_UNIX. GPBF_ENCRYPTED_MASK.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\Archive.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	30847
Entropy (8bit):	4.861163184448537
Encrypted:	false
SSDEEP:	768:uZe2g8LcTXLBKsauQ2CCpWql3irTKnEYyYjAcoN/MPKs2/CX0jsQr+rDSUfOzI/g:UePrVPFuNjVr+7ad1P
MD5:	1B86F190F561ED1024C853ACC9970DC2
SHA1:	7B771746996CFEF50B43A04B425BEE8623D4937B
SHA-256:	3BEFA6E8B1AFFCA0EAC943AFA57CDF100F8AAC1EE4B6D24DDC52267C24B06F89
SHA-512:	46745D34472E02030A7EC12C9B5A88323B48C72B60D3FDAEA5355DF4048113961CA2B229A117073C4CBD6895649452991EA6B9864922A9DC47383F141FF43B91
Malicious:	false
Preview:	#line 1 "Archive/Zip/Archive.pm".package Archive::Zip::Archive;..# Represents a generic ZIP archive..use strict;.use File::Path;.use File::Find ();.use File::Spec ();.use File::Copy ();.use File::Basename;.use Cwd;..use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip );.. if ($^O eq 'MSWin32') {. require Win32;. require Encode;. Encode->import(qw{ encode_utf8 decode_utf8 });. }.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES. :PKZIP_CONSTANTS. :UTILITY_METHODS.);..our $UNICODE;..# Note that this returns undef on read errors, else new zip object...sub new {. my $class = shift;. my $self = bless(. {. 'diskNumber' => 0,. 'diskNumberWithStartOfCentralDirectory' => 0,. 'numberOfCentralDirectoriesOnThisDisk' =>. 0, # should be # of members. 'numberOfCentralDirectories' => 0, # should be # of members. 'cen

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\DirectoryMember.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	4.8197310135421665
Encrypted:	false
SSDEEP:	48:1sTKNQOUQU9CKOkTT9D0osphAkeArQpWTtcZahrtf0eEbvlAs:1sTKNQOUQKxs1eyQpWOaD037n
MD5:	63A42017FA0EFB31E7275CFFD64AFDD5
SHA1:	C8C025AC297A8F33F016696D02EB3D52F0C8A0BA
SHA-256:	0F7298C2481C11F27F98882FF92DEB3B8ED3BD1A40066DAA51ACADAAA860E6EC
SHA-512:	90495EB0DB69110B79C35996E8FCC8AA5CC8C83FE0DF170638BCB6BD09E4E22116537A507FA5DF031D6335A04F104DD364D73DBE8E54A9544E443878C0CA7809
Malicious:	false
Preview:	#line 1 "Archive/Zip/DirectoryMember.pm".package Archive::Zip::DirectoryMember;..use strict;.use File::Path;..use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip::Member );.}..use Archive::Zip qw(. :ERROR_CODES. :UTILITY_METHODS.);..sub _newNamed {. my $class = shift;. my $fileName = shift; # FS name. my $newName = shift; # Zip name. $newName = _asZipDirName($fileName) unless $newName;. my $self = $class->new(@_);. $self->{'externalFileName'} = $fileName;. $self->fileName($newName);.. if (-e $fileName) {.. # -e does NOT do a full stat, so we need to do one now. if (-d _ ) {. my @stat = stat(_);. $self->unixFileAttributes($stat[2]);. my $mod_t = $stat[9];. if ($^O eq 'MSWin32' and !$mod_t) {. $mod_t = time();. }. $self->setLastModFileDateTimeFromUnix($mod_t);.. } else { # hmm.. trying to add a non-directory

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\FileMember.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	4.929292408249592
Encrypted:	false
SSDEEP:	24:TJMK4QOUQUkiO4806cMI64ss2PEnNwTRnLtElg6yB7Zyg0Fo3T7VXhA4vAy0tw:6K4QOUQU9Oj06LI6hwQ/mg6Ng0FK7VXp
MD5:	9A35A62C7E5EE17E979591336462F2DF
SHA1:	D7BF0FF11E7DA4CDD9660A81C578A05532F452EC
SHA-256:	1DD676DDFD85C61A4091C3C7F9E491A7A845EA87075E6EA2C5E17CDE51DF1F1F
SHA-512:	7FB99FD2B14DDA7EF95DA1F6A9CD8A287E9138FE93242211230BCACEE8F425EF1168F6A9487956C76D4BD571743918EE20EC61A3F1C7885A06495CA0E9D4A1D0
Malicious:	false
Preview:	#line 1 "Archive/Zip/FileMember.pm".package Archive::Zip::FileMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw ( Archive::Zip::Member );.}..use Archive::Zip qw(. :UTILITY_METHODS.);..sub externalFileName {. shift->{'externalFileName'};.}..# Return true if I depend on the named file.sub _usesFileNamed {. my $self = shift;. my $fileName = shift;. my $xfn = $self->externalFileName();. return undef if ref($xfn);. return $xfn eq $fileName;.}..sub fh {. my $self = shift;. $self->_openFile(). if !defined($self->{'fh'}) \|\| !$self->{'fh'}->opened();. return $self->{'fh'};.}..# opens my file handle from my file name.sub _openFile {. my $self = shift;. my ($status, $fh) = _newFileHandle($self->externalFileName(), 'r');. if (!$status) {. _ioError("Can't open", $self->externalFileName());. return undef;. }. $self->{'fh'} = $fh;. _binmode($fh);. return $fh;.}..# Make sure

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\Member.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	37472
Entropy (8bit):	5.025888565493956
Encrypted:	false
SSDEEP:	768:K4efLdwctPDnPDIcC5IE2xocfxWPsqBl1oLyIodYl/fF9GWl/H8qbrg4ZK8VIvse:TefrPDIcA9+Z1F9YfrDH
MD5:	CE16DE7F3522E754C7B9D71222847544
SHA1:	A672F55A90546BF2CC34A795EB0B6A9837ACB8DA
SHA-256:	DA2B06A8B3E67FF1A3AEB68715B75476B93487DEFAFA032E9C25D25C6AECF5B5
SHA-512:	1B526AA6553674B13798129EBCC5F7C3B462ABA4DAEF1712469A6A2CA5980AB0FA94ECC51D641CDCB4CE22CDAE55C453F8CA329071849EDA861CD52704AF868D
Malicious:	false
Preview:	#line 1 "Archive/Zip/Member.pm".package Archive::Zip::Member;..# A generic member of an archive..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip );.. if ($^O eq 'MSWin32') {. require Win32;. require Encode;. Encode->import(qw{ decode_utf8 });. }.}..use Archive::Zip qw(. :CONSTANTS. :MISC_CONSTANTS. :ERROR_CODES. :PKZIP_CONSTANTS. :UTILITY_METHODS.);..use Time::Local ();.use Compress::Raw::Zlib qw( Z_OK Z_STREAM_END MAX_WBITS );.use File::Path;.use File::Basename;..# Unix perms for default creation of files/dirs..use constant DEFAULT_DIRECTORY_PERMISSIONS => 040755;.use constant DEFAULT_FILE_PERMISSIONS => 0100666;.use constant DIRECTORY_ATTRIB => 040000;.use constant FILE_ATTRIB => 0100000;..# Returns self if successful, else undef.# Assumes that fh is positioned at beginning of central directory file header..# Leaves fh positioned immediately after file header

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\NewFileMember.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.127495341792661
Encrypted:	false
SSDEEP:	48:aK4QOUQU900pCzm/7tI91cgktQL5ycwZtvhjjNBvRio/o4NpHOZAD6:aK4QOUQopC6If5r5ycwnvhTvRiowYpHc
MD5:	43086CD13BCA09000274838805CC20DF
SHA1:	3B3FBA666543AFC1A2232F747980F2983D5809A1
SHA-256:	4A803CD1C1F8A5E6C9AC5097C46646C958D7FAED0E98A37E59A93E68DF86274C
SHA-512:	ECCD7BB2BA3125CE4988120A688648C5FBBDFA792BE50A821F7F9228A10093C9D1C7FE2D4498B1B89A277541CC09FC6363C34E61BAB965CB63566AE1D1142A45
Malicious:	false
Preview:	#line 1 "Archive/Zip/NewFileMember.pm".package Archive::Zip::NewFileMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw ( Archive::Zip::FileMember );.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES. :UTILITY_METHODS.);..# Given a file name, set up for eventual writing..sub _newFromFileNamed {. my $class = shift;. my $fileName = shift; # local FS format. my $newName = shift;. $newName = _asZipDirName($fileName) unless defined($newName);. return undef unless (stat($fileName) && -r _ && !-d _ );. my $self = $class->new(@_);. $self->{'fileName'} = $newName;. $self->{'externalFileName'} = $fileName;. $self->{'compressionMethod'} = COMPRESSION_STORED;. my @stat = stat(_);. $self->{'compressedSize'} = $self->{'uncompressedSize'} = $stat[7];. $self->desiredCompressionMethod(. ($self->compressedSize() > 0). ? COMPRESSION_DEFLATED. : COMPRESSION_STORED. );. $self-

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\StringMember.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1754
Entropy (8bit):	5.065293198003065
Encrypted:	false
SSDEEP:	48:sK4QOUQU9C0p7PtBke7VXfF0b11zemTREJcMQAZjNBvRipf:sK4QOUQ0pjgeV90bjRsrQkTvRipf
MD5:	48A49AC284A4A1D454302A60C0E6992A
SHA1:	B65548880C98CC68B3D88B9B5F8695F03F27CCE8
SHA-256:	2452246AD0AF2E0EB6CE70CCFC33DE93BB43B19567395DA68C9B22A22E5C3B01
SHA-512:	6E0A86EB2CC0DA7AF3364498152B33D9A00BDBEEE28B2B9E80B1A5944EDD8D80C6808129041598CA049418123AB2A5845FDAA01E2EFC4BB5CE3FE2CDABFAFEE7
Malicious:	false
Preview:	#line 1 "Archive/Zip/StringMember.pm".package Archive::Zip::StringMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw( Archive::Zip::Member );.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES.);..# Create a new string member. Default is COMPRESSION_STORED..# Can take a ref to a string as well..sub _newFromString {. my $class = shift;. my $string = shift;. my $name = shift;. my $self = $class->new(@_);. $self->contents($string);. $self->fileName($name) if defined($name);.. # Set the file date to now. $self->setLastModFileDateTimeFromUnix(time());. $self->unixFileAttributes($self->DEFAULT_FILE_PERMISSIONS);. return $self;.}..sub _become {. my $self = shift;. my $newClass = shift;. return $self if ref($self) eq $newClass;. delete($self->{'contents'});. return $self->SUPER::_become($newClass);.}..# Get or set my contents. Note that we do not call the superclass.# version of this, becau

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Archive\Zip\ZipFileMember.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	13807
Entropy (8bit):	4.944748974599024
Encrypted:	false
SSDEEP:	384:6K4eST2MFysq2kJAq+UJqfY2OUg4TbgUJ8fUiUKS2uyLdefVc7RgE+MhVGvq:6K4eE/FaAq+iAY2OR4TbgimUifhuyZeW
MD5:	4E285D5741DE3960775742839B1827E3
SHA1:	542FCAD86911F4B2AFBAFAEC3612054C7CC7037A
SHA-256:	78717FA043EFA7F3DB07FB4C245AC08BC71B0E7EB5A3D7994565331D064CD33C
SHA-512:	3BE81401FADCF40DA59B03DB01E22B31929E2DDB9AB71BE077B906195B450B68A338E7A96FE77A61368C05E5D872240A80DDDAEA92C8D67ED728283ACF68CF39
Malicious:	false
Preview:	#line 1 "Archive/Zip/ZipFileMember.pm".package Archive::Zip::ZipFileMember;..use strict;.use vars qw( $VERSION @ISA );..BEGIN {. $VERSION = '1.47';. @ISA = qw ( Archive::Zip::FileMember );.}..use Archive::Zip qw(. :CONSTANTS. :ERROR_CODES. :PKZIP_CONSTANTS. :UTILITY_METHODS.);..# Create a new Archive::Zip::ZipFileMember.# given a filename and optional open file handle.#.sub _newFromZipFile {. my $class = shift;. my $fh = shift;. my $externalFileName = shift;. my $possibleEocdOffset = shift; # normally 0.. my $self = $class->new(. 'crc32' => 0,. 'diskNumberStart' => 0,. 'localHeaderRelativeOffset' => 0,. 'dataOffset' => 0, # localHeaderRelativeOffset + header length. @_. );. $self->{'externalFileName'} = $externalFileName;. $self->{'fh'} = $fh;. $self->{'possibleEocdOffset'} = $possibleEocdOffset;. return $self;.}..sub isDire

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Carp.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	20165
Entropy (8bit):	4.853442964914412
Encrypted:	false
SSDEEP:	384:wwmyq0duubwKLMQJGYdrvd67B3ybcXmFpO/pMQln:wwPq0duubwKLl96yO/pzln
MD5:	4BCCE46E00CF94ABB1F7F46214845AF8
SHA1:	AEC26E69E077ACE08B8E24023883FA51C9FD4526
SHA-256:	2B5646F82BCB19B30656048366E66193A51443C5F4D9BC3C8C396DBEF1867841
SHA-512:	8D06917115693642E3F157F7DDA940A238246415DD323C903C6F2DD0214AA6F5F5F828C3FE67FA9505CD5F21F2B986B5818B2F1F5A888E1D4AC038F03D3FC213
Malicious:	false
Preview:	#line 1 "Carp.pm".package Carp;..{ use 5.006; }.use strict;.use warnings;.BEGIN {. # Very old versions of warnings.pm load Carp. This can go wrong due. # to the circular dependency. If warnings is invoked before Carp,. # then warnings starts by loading Carp, then Carp (above) tries to. # invoke warnings, and gets nothing because warnings is in the process. # of loading and hasn't defined its import method yet. If we were. # only turning on warnings ("use warnings" above) this wouldn't be too. # bad, because Carp would just gets the state of the -w switch and so. # might not get some warnings that it wanted. The real problem is. # that we then want to turn off Unicode warnings, but "no warnings. # 'utf8'" won't be effective if we're in this circular-dependency. # situation. So, if warnings.pm is an affected version, we turn. # off all warnings ourselves by directly setting ${^WARNING_BITS}.. # On unaffected versions, we turn off just Unicode w

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Class\Struct.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6803
Entropy (8bit):	4.482797224056409
Encrypted:	false
SSDEEP:	192:QDAdHlKJbw6hw6E4MnX5xn0mW6ibalevUxeAsfQlbXFZmipR:QEhlX3QmhFXR
MD5:	D0DB69CFB5811D01908A929B09F86631
SHA1:	295E21DDB974FCF9F8655096B7FFFB3F0F201D19
SHA-256:	0006BD0FB3650853538F9D709F572FD2412DAA0EFDA8A0B4ECA255E8245C4866
SHA-512:	0D5720BFAF2963AA225A3029E9EC5686D62B5558A83B2FD19455FAAB441396699F8C640C49731E5F7E6805B702EEDAE4E1020ED465A1D9021A08D00BA26A80AD
Malicious:	false
Preview:	#line 1 "Class/Struct.pm".package Class::Struct;..## See POD after __END__..use 5.006_001;..use strict;.use warnings::register;.our(@ISA, @EXPORT, $VERSION);..use Carp;..require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(struct);..$VERSION = '0.65';..my $print = 0;.sub printem {. if (@_) { $print = shift }. else { $print++ }.}..{. package Class::Struct::Tie_ISA;.. sub TIEARRAY {. my $class = shift;. return bless [], $class;. }.. sub STORE {. my ($self, $index, $value) = @_;. Class::Struct::_subclass_error();. }.. sub FETCH {. my ($self, $index) = @_;. $self->[$index];. }.. sub FETCHSIZE {. my $self = shift;. return scalar(@$self);. }.. sub DESTROY { }.}..sub import {. my $self = shift;.. if ( @_ == 0 ) {. $self->export_to_level( 1, $self, @EXPORT );. } elsif ( @_ == 1 ) {..# This is admittedly a little bit silly:..# do we ever export anything else than 'struct'...?. $self-

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Compress\Raw\Bzip2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2488
Entropy (8bit):	5.376620358479528
Encrypted:	false
SSDEEP:	48:5vc1RftiBQMbQK8HMILpVyifXPE0QQQhxhay9ByO8hAuxj8HhAuxO+KfEp+5pfT:5vcDftiBQMbQK8ssVyiff9nIP590O85V
MD5:	CAB1D1F84030D2EC98ED379A0C684DF2
SHA1:	8FB6B112D8C4AF44577EC18AFA4FB09D5373223A
SHA-256:	710F906BADE5E68FF8E6B879CE61F4B61A6AC2C7CE8CDA9259B7BA121B024391
SHA-512:	DF016298016D2ED62B1F635CFFF8DFEB6D1AAF88390E8535D6B8C4A40E5C0480591F7B1FB4CDB8F845FF400B3F705E652F2D8A23C3E4AE7E24EC71DA72F62E03
Malicious:	false
Preview:	#line 1 "Compress/Raw/Bzip2.pm"..package Compress::Raw::Bzip2;..use strict ;.use warnings ;..require 5.006 ;.require Exporter;.use Carp ;..use bytes ;.our ($VERSION, $XS_VERSION, @ISA, @EXPORT, $AUTOLOAD);..$VERSION = '2.069';.$XS_VERSION = $VERSION; .$VERSION = eval $VERSION;..@ISA = qw(Exporter);.# Items to export into callers namespace by default. Note: do not export.# names by default without a very good reason. Use EXPORT_OK instead..# Do not simply export all your public functions/methods/constants..@EXPORT = qw(...BZ_RUN...BZ_FLUSH...BZ_FINISH....BZ_OK...BZ_RUN_OK...BZ_FLUSH_OK...BZ_FINISH_OK...BZ_STREAM_END...BZ_SEQUENCE_ERROR...BZ_PARAM_ERROR...BZ_MEM_ERROR...BZ_DATA_ERROR...BZ_DATA_ERROR_MAGIC...BZ_IO_ERROR...BZ_UNEXPECTED_EOF...BZ_OUTBUFF_FULL...BZ_CONFIG_ERROR.. );..sub AUTOLOAD {. my($constname);. ($constname = $AUTOLOAD) =~ s/.:://;. my ($error, $val) = constant($constname);. Carp::croak $error if $error;. no strict 'refs';. {$AUTOLOAD} = sub { $val

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Compress\Raw\Zlib.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16931
Entropy (8bit):	4.775624805750898
Encrypted:	false
SSDEEP:	384:APRSIVMTA0UtOK3F1W2rgyg257Ufbsz1ogXQXJJkCsUTchTt3HP0k:APR30A0UtOYF1W2rgyg257UfbszegXQm
MD5:	3BA473DB520B786C9C141213D3E98F55
SHA1:	2B822020651930DB0EB885A468F03805ACDFD7D5
SHA-256:	068B50B1DB1BF732BB00592D830DC0FAA14F061C2A518810AB7574C08E41634A
SHA-512:	F983DBBCCD774E4C0083B3993CAE41B410411CBD3EB6536C337551437786DAAA61A576DD8BE219CE040E12A1C968E1D0C6DEC8E912853AEC7679B9DE85C39F65
Malicious:	false
Preview:	#line 1 "Compress/Raw/Zlib.pm"..package Compress::Raw::Zlib;..require 5.006 ;.require Exporter;.use Carp ;..use strict ;.use warnings ;.use bytes ;.our ($VERSION, $XS_VERSION, @ISA, @EXPORT, %EXPORT_TAGS, @EXPORT_OK, $AUTOLOAD, %DEFLATE_CONSTANTS, @DEFLATE_CONSTANTS);..$VERSION = '2.069';.$XS_VERSION = $VERSION; .$VERSION = eval $VERSION;..@ISA = qw(Exporter);.%EXPORT_TAGS = ( flush => [qw{ . Z_NO_FLUSH. Z_PARTIAL_FLUSH. Z_SYNC_FLUSH. Z_FULL_FLUSH. Z_FINISH. Z_BLOCK. }],. level => [qw{ . Z_NO_COMPRESSION. Z_BEST_SPEED. Z_BEST_COMPRESSION. Z_DEFAULT_COMPRESSION.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Compress\Zlib.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	15885
Entropy (8bit):	4.805045041736689
Encrypted:	false
SSDEEP:	384:poRzVdRjvXESeM+p6IB0LXW4NLHBnkBnOS80Cdv6+jE9/zSeP+b0:poRxdRzUDM+p6IB0LXW4NFkaljEFdPm0
MD5:	5681F24C320AF8DE1C05D6EC426521B1
SHA1:	707E2E0F4DE898E4ABC9E0EC706860A9B7A10A12
SHA-256:	C2698AE2F8D35E0F5375BD85D8DAA0020F749382226F2CA4DC455B46C2DB993E
SHA-512:	7A097952B03E45064A8A4D2553612B208B531A9B792B6E24B46C20C36B9C006727B313E83926B27BD525010373A8BAC4D629DB7E7CF2B97C6CB09BA4BF28261F
Malicious:	false
Preview:	#line 1 "Compress/Zlib.pm"..package Compress::Zlib;..require 5.006 ;.require Exporter;.use Carp ;.use IO::Handle ;.use Scalar::Util qw(dualvar);..use IO::Compress::Base::Common 2.069 ;.use Compress::Raw::Zlib 2.069 ;.use IO::Compress::Gzip 2.069 ;.use IO::Uncompress::Gunzip 2.069 ;..use strict ;.use warnings ;.use bytes ;.our ($VERSION, $XS_VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);..$VERSION = '2.069';.$XS_VERSION = $VERSION; .$VERSION = eval $VERSION;..@ISA = qw(Exporter);.# Items to export into callers namespace by default. Note: do not export.# names by default without a very good reason. Use EXPORT_OK instead..# Do not simply export all your public functions/methods/constants..@EXPORT = qw(. deflateInit inflateInit.. compress uncompress.. gzopen $gzerrno. );..push @EXPORT, @Compress::Raw::Zlib::EXPORT ;..@EXPORT_OK = qw(memGunzip memGzip zlib_version);.%EXPORT_TAGS = (. ALL => \@EXPORT.);..BEGIN.{. *zlib_version = \&Compress::Raw::Zlib

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Config.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	5.258493266012994
Encrypted:	false
SSDEEP:	96:gt79V6CB4rkZELjXuwv+bdehWVCHUt07YICuVQD+b1bRbQV9L:5CB4CEHewqd8WA0a7YICuC+ht+N
MD5:	FE5C0D8432FA11803B6C6747221C8345
SHA1:	357E520A55D02C7E406371E9DE3C6635633FF7EE
SHA-256:	E552A5C3AD5E97470D293252FBAA4A3B53E92B146B793AB57BF932D7DE47FA97
SHA-512:	5C3EC9AFC9DFF8167CB0B2B442BFFAFF61B2401EEA19F9B282AC7E253DDCB0F6C382F4A557407AD8078B6CD70524C8412D042C0C8B7BF44E251D0A088AB6F96B
Malicious:	false
Preview:	#line 1 "Config.pm".# This file was created by configpm when Perl was built. Any changes..# made to this file will be lost the next time perl is built.....# for a description of the variables, please have a look at the..# Glossary file, as written in the Porting folder, or use the url:..# http://perl5.git.perl.org/perl.git/blob/HEAD:/Porting/Glossary....package Config;..use strict;..use warnings;..use vars '%Config', '$VERSION';....$VERSION = "5.024000";....# Skip @Config::EXPORT because it only contains %Config, which we special..# case below as it's not a function. @Config::EXPORT won't change in the..# lifetime of Perl 5...my %Export_Cache = (myconfig => 1, config_sh => 1, config_vars => 1,.... config_re => 1, compile_date => 1, local_patches => 1,.... bincompat_options => 1, non_bincompat_options => 1,.... header_files => 1);....@Config::EXPORT = qw(%Config);..@Config::EXPORT_OK = keys %Export_Cache;....# Need to stub all the functions to make code such as print Config::co

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Config_git.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	421
Entropy (8bit):	4.272989918166514
Encrypted:	false
SSDEEP:	6:aE8mPMFDK+ymPieemrjS/z7QBvh3iLvjw230vOayyuD:RfMDKj9ee+S/QFxnfO7D
MD5:	6759074FBCFAC87FB3332F43CFE64379
SHA1:	14CBC0AB1177B572D8153C59C657B3DC15C9F655
SHA-256:	3A32B99BFC9B3D6D353DD0C873E483A31823E99F5D84F847CC7CED9C759AD913
SHA-512:	C58E651992131B5F2D574C7B26A48E56CC911CEB9C2A06D7EBEFD94322D11390E5B7E21E2DD2D280C996F112151E930B8F23F81280794DAA78066BD2C80DDEFB
Malicious:	false
Preview:	######################################################################..# WARNING: 'lib/Config_git.pl' is generated by make_patchnum.pl..# DO NOT EDIT DIRECTLY - edit make_patchnum.pl instead..######################################################################..$Config::Git_Data=<<'ENDOFGIT';..git_commit_id=''..git_describe=''..git_branch=''..git_uncommitted_changes=''..git_commit_id_title=''....ENDOFGIT..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Config_heavy.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with very long lines (1843), with CRLF line terminators
Category:	dropped
Size (bytes):	39040
Entropy (8bit):	5.283260729412827
Encrypted:	false
SSDEEP:	768:FkDmO+qYRH5qru6XMCcCgKlLAJkG12wBBo0fe:apYRHMM/Sk1c
MD5:	1FD71BE7C8835DC9E4901BD1DA0015E8
SHA1:	CF1E9A760AE7DB002CF180FAF1FE770127D2CEB4
SHA-256:	3DAFD9F149AC3D8AAD7497E0E116C30D43565447434AEDB64A65195A66392F8D
SHA-512:	82593B96BEDD511539B7A8327EF5EF1AE2119CCA7EC936B080640BBC95EFA4702D93F508D39C71090B2EFC1FD212E06A73B73D6D7C4A468CE4392B6B62788151
Malicious:	false
Preview:	# This file was created by configpm when Perl was built. Any changes..# made to this file will be lost the next time perl is built.....package Config;..use strict;..use warnings;..use vars '%Config';....sub bincompat_options {.. return split ' ', (Internals::V())[0];..}....sub non_bincompat_options {.. return split ' ', (Internals::V())[1];..}....sub compile_date {.. return (Internals::V())[2]..}....sub local_patches {.. my (undef, undef, undef, @patches) = Internals::V();.. return @patches;....}....BEGIN {.. unless ($ENV{ACTIVEPERL_CONFIG_DISABLE}) {.. eval {.. require ActivePerl::Config;.. };.. die $@ if $@ && $@ !~ /^Can't locate ActivePerl\/Config\.pm/;.. }..}....sub _V {.. die "Perl lib was built for 'MSWin32' but is being run on '$^O'".. unless "MSWin32" eq $^O;.... my ($bincompat, $non_bincompat, $date, @patches) = Internals::V();.... my $opts = join ' ', sort split ' ', "$bincompat $non_bincompat";....

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Cwd.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	18470
Entropy (8bit):	5.122983613793547
Encrypted:	false
SSDEEP:	384:zIG88xXYCsaIiawNM0BQbh2DVmiVhOiIk7miTPRldpXF9hHj8:zIG88X1a1fiSiIkqiTPRldpXrhHw
MD5:	16B64775C6D47C28BAC929CC150325D1
SHA1:	744595DB11C78DB4EC741EC1EA6CA08DCA9596AB
SHA-256:	61855BB6AA5879E9B9E39A7F07AC4FFD78B1A430C9F4243A73CBEA47AE101568
SHA-512:	94932A784E80724378E704D08A8BFB016ADAEDE07DCEAA13AC55330EFB4EE994E6E30A5444AFAFDDC342F2FCD84065AEDB36B1461C742B2DCBE258E7DE05F9D3
Malicious:	false
Preview:	#line 1 "Cwd.pm".package Cwd;.use strict;.use Exporter;.use vars qw(@ISA @EXPORT @EXPORT_OK $VERSION);..$VERSION = '3.63';.my $xs_version = $VERSION;.$VERSION =~ tr/_//d;..@ISA = qw/ Exporter /;.@EXPORT = qw(cwd getcwd fastcwd fastgetcwd);.push @EXPORT, qw(getdcwd) if $^O eq 'MSWin32';.@EXPORT_OK = qw(chdir abs_path fast_abs_path realpath fast_realpath);..# sys_cwd may keep the builtin command..# All the functionality of this module may provided by builtins,.# there is no sense to process the rest of the file..# The best choice may be to have this in BEGIN, but how to return from BEGIN?..if ($^O eq 'os2') {. local $^W = 0;.. cwd = defined &sys_cwd ? \&sys_cwd : \&_os2_cwd;. getcwd = \&cwd;. fastgetcwd = \&cwd;. fastcwd = \&cwd;.. fast_abs_path = \&sys_abspath if defined &sys_abspath;. abs_path = \&fast_abs_path;. realpath = \&fast_abs_path;. fast_realpath = \&fast_abs_path;..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Digest\MD5.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	771
Entropy (8bit):	5.241488972936639
Encrypted:	false
SSDEEP:	12:TFMDIMlfhxcQO0SsiBF3Yg6SKEqWEXGygxY0QKEqziI+vnK66myUzBXYyLIi9JYE:TGDr5h9I7F7d/PQVq8FZyOXYef9JBDj7
MD5:	2DDAC57D8322A65A2BDF9830231D4653
SHA1:	495D57A7A9FFC36E2C22F62C54632C2E80AC5630
SHA-256:	0A4432DB3506D00B504552A69663FBD4ECF598B99442FD4BA530D884931BBEBD
SHA-512:	EED02CA302665162CC117F5FAE3108BF6D73F00F085BE12D206CDBFA46F52F8408EF39C06F181109E5AED7540A68B145326D91BB5EAD305B0AB0D197A5776264
Malicious:	false
Preview:	#line 1 "Digest/MD5.pm".package Digest::MD5;..use strict;.use vars qw($VERSION @ISA @EXPORT_OK);..$VERSION = '2.54';..require Exporter;.import = \&Exporter::import;.@EXPORT_OK = qw(md5 md5_hex md5_base64);..eval {. require Digest::base;. push(@ISA, 'Digest::base');.};.if ($@) {. my $err = $@;. add_bits = sub { die $err };.}...eval {. require XSLoader;. XSLoader::load('Digest::MD5', $VERSION);.};.if ($@) {. my $olderr = $@;. eval {..# Try to load the pure perl version..require Digest::Perl::MD5;...Digest::Perl::MD5->import(qw(md5 md5_hex md5_base64));..unshift(@ISA, "Digest::Perl::MD5"); # make OO interface work. };. if ($@) {..# restore the original error..die $olderr;. }.}.else {. *reset = \&new;.}..1;.__END__..#line 386.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Digest\SHA.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5540
Entropy (8bit):	5.482438035639774
Encrypted:	false
SSDEEP:	96:Poqh8jdmWQpLZPSW+cN+lXy5WBdrsqWim3xJHQc4a4A6MtxWctImliFTZ820AU6u:Pos8cW05PqW/BJH6as/GOqE2
MD5:	B2648449B0822B3E26ADEBD542ACE43F
SHA1:	C28327A17054C1E92781AB6B40B067520A70E655
SHA-256:	3C2BE9F9B20752D6BF2E6FF36EE34E5D89A22D4145D8FBF00F66A5D9A1C2F797
SHA-512:	625EB3473566EAFF80AE6C3F9310AFAD606B84FED4FD420697B66A66E6285E3B65B8C1490B74EDEB41FE6C72321084BC86FAD52FC48196FF5B16C71F5A991526
Malicious:	false
Preview:	#line 1 "Digest/SHA.pm".package Digest::SHA;..require 5.003000;..use strict;.use warnings;.use vars qw($VERSION @ISA @EXPORT @EXPORT_OK);.use Fcntl;.use integer;..$VERSION = '5.95';..require Exporter;.require DynaLoader;.@ISA = qw(Exporter DynaLoader);.@EXPORT_OK = qw(..hmac_sha1.hmac_sha1_base64.hmac_sha1_hex..hmac_sha224.hmac_sha224_base64.hmac_sha224_hex..hmac_sha256.hmac_sha256_base64.hmac_sha256_hex..hmac_sha384.hmac_sha384_base64.hmac_sha384_hex..hmac_sha512.hmac_sha512_base64.hmac_sha512_hex..hmac_sha512224.hmac_sha512224_base64.hmac_sha512224_hex..hmac_sha512256.hmac_sha512256_base64.hmac_sha512256_hex..sha1..sha1_base64..sha1_hex..sha224..sha224_base64..sha224_hex..sha256..sha256_base64..sha256_hex..sha384..sha384_base64..sha384_hex..sha512..sha512_base64..sha512_hex..sha512224.sha512224_base64.sha512224_hex..sha512256.sha512256_base64.sha512256_hex);..# Inherit from Digest::base if possible..eval {..require Digest::base;..push(@ISA, 'Digest::base');.};..# The following routin

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Digest\base.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.955872806414357
Encrypted:	false
SSDEEP:	24:Tn+r5/Q712emRhAJ+UAY0W+QZ5xrXOaYLqaQ4+6FHKRTcanT:ar5/+nmRJvWnreauQb6FHmcW
MD5:	434ADF1A2D3EFC6C11066F8F5EDF7AAE
SHA1:	22EB0318BD1B7566F7292A31A32543D31F89DFDB
SHA-256:	AF67C94C5B81094D15CBCA204266718C2447E411106C594017BC77669537516A
SHA-512:	B6B2F62EB101D77EFBAE79F5FE11E9539A207FD5240D812DB79547E34C24539CC0153CA26379AD5888ECA3F92C3AD0AF2A6E39E8F33245A1B552C6E7E05DE679
Malicious:	false
Preview:	#line 1 "Digest/base.pm".package Digest::base;..use strict;.use vars qw($VERSION);.$VERSION = "1.16";..# subclass is supposed to implement at least these.sub new;.sub clone;.sub add;.sub digest;..sub reset {. my $self = shift;. $self->new(@_); # ugly.}..sub addfile {. my ($self, $handle) = @_;.. my $n;. my $buf = "";.. while (($n = read($handle, $buf, 41024))) {. $self->add($buf);. }. unless (defined $n) {..require Carp;..Carp::croak("Read failed: $!");. }.. $self;.}..sub add_bits {. my $self = shift;. my $bits;. my $nbits;. if (@_ == 1) {..my $arg = shift;..$bits = pack("B", $arg);..$nbits = length($arg);. }. else {..($bits, $nbits) = @_;. }. if (($nbits % 8) != 0) {..require Carp;..Carp::croak("Number of bits must be multiple of 8 for this algorithm");. }. return $self->add(substr($bits, 0, $nbits/8));.}..sub hexdigest {. my $self = shift;. return unpack("H*", $self->digest(@_));.}..sub b64digest {. my $se

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\DynaLoader.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	10854
Entropy (8bit):	4.913281702020398
Encrypted:	false
SSDEEP:	192:D2nu+Mvss1iHTSxGN9KTqiqbqdJFWUhzgzWEtplZI7V5U:4NBbGxGbivEqdJFWGgzZlm7V6
MD5:	5CB87D4D6FE0D89B43A4249C96314D3F
SHA1:	6D41B1958A3BC9E53140D36DC2980E24F315A012
SHA-256:	FBA4584ED10EAA4555D8755D46EF95E0A99AEF65C925E54E05ACF5B0CFA8044F
SHA-512:	A94D7D58BEFB867E4AE945AA558B788187A2F15B0F6E50A34CCA3949865D090B25404D107A679168AE9F494DA0EA0A0C9B4C5E8483AB25C3E9741770691E2B05
Malicious:	false
Preview:	#line 1 "DynaLoader.pm"...# Generated from DynaLoader_pm.PL, this file is unique for every OS....package DynaLoader;....# And Gandalf said: 'Many folk like to know beforehand what is to..# be set on the table; but those who have laboured to prepare the..# feast like to keep their secret; for wonder makes the words of..# praise louder.'....# (Quote from Tolkien suggested by Anno Siegel.)..#..# See pod text at end of file for documentation...# See also ext/DynaLoader/README in source tree for other information...#..# Tim.Bunce@ig.co.uk, August 1994....BEGIN {.. $VERSION = '1.38';.. $XS_VERSION = '1.38';..}....use Config;....# enable debug/trace messages from DynaLoader perl code..$dl_debug = $ENV{PERL_DL_DEBUG} \|\| 0 unless defined $dl_debug;....#..# Flags to alter dl_load_file behaviour. Assigned bits:..# 0x01 make symbols available for linking later dl_load_file's...# (only known to work on Solaris 2 using dlopen(RTLD_GLOBAL))..# (ignored under VMS; e

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Encode.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10442
Entropy (8bit):	4.730078704241152
Encrypted:	false
SSDEEP:	192:+4SjhHMYkEKgcQljyiQvz8MQgQy3iQfRxZNrVO09ukC9R7jXC5utoCkxK04eds3X:3SjF4WgT7vDO0GKC6zrIX
MD5:	FC76A9E9FE0E4A89E3AE8AEB40837968
SHA1:	B1F30264613CABB8F49299A6DA7EF7CEB47659A5
SHA-256:	764688917B3089051FD1AAA89BB703F87829B4FAC1B4F396F034E970AAB969F3
SHA-512:	E340138346A812B1A33DD77F54A9FCB712276300709D62D2AB059DA867AA2776A7707326863F79C5832DAC6B97022492F9E1A420E6CC1EC7729C30DF1A48F2CD
Malicious:	false
Preview:	#line 1 "Encode.pm".#.# $Id: Encode.pm,v 2.82 2016/02/06 20:16:42 dankogai Exp $.#.package Encode;.use strict;.use warnings;.our $VERSION = sprintf "%d.%02d", q$Revision: 2.82 $ =~ /(\d+)/g;.use constant DEBUG => !!$ENV{PERL_ENCODE_DEBUG};.use XSLoader ();.XSLoader::load( __PACKAGE__, $VERSION );..use Exporter 5.57 'import';..# Public, encouraged API is exported by default..our @EXPORT = qw(. decode decode_utf8 encode encode_utf8 str2bytes bytes2str. encodings find_encoding clone_encoding.);.our @FB_FLAGS = qw(. DIE_ON_ERR WARN_ON_ERR RETURN_ON_ERR LEAVE_SRC. PERLQQ HTMLCREF XMLCREF STOP_AT_PARTIAL.);.our @FB_CONSTS = qw(. FB_DEFAULT FB_CROAK FB_QUIET FB_WARN. FB_PERLQQ FB_HTMLCREF FB_XMLCREF.);.our @EXPORT_OK = (. qw(. _utf8_off _utf8_on define_encoding from_to is_16bit is_8bit. is_utf8 perlio_ok resolve_alias utf8_downgrade utf8_upgrade. ),. @FB_FLAGS, @FB_CONSTS,.);..our %EXPORT_TAGS = (. all => [ @EXPORT, @EXPORT_OK ],. default

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Encode\Alias.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9506
Entropy (8bit):	4.93681827917896
Encrypted:	false
SSDEEP:	192:kdueoCyJDnZBC6yiYprQxFE5MECyPC7OFn6cIPR8gI6hBOkx0V583P:kduH/WISLsOvY3P
MD5:	E223EF182ECEF1D337C5D485D96852B8
SHA1:	30BF8B39BA47851E94E7C377C8ABEBC4BFAB318F
SHA-256:	7DBF6409AFC0A239E3F0153A1914A5431AB2897863C08DD23872DD2A70F47D3A
SHA-512:	DB66C59A05147FB5C6891D1A16C3E9A7704AE8DD5F86972F29C5910077663E22E9DC33368760E4F5C4D36DFBBAB82CEC9293CE69C86DBACA077FE0A36DE9DA46
Malicious:	false
Preview:	#line 1 "Encode/Alias.pm".package Encode::Alias;.use strict;.use warnings;.no warnings 'redefine';.our $VERSION = do { my @r = ( q$Revision: 2.20 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };.use constant DEBUG => !!$ENV{PERL_ENCODE_DEBUG};..use Exporter 'import';..# Public, encouraged API is exported by default..our @EXPORT =. qw (. define_alias. find_alias.);..our @Alias; # ordered matching list.our %Alias; # cached known aliases..sub find_alias {. require Encode;. my $class = shift;. my $find = shift;. unless ( exists $Alias{$find} ) {. $Alias{$find} = undef; # Recursion guard. for ( my $i = 0 ; $i < @Alias ; $i += 2 ) {. my $alias = $Alias[$i];. my $val = $Alias[ $i + 1 ];. my $new;. if ( ref($alias) eq 'Regexp' && $find =~ $alias ) {. DEBUG and warn "eval $val";. $new = eval $val;. DEBUG and $@ and warn "$val, $@";. }. elsif (

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Encode\Config.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6039
Entropy (8bit):	4.312247995003883
Encrypted:	false
SSDEEP:	96:UocQ9N/GIUpPfG5wbi1ciFLG5A0Q7Rt1ATgBCXBfV/b2nmltHRbaTvSc:uuFGE0Q7R/ATgBCXBxltxbauc
MD5:	158D9556EBF16BF3B5F6B486F00C2DB1
SHA1:	164DE9C5BFD87DC279A75C407834753477390EC0
SHA-256:	A8F69ABC1E47276DE5B291D16DD8769AEF682BE3E5750738E6A7BBB4270A7759
SHA-512:	FE5219E595A4BF81633CD569E1D85C0B81C6F251D1719398890284613F01A10565550271D77192303C49983C48D6756710227F33D18A485E48ECCEF32021E1C3
Malicious:	false
Preview:	#line 1 "Encode/Config.pm".#.# Demand-load module list.#.package Encode::Config;.our $VERSION = do { my @r = ( q$Revision: 2.5 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };..use strict;.use warnings;..our %ExtModule = (.. # Encode::Byte. #iso-8859-1 is in Encode.pm itself. 'iso-8859-2' => 'Encode::Byte',. 'iso-8859-3' => 'Encode::Byte',. 'iso-8859-4' => 'Encode::Byte',. 'iso-8859-5' => 'Encode::Byte',. 'iso-8859-6' => 'Encode::Byte',. 'iso-8859-7' => 'Encode::Byte',. 'iso-8859-8' => 'Encode::Byte',. 'iso-8859-9' => 'Encode::Byte',. 'iso-8859-10' => 'Encode::Byte',. 'iso-8859-11' => 'Encode::Byte',. 'iso-8859-13' => 'Encode::Byte',. 'iso-8859-14' => 'Encode::Byte',. 'iso-8859-15' => 'Encode::Byte',. 'iso-8859-16' => 'Encode::Byte',. 'koi8-f' => 'Encode::Byte',. 'koi8-r

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Encode\Encoding.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	5.01652476073883
Encrypted:	false
SSDEEP:	24:TALqSQdXn/CHY7ALj5v+49CaypEq8YkamTUPM/QHMX5+11ZkdB+WVdB+WYMn:ULqSQ9n//ej5v+CEpZkbTCGvpUKD+WDp
MD5:	7AA7BD3818A1ECA3B23852FC3E1EC161
SHA1:	CD033C8B11C555DD574484EE56D493EB77BFA688
SHA-256:	830C64287023724CAA36137E4670D4FC77443A80448FE6FC55DCD7559215BC3B
SHA-512:	A2A445769FF840C45EA99E2147B8F757ABD90AADF5B9983A728D5A8F8611A46096A98079F64F62750CC61388F57A27AA603BB132AEA1D8871A98DB51175878B9
Malicious:	false
Preview:	#line 1 "Encode/Encoding.pm".package Encode::Encoding;..# Base class for classes which implement encodings.use strict;.use warnings;.our $VERSION = do { my @r = ( q$Revision: 2.7 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };..require Encode;..sub DEBUG { 0 }..sub Define {. my $obj = shift;. my $canonical = shift;. $obj = bless { Name => $canonical }, $obj unless ref $obj;.. # warn "$canonical => $obj\n";. Encode::define_encoding( $obj, $canonical, @_ );.}..sub name { return shift->{'Name'} }..sub mime_name{. require Encode::MIME::Name;. return Encode::MIME::Name::get_mime_name(shift->name);.}..# sub renew { return $_[0] }..sub renew {. my $self = shift;. my $clone = bless {%$self} => ref($self);. $clone->{renewed}++; # so the caller can see it. DEBUG and warn $clone->{renewed};. return $clone;.}..sub renewed { return $_[0]->{renewed} \|\| 0 }..*new_sequence = \&renew;..sub needs_lines { 0 }..sub perlio_ok {. eval { require PerlIO::enco

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Encode\MIME\Name.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3477
Entropy (8bit):	4.101475025900466
Encrypted:	false
SSDEEP:	96:UWSQ9a/KDRH6O16EEYwOBsy0rEgimPeo1+EYPsWMqbFai9r:VSuUKDRHlj47CLFai9r
MD5:	11C3517234247FB3465AE184721ABAB9
SHA1:	196491004CFE11FBC1C23A9DB45D0A5C5AAC65BC
SHA-256:	0C6FDDB453F8C861F3CCAB15FADEFFC29DD6B345A5BF5762A90C586F94F3996C
SHA-512:	5FBC72EFCE981FD4643A16AE5131B8DCAE05CDAA36DE5410D7851CCA6CBF0064C9F4A47D05AD447547D67CC9942898E0A055956107605775A801B5B06E1DC90C
Malicious:	false
Preview:	#line 1 "Encode/MIME/Name.pm".package Encode::MIME::Name;.use strict;.use warnings;.our $VERSION = do { my @r = ( q$Revision: 1.1 $ =~ /\d+/g ); sprintf "%d." . "%02d" x $#r, @r };..our %MIME_NAME_OF = (. 'AdobeStandardEncoding' => 'Adobe-Standard-Encoding',. 'AdobeSymbol' => 'Adobe-Symbol-Encoding',. 'ascii' => 'US-ASCII',. 'big5-hkscs' => 'Big5-HKSCS',. 'cp1026' => 'IBM1026',. 'cp1047' => 'IBM1047',. 'cp1250' => 'windows-1250',. 'cp1251' => 'windows-1251',. 'cp1252' => 'windows-1252',. 'cp1253' => 'windows-1253',. 'cp1254' => 'windows-1254',. 'cp1255' => 'windows-1255',. 'cp1256' => 'windows-1256',. 'cp1257' => 'windows-1257',. 'cp1258' => 'windows-1258',. 'cp37' => 'IBM037',. 'cp424' => 'IBM424',. '

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Errno.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	80068
Entropy (8bit):	5.032847539623258
Encrypted:	false
SSDEEP:	1536:7FvLHk6SThgeGrz6u/RdrBRjxXtBanGn1JJrb1T5w+PN8CZc0BcWvOiDseuFr9e:7FvLjltjJVLK99e
MD5:	932E1C5EA34717E619DD91DF276380F8
SHA1:	C421409A13FF7ABECCE4B72504ED34FA4FC485F4
SHA-256:	D5099E5D58832892E07D3C8E02AF61E9D8122B6505137A5BF1133387E3D5C09A
SHA-512:	6D2053718496B3E97F511AC585F935C8BBAE4741CD3D140782B888C9E91B281CB3885B18E0CA1A2F9516EBCEF471C7B23AD963274BFD845A47EC6F5673CE47EB
Malicious:	false
Preview:	#line 1 "Errno.pm".# -- buffer-read-only: t --..#..# This file is auto-generated. *ANY* changes here will be lost..#....package Errno;..require Exporter;..use strict;....use Config;.."$Config{'archname'}-$Config{'osvers'}" eq.."MSWin32-x86-multi-thread-64int-6.1" or...die "Errno architecture (MSWin32-x86-multi-thread-64int-6.1) does not match executable architecture ($Config{'archname'}-$Config{'osvers'})";....our $VERSION = "1.25";..$VERSION = eval $VERSION;..our @ISA = 'Exporter';....my %err;....BEGIN {.. %err = (...ENUM_REGISTRY_SETTINGS => -2,...ENUM_CURRENT_SETTINGS => -1,...EXCEPTION_CONTINUE_EXECUTION => -1,...EC_ENABLEALL => 0,...ELF_CULTURE_LATIN => 0,...ELF_VERSION => 0,...EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X => 0,...EMARCH_ENC_I17_IMM7B_VAL_POS_X => 0,...EMBDHLP_CREATENOW => 0,...EMBDHLP_INPROC_HANDLER => 0,...ERROR => 0,...ERROR_BIDI_STATUS_OK => 0,...ERROR_SEVERITY_SUCCESS => 0,...ERROR_SUCCESS => 0,...ESB_ENABLE_BOTH => 0,...ES_LEFT => 0,...EVENTLOG_FULL_INFO =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Exporter.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.1172429855658335
Encrypted:	false
SSDEEP:	48:CnRQW5Nk5XsLQsdv5Km57Q5tGBk5+wdhWcEG5Qb6FBZBjHDkCc0JZZHp60bxp0Xw:CRQnXi5Km5k5j5+wlEG5E6FBTMCcw40j
MD5:	6DE757B871193CC812BD93ED263A7E5D
SHA1:	9CBB1C3D20691D111D2734DE855F93EB187E007E
SHA-256:	8DA57CF6EE702E8664931A56D02E01E03A1BF97AAACFAADE7982FA13F114ADD7
SHA-512:	D98174475D5E09F1C4ACD5708002F8EA1B54433F0BDA3EDF81AC6A70694E561B3C7F6C602A5C0CF8404BB274617C663722A557E4BBD2A6CEFE75E795F84FDE93
Malicious:	false
Preview:	#line 1 "Exporter.pm".package Exporter;..require 5.006;..# Be lean..#use strict;.#no strict 'refs';..our $Debug = 0;.our $ExportLevel = 0;.our $Verbose \|\|= 0;.our $VERSION = '5.72';.our (%Cache);..sub as_heavy {. require Exporter::Heavy;. # Unfortunately, this does not work if the caller is aliased as name = \&foo. # Thus the need to create a lot of identical subroutines. my $c = (caller(1))[3];. $c =~ s/.:://;. \&{"Exporter::Heavy::heavy_$c"};.}..sub export {. goto &{as_heavy()};.}..sub import {. my $pkg = shift;. my $callpkg = caller($ExportLevel);.. if ($pkg eq "Exporter" and @_ and $_[0] eq "import") {. {$callpkg."::import"} = \&import;. return;. }.. # We need* to treat @{"$pkg\::EXPORT_FAIL"} since Carp uses it :-(. my $exports = \@{"$pkg\::EXPORT"};. # But, avoid creating things if they don't exist, which saves a couple of. # hundred bytes per package processed.. my $fail = ${$pkg . '::'}{EXPORT_FAIL} && \@{"$pkg\::EXPORT_FAIL"};. return export $pkg, $c

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Exporter\Heavy.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6444
Entropy (8bit):	5.147001894974074
Encrypted:	false
SSDEEP:	192:0EfOHViyR9CMGd4PjyjrwLsgvna8oxMCQl6C:0aCiyniKmjMLsgvnanxFWj
MD5:	40C14FD328DE9393710EB14BDC6445B4
SHA1:	76498087C141F1CD43D652B42AC349D977B3AC2A
SHA-256:	6499CB3413DE99F11CF24A7F6F14FBC6030D6F8C1FC5C1BB736A8E99CE4FBF10
SHA-512:	39A0E1663B9B3A48807E2C03C4BC53F15454BF64597054F7166A693E7A7389CE72877B56BB64EE7F302DE5DA969F4692B433A31BE2DE4EA7F6ABE63970E165BE
Malicious:	false
Preview:	#line 1 "Exporter/Heavy.pm".package Exporter::Heavy;..use strict;.no strict 'refs';..# On one line so MakeMaker will see it..require Exporter; our $VERSION = $Exporter::VERSION;..#line 22..#.# We go to a lot of trouble not to 'require Carp' at file scope,.# because Carp requires Exporter, and something has to give..#..sub _rebuild_cache {. my ($pkg, $exports, $cache) = @_;. s/^&// foreach @$exports;. @{$cache}{@$exports} = (1) x @$exports;. my $ok = \@{"${pkg}::EXPORT_OK"};. if (@$ok) {..s/^&// foreach @$ok;..@{$cache}{@$ok} = (1) x @$ok;. }.}..sub heavy_export {.. # Save the old __WARN__ handler in case it was defined. my $oldwarn = $SIG{__WARN__};.. # First make import warnings look like they're coming from the "use".. local $SIG{__WARN__} = sub {..# restore it back so proper stacking occurs..local $SIG{__WARN__} = $oldwarn;..my $text = shift;..if ($text =~ s/ at \SExporter\S.pm line \d+.*\n//) {.. require Carp;.. local $Carp::CarpLevel = 1;.#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Fcntl.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2185
Entropy (8bit):	5.12930023273981
Encrypted:	false
SSDEEP:	48:lrWUPzbvUFKGuujRu7sdkR3uB85dLGq44/okT6HWQRJEIpsSf:1WCvUFsul6uB8ff44/oS6HWMOIpZ
MD5:	FF1D65B7351BA75F4C9A69D58C4E1898
SHA1:	DE6859C8DBDD67A92FA337CA42A3E0E7EBAD16F8
SHA-256:	C08E9ECD6660933057952584276E8F5E3A232069477A564DACA2AC5C7426C0FD
SHA-512:	482180B744C7B18F9C38E9D6ECC9E938F2FBA85355D71D98F5AB7E2084A4CF11A053F4E6E19990081E38CA643FC4EDC3461EC77F591439180537015A2F00ABDE
Malicious:	false
Preview:	#line 1 "Fcntl.pm".package Fcntl;..#line 57..use strict;.our($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);..require Exporter;.require XSLoader;.@ISA = qw(Exporter);.$VERSION = '1.13';..XSLoader::load();..# Named groups of exports.%EXPORT_TAGS = (. 'flock' => [qw(LOCK_SH LOCK_EX LOCK_NB LOCK_UN)],. 'Fcompat' => [qw(FAPPEND FASYNC FCREAT FDEFER FDSYNC FEXCL FLARGEFILE... FNDELAY FNONBLOCK FRSYNC FSYNC FTRUNC)],. 'seek' => [qw(SEEK_SET SEEK_CUR SEEK_END)],. 'mode' => [qw(S_ISUID S_ISGID S_ISVTX S_ISTXT... _S_IFMT S_IFREG S_IFDIR S_IFLNK... S_IFSOCK S_IFBLK S_IFCHR S_IFIFO S_IFWHT S_ENFMT... S_IRUSR S_IWUSR S_IXUSR S_IRWXU... S_IRGRP S_IWGRP S_IXGRP S_IRWXG... S_IROTH S_IWOTH S_IXOTH S_IRWXO... S_IREAD S_IWRITE S_IEXEC... S_ISREG S_ISDIR S_ISLNK S_ISSOCK... S_ISBLK S_ISCHR S_ISFIFO... S_ISWHT S_ISENFMT..... S_IFMT S_IMODE. )],.);..# Items to export into callers namespace by default.# (move infrequently u

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\FileHandle.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2139
Entropy (8bit):	5.167096528851953
Encrypted:	false
SSDEEP:	48:4Gjof/YCFqcWRZoBvJrLWm5l0Ly76Pqo/5siRtMod:4GjlCFqFboJJXWm5l0O7Q
MD5:	21626B759906C4DBAF4185AE0C076AE9
SHA1:	885334D1A805686157BACBCC33D0386761374FAB
SHA-256:	13BFD0A72298B76EF035EB8B0E7194351D594B0E7BAD4FAD7731114C4AB4C059
SHA-512:	1E981613D0E50BD40F4B8B2D1AE61982C1119560D7D622ED0A75B90C434075929FAED4A4F82F000F32387D014863584176A0465BBD999405684D980FBE6A45BF
Malicious:	false
Preview:	#line 1 "FileHandle.pm".package FileHandle;..use 5.006;.use strict;.our($VERSION, @ISA, @EXPORT, @EXPORT_OK);..$VERSION = "2.02";..require IO::File;.@ISA = qw(IO::File);..@EXPORT = qw(_IOFBF _IOLBF _IONBF);..@EXPORT_OK = qw(. pipe.. autoflush. output_field_separator. output_record_separator. input_record_separator. input_line_number. format_page_number. format_lines_per_page. format_lines_left. format_name. format_top_name. format_line_break_characters. format_formfeed.. print. printf. getline. getlines.);..#.# Everything we're willing to export, we must first import..#.import IO::Handle grep { !defined(&$_) } @EXPORT, @EXPORT_OK;..#.# Some people call "FileHandle::function", so all the functions.# that were in the old FileHandle class must be imported, too..#.{. no strict 'refs';.. my %import = (..'IO::Handle' =>.. [qw(DESTROY new_from_fd fdopen close fileno getc ungetc gets...eof flush error clearerr setbuf setvbuf _open_mod

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Basename.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5535
Entropy (8bit):	4.973452570625352
Encrypted:	false
SSDEEP:	96:CnA9XEQ8taJmXjtHn3TKaEQUzaar9PGPLazs9qMzYfCei:8A9XEhaJIjtHn3/UuO9PGPGI9qMMfCei
MD5:	D5D2F6AE18CBD932944BC793324F63B7
SHA1:	221A4CA0A65345ED48CDE8F5FF22CAA9A7F5F02A
SHA-256:	AA9A826113D43BDF00482D76C745C60B57A15B14D0AC1ADABDC4F7EB63CC8769
SHA-512:	B56813FCA7CD6B72E0DA786CEF2A98112739893A371DC2C9401FAB3B5169F1BC504E6C4B2C867603142B1397D2F28E01224271777605B58DFF47F4435D765F35
Malicious:	false
Preview:	#line 1 "File/Basename.pm"..#line 36...package File::Basename;..# File::Basename is used during the Perl build, when the re extension may.# not be available, but we only actually need it if running under tainting..BEGIN {. if (${^TAINT}) {. require re;. re->import('taint');. }.}...use strict;.use 5.006;.use warnings;.our(@ISA, @EXPORT, $VERSION, $Fileparse_fstype, $Fileparse_igncase);.require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(fileparse fileparse_set_fstype basename dirname);.$VERSION = "2.85";..fileparse_set_fstype($^O);...#line 102...sub fileparse {. my($fullname,@suffices) = @_;.. unless (defined $fullname) {. require Carp;. Carp::croak("fileparse(): need a valid pathname");. }.. my $orig_type = '';. my($type,$igncase) = ($Fileparse_fstype, $Fileparse_igncase);.. my($taint) = substr($fullname,0,0); # Is $fullname tainted?.. if ($type eq "VMS" and $fullname =~ m{/} ) {. # We're doing Unix emulation. $orig_type = $type;. $type = 'Unix';. }.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Copy.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9036
Entropy (8bit):	4.911178802677956
Encrypted:	false
SSDEEP:	192:lXc7LHSFKrPrPWWECfxZ5hSDWMfbGVWsrECfvmHQvH4QxO3kiyjHb+gtF+4KM:lXqMKnfJSH4InwIHecA
MD5:	77E1CDA314659D736A9E165335EC1E76
SHA1:	12FB60F259C68DA36ACDECB935DCDB1DF26F3DAC
SHA-256:	B9574193AA549B5A3DA247A04CA6C8BE86744609E888EF0A23788CCE8BCCB2AD
SHA-512:	5090AD41225060BAEF74F3F78F0A2A0A0BC031E849663F935191910F1554979F62E75AEC92917AE3D9A8021537D232760CFEA199221BCD3A7E678887C2058626
Malicious:	false
Preview:	#line 1 "File/Copy.pm".# File/Copy.pm. Written in 1994 by Aaron Sherman <ajs@ajs.com>. This.# source code has been placed in the public domain by the author..# Please be kind and preserve the documentation..#.# Additions copyright 1996 by Charles Bailey. Permission is granted.# to distribute the revised code under the same terms as Perl itself...package File::Copy;..use 5.006;.use strict;.use warnings; no warnings 'newline';.use File::Spec;.use Config;.# During perl build, we need File::Copy but Scalar::Util might not be built yet.# And then we need these games to avoid loading overload, as that will.# confuse miniperl during the bootstrap of perl..my $Scalar_Util_loaded = eval q{ require Scalar::Util; require overload; 1 };.our(@ISA, @EXPORT, @EXPORT_OK, $VERSION, $Too_Big, $Syscopy_is_copy);.sub copy;.sub syscopy;.sub cp;.sub mv;..$VERSION = '2.31';..require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(copy move);.@EXPORT_OK = qw(cp mv);..$Too_Big = 1024 * 1024 * 2;..sub croak {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Find.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	22265
Entropy (8bit):	4.980557108815011
Encrypted:	false
SSDEEP:	384:viwg6lz9EHY4Vtxz9eV+IdliPHOg2Knc1LHnAcZFbTyTRmULq6:vib6lBE44VZQMX
MD5:	8278BA3FE4E0C2802CE279E53B722412
SHA1:	68896658C894104491F1823F6847A17C1611E666
SHA-256:	8624B6FE201E51709C658D1571AF63BB4D75D148BD8E550959A267663D85C602
SHA-512:	EDA98B677A095EA1CE79098CFB3E25FFE1749A2CCB7F54EA2211396DB53061CBD3DC86989F2D56455C3CF23C71F1F4E09008780DAD86D32BFD3695E8B4249196
Malicious:	false
Preview:	#line 1 "File/Find.pm".package File::Find;.use 5.006;.use strict;.use warnings;.use warnings::register;.our $VERSION = '1.34';.require Exporter;.require Cwd;..our @ISA = qw(Exporter);.our @EXPORT = qw(find finddepth);...use strict;.my $Is_VMS;.my $Is_Win32;..require File::Basename;.require File::Spec;..# Should ideally be my() not our() but local() currently.# refuses to operate on lexicals..our %SLnkSeen;.our ($wanted_callback, $avoid_nlink, $bydepth, $no_chdir, $follow,. $follow_skip, $full_check, $untaint, $untaint_skip, $untaint_pat,. $pre_process, $post_process, $dangling_symlinks);..sub contract_name {. my ($cdir,$fn) = @_;.. return substr($cdir,0,rindex($cdir,'/')) if $fn eq $File::Find::current_dir;.. $cdir = substr($cdir,0,rindex($cdir,'/')+1);.. $fn =~ s\|^\./\|\|;.. my $abs_name= $cdir . $fn;.. if (substr($fn,0,3) eq '../') {. 1 while $abs_name =~ s!/[^/]*/\.\./+!/!;. }.. return $abs_name;.}..sub PathCombine($$) {. my ($Base,$Name) = @_;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Glob.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1870
Entropy (8bit):	5.179653533725432
Encrypted:	false
SSDEEP:	48:VdwWk4OOYvTTSZVfUIACUlQy1XKslKsIhsjNOTaRatCtv:VdwW5uTSnFfz+XVlVr50E
MD5:	66BBA013E20874557053C82F1A46707A
SHA1:	6ACB565566C88305B5EDBBA6A9647E72B965D546
SHA-256:	F07DC18B521F38AC7A92F9C6332D18FA120A671503B2E4664D2BA16F40F1ABA5
SHA-512:	245F6CD629FBB8C731FEB2C29A2AF8E1BF811383A3B967D9582F9DEB77B4A5686B219DB14A8E99C57CA39CCD7ED9B06DD290142CC0993286D37CB7E713069784
Malicious:	false
Preview:	#line 1 "File/Glob.pm".package File::Glob;..use strict;.our($VERSION, @ISA, @EXPORT_OK, @EXPORT_FAIL, %EXPORT_TAGS, $DEFAULT_FLAGS);..require XSLoader;..@ISA = qw(Exporter);..# NOTE: The glob() export is only here for compatibility with 5.6.0..# csh_glob() should not be used directly, unless you know what you're doing...%EXPORT_TAGS = (. 'glob' => [ qw(. GLOB_ABEND..GLOB_ALPHASORT. GLOB_ALTDIRFUNC. GLOB_BRACE. GLOB_CSH. GLOB_ERR. GLOB_ERROR. GLOB_LIMIT. GLOB_MARK. GLOB_NOCASE. GLOB_NOCHECK. GLOB_NOMAGIC. GLOB_NOSORT. GLOB_NOSPACE. GLOB_QUOTE. GLOB_TILDE. bsd_glob. glob. ) ],.);.$EXPORT_TAGS{bsd_glob} = [@{$EXPORT_TAGS{glob}}];.pop @{$EXPORT_TAGS{bsd_glob}}; # no "glob"..@EXPORT_OK = (@{$EXPORT_TAGS{'glob'}}, 'csh_glob');..$VERSION = '1.26';..sub import {. require Exporter;. local $Exporter::ExportLevel = $Exporter::ExportLevel + 1;. Exporter::import(gr

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\GlobMapper.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8103
Entropy (8bit):	4.516363210081285
Encrypted:	false
SSDEEP:	192:PKloMr/R5RtSUaq8xjpNHDKUFEK37Sp9AhRwEpFoXwHDCEKYZSpyJZHD6Fs4DknG:PKLWUevuZMu7+5/BXD8sj2efY
MD5:	8E3EEA1DF40D6C5673F188FF631DB715
SHA1:	8FB4833C4BC754F23BE1889296F7EA960A52661B
SHA-256:	A48AFCEA4B7C4A053C25F0D11B21E2EBDEF23EAD1FE5F7E527E905E09B699988
SHA-512:	C732C3915375733C7132F5C7EDF73EBD8C934C9AC5DE7EBC1FF66769EF89A41D274598E7E2BDADFFF8D617C464D05651970E90BFE8E2412311B6F56CA7096F8C
Malicious:	false
Preview:	#line 1 "File/GlobMapper.pm".package File::GlobMapper;..use strict;.use warnings;.use Carp;..our ($CSH_GLOB);..BEGIN.{. if ($] < 5.006). { . require File::BSDGlob; import File::BSDGlob qw(:glob) ;. $CSH_GLOB = File::BSDGlob::GLOB_CSH() ;. globber = \&File::BSDGlob::csh_glob;. } . else. { . require File::Glob; import File::Glob qw(:glob) ;. $CSH_GLOB = File::Glob::GLOB_CSH() ;. #globber = \&File::Glob::bsd_glob;. globber = \&File::Glob::csh_glob;. } .}..our ($Error);..our ($VERSION, @EXPORT_OK);.$VERSION = '1.000';.@EXPORT_OK = qw( globmap );...our ($noPreBS, $metachars, $matchMetaRE, %mapping, %wildCount);.$noPreBS = '(?<!\\\)' ; # no preceding backslash.$metachars = '.?[](){}';.$matchMetaRE = '[' . quotemeta($metachars) . ']';..%mapping = (. '' => '([^/])',. '?' => '([^/])',. '.' => '\.',. '[' => '([',. '(' => '(',. ')' =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Path.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	4.247447121852549
Encrypted:	false
SSDEEP:	192:oCtjfvySlS14X0VnioOEOgXW233yNRay2mbNQRu7DapICsCyJtICyiQKqtZVdoPM:oCt7a4eILkS6eH04e5uPX5YS7OPrhtv
MD5:	2004EA524DF3E2AC4D9C506AAFDA8E65
SHA1:	0C9C8E6BBBDBCBA84FB0E9C50957142784987DA9
SHA-256:	14FDCE5B214AE1BB40CC858476AD1D8371CBDCE3A077E010831377FF8FC9B594
SHA-512:	77B7C16E647F0258FE6C470EAC5C06716FFA5892EB2A1738971EF4736CBCB9DFFF100CE999D0668036D58ACDDB1C64EAB6F8168EE16E37DF91F5064E268BD1B9
Malicious:	false
Preview:	#line 1 "File/Path.pm".package File::Path;..use 5.005_04;.use strict;..use Cwd 'getcwd';.use File::Basename ();.use File::Spec ();..BEGIN {. if ( $] < 5.006 ) {.. # can't say 'opendir my $dh, $dirname'. # need to initialise $dh. eval 'use Symbol';. }.}..use Exporter ();.use vars qw($VERSION @ISA @EXPORT @EXPORT_OK);.$VERSION = '2.12_01';.$VERSION = eval $VERSION;.@ISA = qw(Exporter);.@EXPORT = qw(mkpath rmtree);.@EXPORT_OK = qw(make_path remove_tree);..BEGIN {. for (qw(VMS MacOS MSWin32 os2)) {. no strict 'refs';. {"_IS_\U$_"} = $^O eq $_ ? sub () { 1 } : sub () { 0 };. }.. # These OSes complain if you want to remove a file that you have no. # write permission to:. _FORCE_WRITABLE = (. grep { $^O eq $_ } qw(amigaos dos epoc MSWin32 MacOS os2). ) ? sub () { 1 } : sub () { 0 };.. # Unix-like systems need to stat each directory in order to detect. # race condition. MS-Windows is immune to this particular attack.. *_NEED_STAT_

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\RandomAccess.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	12864
Entropy (8bit):	4.5488196759728226
Encrypted:	false
SSDEEP:	192:KMp4p9phN2A5QgFYaiQHlQK8hJQxXWdhWuyEX2iQ3mvjlJygi2iQRWE9dZJWNVEw:mpbhNDvBSZU
MD5:	E8ACE52779216EE1A49B1C9819EF6417
SHA1:	3B8AF655E0E98329CB90062F3D7110F1B2DAD377
SHA-256:	46FD6382CFA0371D006F05B901095D373E61780CFD5B4CA2DD22D1E1AF388345
SHA-512:	DEFCD390388A051A7EA01BA1F5271AED0258AE76ABA17D27C7F8137F0F576E36D28F179733E1B18A5B0C0A66E417197BBD119E9AA95D74F46CE7A58EE2AF7246
Malicious:	false
Preview:	#line 1 "File/RandomAccess.pm".#------------------------------------------------------------------------------.# File: RandomAccess.pm.#.# Description: Buffer to support random access reading of sequential file.#.# Revisions: 02/11/2004 - P. Harvey Created.# 02/20/2004 - P. Harvey Added flag to disable SeekTest in new().# 11/18/2004 - P. Harvey Fixed bug with seek relative to end of file.# 01/02/2005 - P. Harvey Added DEBUG code.# 01/09/2006 - P. Harvey Fixed bug in ReadLine() when using.# multi-character EOL sequences.# 02/20/2006 - P. Harvey Fixed bug where seek past end of file could.# generate "substr outside string" warning.# 06/10/2006 - P. Harvey Decreased $CHUNK_SIZE from 64k to 8k.# 11/23/2006 - P. Harvey Limit reads to < 0x80000000 bytes.# 11/26/2008 - P. Harvey Fixed bug in ReadLine when reading from

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Spec.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.129331940489716
Encrypted:	false
SSDEEP:	12:TFWpfIDVsQt2QpkQLeve/J//R/v/mbc/n/mq4AUrIN+UN/TwAoUoG6N/dSXpKOtJ:TYfKsQ39iW/J//t/m4/n/mqx+4+kT6Ns
MD5:	7DDE8F33CD3C95F21C58E1D20949F5E0
SHA1:	23BCE641E286AA6015859AD22D5149F6F6D4D594
SHA-256:	C8BC415759548F537DEBF8A3F821A33F4ED13C58F247FBD973C8A9B69E2FF879
SHA-512:	0C38A58B317DAB0FD127791D948A5963BC714BBECFC6CD6BA17633895D0DD353FC4D6885F8AE27A36706CEA437126C66D22632A29E0307779A96976F606C65AB
Malicious:	false
Preview:	#line 1 "File/Spec.pm".package File::Spec;..use strict;.use vars qw(@ISA $VERSION);..$VERSION = '3.63';.$VERSION =~ tr/_//d;..my %module = (MacOS => 'Mac',.. MSWin32 => 'Win32',.. os2 => 'OS2',.. VMS => 'VMS',.. epoc => 'Epoc',.. NetWare => 'Win32', # Yes, File::Spec::Win32 works on NetWare... symbian => 'Win32', # Yes, File::Spec::Win32 works on symbian... dos => 'OS2', # Yes, File::Spec::OS2 works on DJGPP... cygwin => 'Cygwin',.. amigaos => 'AmigaOS');...my $module = $module{$^O} \|\| 'Unix';..require "File/Spec/$module.pm";.@ISA = ("File::Spec::$module");..1;..__END__..#line 341.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Spec\Unix.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10251
Entropy (8bit):	4.8805211761215626
Encrypted:	false
SSDEEP:	192:XJ5Mmaq9XbCPUQox49lQxTQt5QLcSMKmoQ1C4MtVhe8ww5TZfpQZjvi4Agh8HKBd:XJOA01D+8QNcjvipghUdvc
MD5:	ECADE0346107F7A5CE7FC3B01E4BB57F
SHA1:	B421741AFD4F4CBEA04572E0813AE606446AD58C
SHA-256:	72A45295ABA554DF41FF9F9CCC029E1B094BDB4051885A402F63757CFF697C3B
SHA-512:	6EA1FEABE18ADDD8A6801618F190399B9AAD68847B8F54E336EDFE100351A487E9534B4140AAF4476D7AA60918394B5D7C7F9739481F1529CBC7CB617F7BE735
Malicious:	false
Preview:	#line 1 "File/Spec/Unix.pm".package File::Spec::Unix;..use strict;.use vars qw($VERSION);..$VERSION = '3.63';.my $xs_version = $VERSION;.$VERSION =~ tr/_//d;..#dont try to load XSLoader and DynaLoader only to ultimately fail on miniperl.if(!defined &canonpath && defined &DynaLoader::boot_DynaLoader) {. eval {#eval is questionable since we are handling potential errors like. #"Cwd object version 3.48 does not match bootstrap parameter 3.50. #at lib/DynaLoader.pm line 216." by having this eval. if ( $] >= 5.006 ) {..require XSLoader;..XSLoader::load("Cwd", $xs_version);. } else {..require Cwd;. }. };.}..#line 57..sub _pp_canonpath {. my ($self,$path) = @_;. return unless defined $path;. . # Handle POSIX-style node names beginning with double slash (qnx, nto). # (POSIX says: "a pathname that begins with two successive slashes. # may be interpreted in an implementation-defined manner, although. # more than two leading slashes shall be treated a

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Spec\Win32.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7685
Entropy (8bit):	5.119740635922082
Encrypted:	false
SSDEEP:	192:9+17oy09NRWQaaVRkRKeaiRkRH0pRlMW3BxRSIDo+qvIKcHmbEBpuFKSkyQmJ:9+Ika7WhaoW0OWxx0IDDqAruFphJ
MD5:	7AABF24D2EAE9C13A6270F13063A470D
SHA1:	E1E35BEC7A995300C8E038383910657DD9C585CE
SHA-256:	26577AEC46B57963B4801EEBA7887FCF972602FEA673C13451B53C122686CBDC
SHA-512:	B4E052C9482E32A080D132088812188DEB965DF7310C8D4B7C47D9EB9B5EE7ACF47BBAC90B9AD7CAABDFCFBE509216C4457B2D67F1595E6214A1BAA29B3555A4
Malicious:	false
Preview:	#line 1 "File/Spec/Win32.pm".package File::Spec::Win32;..use strict;..use vars qw(@ISA $VERSION);.require File::Spec::Unix;..$VERSION = '3.63';.$VERSION =~ tr/_//d;..@ISA = qw(File::Spec::Unix);..# Some regexes we use for path splitting.my $DRIVE_RX = '[a-zA-Z]:';.my $UNC_RX = '(?:\\\\\\\\\|//)[^\\\\/]+[\\\\/][^\\\\/]+';.my $VOL_RX = "(?:$DRIVE_RX\|$UNC_RX)";...#line 40..sub devnull {. return "nul";.}..sub rootdir { '\\' }...#line 69..sub tmpdir {. my $tmpdir = $_[0]->_cached_tmpdir(qw(TMPDIR TEMP TMP));. return $tmpdir if defined $tmpdir;. $tmpdir = $_[0]->_tmpdir( map( $ENV{$_}, qw(TMPDIR TEMP TMP) ),.... 'SYS:/temp',.... 'C:\system\temp',.... 'C:/temp',.... '/tmp',.... '/' );. $_[0]->_cache_tmpdir($tmpdir, qw(TMPDIR TEMP TMP));.}..#line 91..sub case_tolerant {. eval { require Win32API::File; } or return 1;. my $drive = shift \|\| "C:";. my $osFsType = "\0"x256;. my $osVolName = "\0"x256;. my $ouFsFlags = 0;. Win32API::File::GetVolumeInforma

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\Temp.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	46994
Entropy (8bit):	4.787008710820633
Encrypted:	false
SSDEEP:	768:J9/m4You+BhjIeuvRdVJVWRlvCj7jq96QMnuuDq1w7cSvonO7OgHP858d5:zxnIeuvhbWR6dQMnfOwAcoZukK5
MD5:	53903EB75F2D4C0DAAC2B5F9C0AECB3D
SHA1:	D90A8DEEEF24D8AB5E4EB7EE0943A6CDC32265B1
SHA-256:	EF07D5904D20BC329762934B7308702C4845F1F18AEDF3630A8C6438BD5491E6
SHA-512:	FA0B3C59C9619772B090E5143C12FFE1F82A6B70D1B1FF3CACE485CA565A2B3179FFA8F78230EF7710A7A31D877F6BD151C8968F21C4E55E007109E93088C002
Malicious:	false
Preview:	#line 1 "File/Temp.pm".package File::Temp;.# ABSTRACT: return name and handle of a temporary file safely.our $VERSION = '0.2304'; # VERSION...# Toolchain targets v5.8.1, but we'll try to support back to v5.6 anyway..# It might be possible to make this v5.5, but many v5.6isms are creeping.# into the code and tests..use 5.006;.use strict;.use Carp;.use File::Spec 0.8;.use Cwd ();.use File::Path 2.06 qw/ rmtree /;.use Fcntl 1.03;.use IO::Seekable; # For SEEK_*.use Errno;.use Scalar::Util 'refaddr';.require VMS::Stdio if $^O eq 'VMS';..# pre-emptively load Carp::Heavy. If we don't when we run out of file.# handles and attempt to call croak() we get an error message telling.# us that Carp::Heavy won't load rather than an error telling us we.# have run out of file handles. We either preload croak() or we.# switch the calls to croak from _gettemp() to use die..eval { require Carp::Heavy; };..# Need the Symbol package if we are running older perl.require Symbol if $] < 5.006;..##

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\File\stat.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6223
Entropy (8bit):	4.932452330940172
Encrypted:	false
SSDEEP:	192:1XfM2kXoqIXEZNQA1hWpB+KGKgKwhAai/d3vnKzBmsnz/EkMvFluTKgG47p4BLCi:1PNyoq/1ABtq/lxT+
MD5:	C26600CB2F39C52094C2CCCF2150791E
SHA1:	E9618415B02195F4DFC2B830DA5A46E0E4321DD8
SHA-256:	F27C174A5F05820514347CDF35398D67D5741A33CF4D684ECA88E38BE9778E74
SHA-512:	8472223D8D77C17FA386DA565BBB788FE8F61D6EFAFDD966B5659A382142BFABE0166C26E4E0252DA5B3FB4B3453E1C2BA55F2363E998CD8C9643BF20155DFF6
Malicious:	false
Preview:	#line 1 "File/stat.pm".package File::stat;.use 5.006;..use strict;.use warnings;.use warnings::register;.use Carp;..BEGIN { warnif = \&warnings::warnif }..our(@EXPORT, @EXPORT_OK, %EXPORT_TAGS);..our $VERSION = '1.07';..my @fields;.BEGIN { . use Exporter ();. @EXPORT = qw(stat lstat);. @fields = qw( $st_dev. $st_ino $st_mode ... $st_nlink $st_uid $st_gid ... $st_rdev $st_size ... $st_atime $st_mtime $st_ctime ... $st_blksize $st_blocks... );. @EXPORT_OK = ( @fields, "stat_cando" );. %EXPORT_TAGS = ( FIELDS => [ @fields, @EXPORT ] );.}.use vars @fields;..use Fcntl qw(S_IRUSR S_IWUSR S_IXUSR);..BEGIN {. # These constants will croak on use if the platform doesn't define. # them. It's important to avoid inflicting that on the user.. no strict 'refs';. for (qw(suid sgid svtx)) {. my $val = eval { &{"Fcntl::S_I\U$_"} };. {"_$_"} = defined $val ? sub { $_[0] & $val ? 1 : "" } : sub { "" };.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	439
Entropy (8bit):	5.146049705506756
Encrypted:	false
SSDEEP:	12:TFDqD45TVsQVPYQDp10elBwYcLGJAaXrM/lLzKXB3:TwqT2QpYQdqesLeAqrM/4R3
MD5:	F8C4FEF3BE59C0DD43C9DA98A13104C1
SHA1:	462FFD57BAE3AEF93C6B2F89F79B00578AECF0EB
SHA-256:	9C161D87A969622F4A1630EEF004F7017C48E4B3ECB9198A70C6756E89130599
SHA-512:	9688791067D47A6CE98D9C102E3CCDC9DA69934651D4E4D18103D7B457B9854CA707B2CB830605D6E473F4A5FADE8E92DB8D997D17FB6D849AD50762699748D0
Malicious:	false
Preview:	#line 1 "IO.pm".#..package IO;..use XSLoader ();.use Carp;.use strict;.use warnings;..our $VERSION = "1.36";.XSLoader::load 'IO', $VERSION;..sub import {. shift;.. warnings::warnif('deprecated', qq{Parameterless "use IO" deprecated}). if @_ == 0 ;. . my @l = @_ ? @_ : qw(Handle Seekable File Pipe Socket Dir);.. eval join("", map { "require IO::" . (/(\w+)/)[0] . ";\n" } @l)..or croak $@;.}..1;..__END__..#line 68..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Adapter\Bzip2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2635
Entropy (8bit):	4.8387823159159185
Encrypted:	false
SSDEEP:	48:wa/iIJ3gykeVM/liUJ254vJ2NgVJ2N1Eld+VM/nK:wa/rJQynVM/li6262Ngv2N1Kd+VM/nK
MD5:	D62F665E9012DD1D13058CBFBD2F51A1
SHA1:	FEDD0D323AD9CFB7B5CCED2800F2007B6191A96E
SHA-256:	09F27F2444391E600C779BD0589A8262CAAFF4258558659FC697B8F861336D9B
SHA-512:	899B69DF1E7DD5A0764C375A71A0F24A0E016C31EACEBF2ED291D4000A9E997C3AE8986DDBC70407850D9998B49439B9129978E01F41C89D2506A929F6E06F92
Malicious:	false
Preview:	#line 1 "IO/Compress/Adapter/Bzip2.pm".package IO::Compress::Adapter::Bzip2 ;..use strict;.use warnings;.use bytes;..use IO::Compress::Base::Common 2.069 qw(:Status);..use Compress::Raw::Bzip2 2.069 ;..our ($VERSION);.$VERSION = '2.069';..sub mkCompObject.{. my $BlockSize100K = shift ;. my $WorkFactor = shift ;. my $Verbosity = shift ;.. $BlockSize100K = 1 if ! defined $BlockSize100K ;. $WorkFactor = 0 if ! defined $WorkFactor ;. $Verbosity = 0 if ! defined $Verbosity ;.. my ($def, $status) = new Compress::Raw::Bzip2(1, $BlockSize100K,. $WorkFactor, $Verbosity);.. return (undef, "Could not create Deflate object: $status", $status). if $status != BZ_OK ;.. return bless {'Def' => $def,. 'Error' => '',. 'ErrorNo' => 0,. } ; .}..sub compr.{. my $self = shift ;.. my $def = $self->{Def};.. my $status = $def->bzdeflate($_[

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Adapter\Deflate.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3185
Entropy (8bit):	4.751508429163416
Encrypted:	false
SSDEEP:	48:Ay6WWsvtZIjXoLZfah3akpVM/ooJ25B2J2bsmJ23U0UOUz2P:AyzWGt2afa0KVM/ou2Q2gs2M2P
MD5:	4BA2A50A27455F461C1EFC9AEB68CB5D
SHA1:	A0E2560B235E3269EBCB5F60CD6D49ECCB944A99
SHA-256:	58504B13DA8D38A9D24B47DD45CD9A83167BC8FDFEEAEF3725E48042A0B23A3B
SHA-512:	84A1696DF6C2C534B22CC94BBA6F2D3043372EA6A1B528E14A016E7D2535BB4F096ED1BF8940232E41A906502336692BA0DF385B02F038FCCA72BA2AD7A76060
Malicious:	false
Preview:	#line 1 "IO/Compress/Adapter/Deflate.pm".package IO::Compress::Adapter::Deflate ;..use strict;.use warnings;.use bytes;..use IO::Compress::Base::Common 2.069 qw(:Status);.use Compress::Raw::Zlib 2.069 qw( !crc32 !adler32 ) ;. .require Exporter; .our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, @EXPORT, %DEFLATE_CONSTANTS);..$VERSION = '2.069';.@ISA = qw(Exporter);.@EXPORT_OK = @Compress::Raw::Zlib::DEFLATE_CONSTANTS;.%EXPORT_TAGS = %Compress::Raw::Zlib::DEFLATE_CONSTANTS;.@EXPORT = @EXPORT_OK;.%DEFLATE_CONSTANTS = %EXPORT_TAGS ;..sub mkCompObject.{. my $crc32 = shift ;. my $adler32 = shift ;. my $level = shift ;. my $strategy = shift ;.. my ($def, $status) = new Compress::Raw::Zlib::Deflate. -AppendOutput => 1,. -CRC32 => $crc32,. -ADLER32 => $adler32,. -Lev

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Base.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	22597
Entropy (8bit):	4.702986902284558
Encrypted:	false
SSDEEP:	192:8y4J7DRVG0CHMWn+oNxT2YnWW8fTmrxaOgL6IwShru6D+CeVFhFgacmpW0FetZM8:x4DPCHCegDVuSWVFhiSnVWKeNDave
MD5:	341C6836FAD5EEAE6317B85004828FC2
SHA1:	E45AB4465A1268D3CC90E34C8F85F56C56E8221B
SHA-256:	654C1CE5A3353DD6A1E3AA040E95C46D03A845FD21FAA0E08668880AD20075B2
SHA-512:	4BD29F6824B9BBADAAA00268A959A2F003B4BD23593AA212FD8F3D1E64B757FD29B1D631F27B689165E18ADCE2508FAF1323BFEA734F1ED2408BED9A3241307E
Malicious:	false
Preview:	#line 1 "IO/Compress/Base.pm"..package IO::Compress::Base ;..require 5.006 ;..use strict ;.use warnings;..use IO::Compress::Base::Common 2.069 ;..use IO::File (); ;.use Scalar::Util ();..#use File::Glob;.#require Exporter ;.use Carp() ;.use Symbol();.#use bytes;..our (@ISA, $VERSION);.@ISA = qw(Exporter IO::File);..$VERSION = '2.069';..#Can't locate object method "SWASHNEW" via package "utf8" (perhaps you forgot to load "utf8"?) at .../ext/Compress-Zlib/Gzip/blib/lib/Compress/Zlib/Common.pm line 16...sub saveStatus.{. my $self = shift ;. ${ $self->{ErrorNo} } = shift() + 0 ;. ${ $self->{Error} } = '' ;.. return ${ $self->{ErrorNo} } ;.}...sub saveErrorString.{. my $self = shift ;. my $retval = shift ;. ${ $self->{Error} } = shift ;. ${ *$self->{ErrorNo} } = shift() + 0 if @_ ;.. return $retval;.}..sub croakError.{. my $self = shift ;. $self->saveErrorString(0, $_[0]);. Carp::croak $_[0];.}..sub closeError.{. my $self = shift ;. my

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Base\Common.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	23136
Entropy (8bit):	4.7888651473029675
Encrypted:	false
SSDEEP:	384:MOFmpu5vf5iV624ADQEPT6mfxhyXgkdQPB7pc6y7:sr5PT6mfxcXgkdQ1w
MD5:	D5C3C18706539C07097211B0E2C68BEF
SHA1:	189D7F107016ADF4F2F3369DC8EEB6800349194C
SHA-256:	4F9B411831B77A5B9C5DC13273976A82958BE05CBD5EFC94B7C5F99DCDDE51EA
SHA-512:	1E504B998A361DB26895D72EE382549B51EC8CE450103F6AC1F3EAC6FEB907313DB07CB5A9818AE81B343140C66D0D228554FC1C00D2FAB681ACD8E4E068FAC5
Malicious:	false
Preview:	#line 1 "IO/Compress/Base/Common.pm".package IO::Compress::Base::Common;..use strict ;.use warnings;.use bytes;..use Carp;.use Scalar::Util qw(blessed readonly);.use File::GlobMapper;..require Exporter;.our ($VERSION, @ISA, @EXPORT, %EXPORT_TAGS, $HAS_ENCODE);.@ISA = qw(Exporter);.$VERSION = '2.069';..@EXPORT = qw( isaFilehandle isaFilename isaScalar. whatIsInput whatIsOutput . isaFileGlobString cleanFileGlobString oneTarget. setBinModeInput setBinModeOutput. ckInOutParams . createSelfTiedObject. . isGeMax32.. MAX32.. WANT_CODE. WANT_EXT. WANT_UNDEF. WANT_HASH.. STATUS_OK. STATUS_ENDSTREAM. STATUS_EOF. STATUS_ERROR. ); ..%EXPORT_TAGS = ( Status => [qw( STATUS_OK. STATUS_ENDSTREAM. STATUS_EOF.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Bzip2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	5.0797885733210535
Encrypted:	false
SSDEEP:	48:ILaKQYP8PsSluANytWQ89yI4jKlI0krIyS8uIUfKsqsscZV:ILLQYP8Z0AgtKy1KlwcyS8u1fKjXcZV
MD5:	62DD9838AF6DF53E740E8F5007FC7C14
SHA1:	AEE24C118E1ECFCA03790705217787D3D3CB9061
SHA-256:	A2E161D6DE69EC460F01F0AF911B5871FEAD114AAF216CCBC07D1763460ADD3F
SHA-512:	AA8FE4C9D8CC4BDA454F75B6439B47897C2EA8B24233E0F4470D6D0BA4A31F92EF5CBF4BEA63429574A023F5581F803B76779574E8124A88BEC278E971293239
Malicious:	false
Preview:	#line 1 "IO/Compress/Bzip2.pm".package IO::Compress::Bzip2 ;..use strict ;.use warnings;.use bytes;.require Exporter ;..use IO::Compress::Base 2.069 ;..use IO::Compress::Base::Common 2.069 qw();.use IO::Compress::Adapter::Bzip2 2.069 ;....our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, $Bzip2Error);..$VERSION = '2.069';.$Bzip2Error = '';..@ISA = qw(Exporter IO::Compress::Base);.@EXPORT_OK = qw( $Bzip2Error bzip2 ) ;.%EXPORT_TAGS = %IO::Compress::Base::EXPORT_TAGS ;.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');....sub new.{. my $class = shift ;.. my $obj = IO::Compress::Base::Common::createSelfTiedObject($class, \$Bzip2Error);. return $obj->_create(undef, @_);.}..sub bzip2.{. my $obj = IO::Compress::Base::Common::createSelfTiedObject(undef, \$Bzip2Error);. $obj->_def(@_);.}...sub mkHeader .{. my $self = shift ;. return '';..}..sub getExtraParams.{. my $self = shift ;.. use IO::Compress::Base::Common 2.069 qw(:Parse);. . r

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Gzip.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7789
Entropy (8bit):	4.972176827383637
Encrypted:	false
SSDEEP:	192:1AaZ4IYIdsyxVxUxhxghFy2nWnKX+ha2SA4tW:1TP/STUFy8A9
MD5:	E8D5DE56E389CD925FE1160E2832B62B
SHA1:	A9CE7D9C405892C43064BF9B6CE23E809985D1C8
SHA-256:	299F31368121F2476360544C2A931F7ADDC33AEBAAB415116BC6704B4BD2D936
SHA-512:	B35F43453FBA2D054EEE0CDC96880CF3A94E8BC104B9FF6DA75E1F91D7512CA86E569CDC17C4EFC493071960D112C86C0DFEFF7CA6D8CA9DF4DF6D1FC81440A0
Malicious:	false
Preview:	#line 1 "IO/Compress/Gzip.pm".package IO::Compress::Gzip ;..require 5.006 ;..use strict ;.use warnings;.use bytes;..require Exporter ;..use IO::Compress::RawDeflate 2.069 () ; .use IO::Compress::Adapter::Deflate 2.069 ;..use IO::Compress::Base::Common 2.069 qw(:Status );.use IO::Compress::Gzip::Constants 2.069 ;.use IO::Compress::Zlib::Extra 2.069 ;..BEGIN.{. if (defined &utf8::downgrade ) . { noUTF8 = \&utf8::downgrade }. else. { noUTF8 = sub {} } .}..our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $GzipError);..$VERSION = '2.069';.$GzipError = '' ;..@ISA = qw(Exporter IO::Compress::RawDeflate);.@EXPORT_OK = qw( $GzipError gzip ) ;.%EXPORT_TAGS = %IO::Compress::RawDeflate::DEFLATE_CONSTANTS ;..push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');..sub new.{. my $class = shift ;.. my $obj = IO::Compress::Base::Common::createSelfTiedObject($class, \$GzipError);.. $obj->_create(undef, @_);.}...sub gzip.{. my $obj

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Gzip\Constants.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3943
Entropy (8bit):	4.984250864407822
Encrypted:	false
SSDEEP:	48:p72lbXFpqhfzuYLTgeu7WS8phRFimkkCS1Vk86pZTGXpgdO8jisnxim0t6IcuEMS:klLZmL20fsnR0E8M
MD5:	52E643EB73C7A882FBFC06F57CAC91E4
SHA1:	1948E95D60E145FC407C2C3599F0D6DDC9C599D2
SHA-256:	29FE31196BDB8C436B83DA9B7024193CEC6F21BA159B4009951FE35928B9E99E
SHA-512:	5230445A9A0B6414F7B0302F9E99389A00811AF570D11EAE018ECAAD21C4C07231D9034077B5D6E494F74AD90572603E2BFDAB6D380577B6A236DA90A65AF000
Malicious:	false
Preview:	#line 1 "IO/Compress/Gzip/Constants.pm".package IO::Compress::Gzip::Constants;..use strict ;.use warnings;.use bytes;..require Exporter;..our ($VERSION, @ISA, @EXPORT, %GZIP_OS_Names);.our ($GZIP_FNAME_INVALID_CHAR_RE, $GZIP_FCOMMENT_INVALID_CHAR_RE);..$VERSION = '2.069';..@ISA = qw(Exporter);..@EXPORT= qw(.. GZIP_ID_SIZE. GZIP_ID1. GZIP_ID2.. GZIP_FLG_DEFAULT. GZIP_FLG_FTEXT. GZIP_FLG_FHCRC. GZIP_FLG_FEXTRA. GZIP_FLG_FNAME. GZIP_FLG_FCOMMENT. GZIP_FLG_RESERVED.. GZIP_CM_DEFLATED.. GZIP_MIN_HEADER_SIZE. GZIP_TRAILER_SIZE.. GZIP_MTIME_DEFAULT. GZIP_XFL_DEFAULT. GZIP_FEXTRA_HEADER_SIZE. GZIP_FEXTRA_MAX_SIZE. GZIP_FEXTRA_SUBFIELD_HEADER_SIZE. GZIP_FEXTRA_SUBFIELD_ID_SIZE. GZIP_FEXTRA_SUBFIELD_LEN_SIZE. GZIP_FEXTRA_SUBFIELD_MAX_SIZE.. $GZIP_FNAME_INVALID_CHAR_RE. $GZIP_FCOMMENT_INVALID_CHAR_RE.. GZIP_FHCRC_SIZE.. GZIP_ISIZE_MAX. GZIP_ISIZE_MOD_VALUE... GZIP_NULL_BYTE.. GZIP_OS_DEFAULT.. %GZIP_OS_Names..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\RawDeflate.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5254
Entropy (8bit):	5.004496324385586
Encrypted:	false
SSDEEP:	96:KyXwgni0YPI2Y7EyBL1c/j/GYWAkv0df8QWMn9b2i3c5OLJXptCNAGKEuiWXY:+gni04I2Y7EUc/j/GYNzvWyb4YhptM8+
MD5:	9C6B63D2F13828EAF80FF0469C9B3FF9
SHA1:	83F87320A70398D7F1C0F5E6DF216C2DEFA8C2F4
SHA-256:	18F26C5666BB31BC779CD3850608D160578C1D2C0DAA18C06B94C7E3A98CE1C1
SHA-512:	55F45AC6C50947A845078C0EE1A0F6D38D13BE95C06745C6A191D5F3DDA6EBAF00062CF3B6187C84FEBC04B3466E2D00F64B2495C295DFB0B86F7495040354F9
Malicious:	false
Preview:	#line 1 "IO/Compress/RawDeflate.pm".package IO::Compress::RawDeflate ;..# create RFC1951.#.use strict ;.use warnings;.use bytes;..use IO::Compress::Base 2.069 ;.use IO::Compress::Base::Common 2.069 qw(:Status );.use IO::Compress::Adapter::Deflate 2.069 ;..require Exporter ;..our ($VERSION, @ISA, @EXPORT_OK, %DEFLATE_CONSTANTS, %EXPORT_TAGS, $RawDeflateError);..$VERSION = '2.069';.$RawDeflateError = '';..@ISA = qw(Exporter IO::Compress::Base);.@EXPORT_OK = qw( $RawDeflateError rawdeflate ) ;.push @EXPORT_OK, @IO::Compress::Adapter::Deflate::EXPORT_OK ;..%EXPORT_TAGS = %IO::Compress::Adapter::Deflate::DEFLATE_CONSTANTS;...{. my %seen;. foreach (keys %EXPORT_TAGS ). {. push @{$EXPORT_TAGS{constants}}, . grep { !$seen{$_}++ } . @{ $EXPORT_TAGS{$_} }. }. $EXPORT_TAGS{all} = $EXPORT_TAGS{constants} ;.}...%DEFLATE_CONSTANTS = %EXPORT_TAGS;..#push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;..Exporter::export_ok_tags('all');. ...sub n

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Compress\Zlib\Extra.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5747
Entropy (8bit):	4.5591571976384335
Encrypted:	false
SSDEEP:	96:6M+8oFAGQIaTt+P6XMPTjZmzTTKYyD24xDwJHfX2wGrxUvdvd/Mj:BoFAGQIaTt+SXMPTjZmzNL4x0pjkqvdY
MD5:	1F0D7F006D29A141A8CCE86CCC7E1F05
SHA1:	67D9A031C4B501A8412FA32F04FC4D5467DB9B9D
SHA-256:	76A92EB8B2464D46D1E0C395D208DB3E7BC0C9F19DB345A6DB18BD2C2E324FA6
SHA-512:	D630E893E9B336565419E44A86E44A1F628EC5DCD631DD0A59811459B7EE771E5DD5D3AF10F385C2A3A24821EE2C9C1C2BD26DF6C43090D3085A6D2E96C19B09
Malicious:	false
Preview:	#line 1 "IO/Compress/Zlib/Extra.pm".package IO::Compress::Zlib::Extra;..require 5.006 ;..use strict ;.use warnings;.use bytes;..our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS);..$VERSION = '2.069';..use IO::Compress::Gzip::Constants 2.069 ;..sub ExtraFieldError.{. return $_[0];. return "Error with ExtraField Parameter: $_[0]" ;.}..sub validateExtraFieldPair.{. my $pair = shift ;. my $strict = shift;. my $gzipMode = shift ;.. return ExtraFieldError("Not an array ref"). unless ref $pair && ref $pair eq 'ARRAY';.. return ExtraFieldError("SubField must have two parts"). unless @$pair == 2 ;.. return ExtraFieldError("SubField ID is a reference"). if ref $pair->[0] ;.. return ExtraFieldError("SubField Data is a reference"). if ref $pair->[1] ;.. # ID is exactly two chars . return ExtraFieldError("SubField ID not two chars long"). unless length $pair->[0] == GZIP_FEXTRA_SUBFIELD_ID_SIZE ;.. # Check that the 2nd byte of t

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Dir.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2776
Entropy (8bit):	5.1929290977144635
Encrypted:	false
SSDEEP:	48:iaVkD0OhfDQ/rlHQXbQr5Kq0jGBH9lFdpoQev4BO9+BodzCmeJ41/nBDkBoizMjK:izBhfDQ/ZwXbQoq9B3npoiBfBo9CmeWs
MD5:	AF9CEBC3D280EBC383508F5DCA685366
SHA1:	2615AFB48299DA452EA1EEC95D83265E0142B3D2
SHA-256:	0F19F6B03C9D851EA6F5FA0A5FF027E2F6743067CD1DBD4C6D241A5B10F4325E
SHA-512:	48A27F0EA8438A628A4DDCA897DD9E4E0AF200BC61E2D11DF4F8B0029FA3317F505D3F5F725B71235171A06FB0BAB22AB0335C0772DFF7EDAC3E586017192008
Malicious:	false
Preview:	#line 1 "IO/Dir.pm".# IO::Dir.pm.#.# Copyright (c) 1997-8 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself...package IO::Dir;..use 5.006;..use strict;.use Carp;.use Symbol;.use Exporter;.use IO::File;.our(@ISA, $VERSION, @EXPORT_OK);.use Tie::Hash;.use File::stat;.use File::Spec;..@ISA = qw(Tie::Hash Exporter);.$VERSION = "1.10";.$VERSION = eval $VERSION;.@EXPORT_OK = qw(DIR_UNLINK);..sub DIR_UNLINK () { 1 }..sub new {. @_ >= 1 && @_ <= 2 or croak 'usage: IO::Dir->new([DIRNAME])';. my $class = shift;. my $dh = gensym;. if (@_) {..IO::Dir::open($dh, $_[0]).. or return undef;. }. bless $dh, $class;.}..sub DESTROY {. my ($dh) = @_;. local($., $@, $!, $^E, $?);. no warnings 'io';. closedir($dh);.}..sub open {. @_ == 2 or croak 'usage: $dh->open(DIRNAME)';. my ($dh, $dirname) = @_;. return undef..unless opendir($dh, $dirname);. # a d

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\File.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	5.214160948537062
Encrypted:	false
SSDEEP:	24:T1rm8HcCaKGErRfm0VZLPG9sCKef7rXgl7tIdFO6BHbgBr83eGreCO5THUaJ/Wii:pmeom7V5GrHQbIdFOo7gXFHUawi5bU3j
MD5:	CE59CC5FBD8514643DF634ADFDEE7EFB
SHA1:	61FCC7CEA50ABD463360A3F367134FB426E405A4
SHA-256:	4C5F540B140EE032F880F54F62FAFA6559B5F5E1E7CA44CE3320F588A1F873CF
SHA-512:	70850A0690A43D0E65482E2EC9AF564F341F71C1C99063A69E991EE1BA8776BA599BAEEDBA82840AB724198A5BD027CD50ED03DAC9163EA55C497C507D74DB09
Malicious:	false
Preview:	#line 1 "IO/File.pm".#..package IO::File;..#line 126..use 5.006_001;.use strict;.our($VERSION, @EXPORT, @EXPORT_OK, @ISA);.use Carp;.use Symbol;.use SelectSaver;.use IO::Seekable;..require Exporter;..@ISA = qw(IO::Handle IO::Seekable Exporter);..$VERSION = "1.16";..@EXPORT = @IO::Seekable::EXPORT;..eval {. # Make all Fcntl O_XXX constants available for importing. require Fcntl;. my @O = grep /^O_/, @Fcntl::EXPORT;. Fcntl->import(@O); # first we import what we want to export. push(@EXPORT, @O);.};..################################################.## Constructor.##..sub new {. my $type = shift;. my $class = ref($type) \|\| $type \|\| "IO::File";. @_ >= 0 && @_ <= 3..or croak "usage: $class->new([FILENAME [,MODE [,PERMS]]])";. my $fh = $class->SUPER::new();. if (@_) {..$fh->open(@_).. or return undef;. }. $fh;.}..################################################.## Open.##..sub open {. @_ >= 2 && @_ <= 4 or croak 'usage: $fh->open(FILENAME [,MODE [,PE

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Handle.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8271
Entropy (8bit):	5.144817591610001
Encrypted:	false
SSDEEP:	192:xk/7ZFEMSeUZLpOe+VZpE40bM/s/y/Y/B/TqsagdasJn:x8ZxUNZCpib4YWkBTq4
MD5:	9DA561A2DA18A930800F12745FE393D0
SHA1:	696211BC81DC1612F3A691824DE0F2F059C1E04C
SHA-256:	A9F25F6CECDE0336B2BE5A7516235412893794E921E1EB4D38CAE200C3595C92
SHA-512:	F4555DE3A00BF9521622C3F4913F9DD7937F665AA963BF2E31A2F4AEC2940436EE631BF05D59C2B8AF8FDC402C0B439F02F94269EC4F7FDFA54833B4DEACD202
Malicious:	false
Preview:	#line 1 "IO/Handle.pm".package IO::Handle;..#line 262..use 5.006_001;.use strict;.our($VERSION, @EXPORT_OK, @ISA);.use Carp;.use Symbol;.use SelectSaver;.use IO ();.# Load the XS module..require Exporter;.@ISA = qw(Exporter);..$VERSION = "1.36";.$VERSION = eval $VERSION;..@EXPORT_OK = qw(. autoflush. output_field_separator. output_record_separator. input_record_separator. input_line_number. format_page_number. format_lines_per_page. format_lines_left. format_name. format_top_name. format_line_break_characters. format_formfeed. format_write.. print. printf. say. getline. getlines.. printflush. flush.. SEEK_SET. SEEK_CUR. SEEK_END. _IOFBF. _IOLBF. _IONBF.);..################################################.## Constructors, destructors..##..sub new {. my $class = ref($_[0]) \|\| $_[0] \|\| "IO::Handle";. if (@_ != 1) {..# Since perl will automatically require IO::File if needed, but..# also initialises IO::Fil

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Pipe.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3456
Entropy (8bit):	4.891538530354684
Encrypted:	false
SSDEEP:	48:JikD3tNylAcF9DCN9f1/B4mjKMbI8pKir1mvS64xHSHx5UZBedO5t:V3tNXKDiIEVAiJASDZSzMBXt
MD5:	DBE64C168F8D1B580B397170A57E6721
SHA1:	4DA72DBB4A3650C8FB372ECFEBE80C7C501AFDC5
SHA-256:	E66EEBA2A624448224E6CD7AB190AB820FD7CC26D9E22BE3D678BEDA7C769669
SHA-512:	991035044819E4EE6E4721BFDD29933227A13CA2374903EBFF5FD4D43C13869ECFCE2609ED41356AA61939E763D79A8AE1DBA66AC04CD573B0F12141E1C9A25E
Malicious:	false
Preview:	#line 1 "IO/Pipe.pm".# IO::Pipe.pm.#.# Copyright (c) 1996-8 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself...package IO::Pipe;..use 5.006_001;..use IO::Handle;.use strict;.our($VERSION);.use Carp;.use Symbol;..$VERSION = "1.15";..sub new {. my $type = shift;. my $class = ref($type) \|\| $type \|\| "IO::Pipe";. @_ == 0 \|\| @_ == 2 or croak "usage: $class->([READFH, WRITEFH])";.. my $me = bless gensym(), $class;.. my($readfh,$writefh) = @_ ? @_ : $me->handles;.. pipe($readfh, $writefh)..or return undef;.. @{*$me} = ($readfh, $writefh);.. $me;.}..sub handles {. @_ == 1 or croak 'usage: $pipe->handles()';. (IO::Pipe::End->new(), IO::Pipe::End->new());.}..my $do_spawn = $^O eq 'os2' \|\| $^O eq 'MSWin32';..sub _doit {. my $me = shift;. my $rw = shift;.. my $pid = $do_spawn ? 0 : fork();.. if($pid) { # Parent. return $pid;. }. el

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Seekable.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	721
Entropy (8bit):	5.398107244246876
Encrypted:	false
SSDEEP:	12:TFwSOFLGDpR4QFqrOQDCK7/OSANd0rGQw/Q0SNZGQfkt12Qy7QbQ5L2H73WKKMYC:TTOFmpn0QK7murGPorzGrhXbQ5I3W5JC
MD5:	4495950DD864B36CB02D0627B7BAE4C5
SHA1:	521B492C9AFC583A7494EE7D9FAED70243BB5279
SHA-256:	C421C85968CFBC51CCC7CE61E155380F82BE5BD9C1121CC96D743E6BBBCC2F30
SHA-512:	BE8E152E38F3EECE308B4F052FC0628D97C91A42D650349A5498BD3AB935BF32E8DD11B07AB5791E98DDE26D8B24C065C12CC39FAE574A2358C9CBA22CA912B8
Malicious:	false
Preview:	#line 1 "IO/Seekable.pm".#..package IO::Seekable;..#line 96..use 5.006_001;.use Carp;.use strict;.our($VERSION, @EXPORT, @ISA);.use IO::Handle ();.# XXX we can't get these from IO::Handle or we'll get prototype.# mismatch warnings on C<use POSIX; use IO::File;> :-(.use Fcntl qw(SEEK_SET SEEK_CUR SEEK_END);.require Exporter;..@EXPORT = qw(SEEK_SET SEEK_CUR SEEK_END);.@ISA = qw(Exporter);..$VERSION = "1.10";.$VERSION = eval $VERSION;..sub seek {. @_ == 3 or croak 'usage: $io->seek(POS, WHENCE)';. seek($_[0], $_[1], $_[2]);.}..sub sysseek {. @_ == 3 or croak 'usage: $io->sysseek(POS, WHENCE)';. sysseek($_[0], $_[1], $_[2]);.}..sub tell {. @_ == 1 or croak 'usage: $io->tell()';. tell($_[0]);.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Select.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4397
Entropy (8bit):	5.03573341331884
Encrypted:	false
SSDEEP:	96:YT+wJp68BRKByrCNeWLmPGMQ8jO2/Yrw5o7u+/QEwBKfgwe3:YTDnkcerdMD2Vu+o3B+c
MD5:	F9F302EC6EA1AF58B886E96FA4E884E0
SHA1:	E045675F5C4CE559570FED86F46F3DBD8CC5FC53
SHA-256:	8A48BCBE38451E3E02D9B904F14927E51086C2DC79736105C63FB4DA6A09D192
SHA-512:	D5DFD41767F3760C227DBFEDAE7F8456E0142DA9D950A5572A0BB135A3A9BDC8526F7F8ADEEC895218D3D98366463E6838EB1908455954B80FE1FC2493E390BA
Malicious:	false
Preview:	#line 1 "IO/Select.pm".# IO::Select.pm.#.# Copyright (c) 1997-8 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself...package IO::Select;..use strict;.use warnings::register;.use vars qw($VERSION @ISA);.require Exporter;..$VERSION = "1.22";..@ISA = qw(Exporter); # This is only so we can do version checking..sub VEC_BITS () {0}.sub FD_COUNT () {1}.sub FIRST_FD () {2}..sub new.{. my $self = shift;. my $type = ref($self) \|\| $self;.. my $vec = bless [undef,0], $type;.. $vec->add(@_). if @_;.. $vec;.}..sub add.{. shift->_update('add', @_);.}...sub remove.{. shift->_update('remove', @_);.}...sub exists.{. my $vec = shift;. my $fno = $vec->_fileno(shift);. return undef unless defined $fno;. $vec->[$fno + FIRST_FD];.}...sub _fileno.{. my($self, $f) = @_;. return unless defined $f;. $f = $f->[0] if ref($f) eq 'ARRAY';. ($f =~ /^\d+$/) ? $f : fileno($f);.}..sub _update.{. my

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Socket.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9490
Entropy (8bit):	5.216836795535086
Encrypted:	false
SSDEEP:	192:0BvIO2nbcoXjdFFBl5MliMBv/ihtGX/yujOAInb2er+h0xE1PR2C:yjoRBl5MliMBv/A+PjWb00wt
MD5:	EC4F897388025F535DE2E86BEE69ABE0
SHA1:	47F012E397971F358DF0E07ED45AF9946013D65E
SHA-256:	4182189008F7A5B8253F4CF2BBDB752456C4926432E052D161B8EF44FA3334D5
SHA-512:	20819E4D6C106794A4E0D92B8BD36F12C9BE6D68F12DF908E1577CDAAFBCD28C7DDE11E080BD45EDF327EE9F91DD8492311B3BFAC5B6A7C0EF488DF69657C3EC
Malicious:	false
Preview:	#line 1 "IO/Socket.pm"..# IO::Socket.pm.#.# Copyright (c) 1997-8 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself...package IO::Socket;..require 5.006;..use IO::Handle;.use Socket 1.3;.use Carp;.use strict;.our(@ISA, $VERSION, @EXPORT_OK);.use Exporter;.use Errno;..# legacy..require IO::Socket::INET;.require IO::Socket::UNIX if ($^O ne 'epoc' && $^O ne 'symbian');..@ISA = qw(IO::Handle);..$VERSION = "1.38";..@EXPORT_OK = qw(sockatmark);..sub import {. my $pkg = shift;. if (@_ && $_[0] eq 'sockatmark') { # not very extensible but for now, fast..Exporter::export_to_level('IO::Socket', 1, $pkg, 'sockatmark');. } else {..my $callpkg = caller;..Exporter::export 'Socket', $callpkg, @_;. }.}..sub new {. my($class,%arg) = @_;. my $sock = $class->SUPER::new();.. $sock->autoflush(1);.. ${*$sock}{'io_socket_timeout'} = delete $arg{Timeout};.. return scalar(

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Socket\INET.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7513
Entropy (8bit):	5.159453378209193
Encrypted:	false
SSDEEP:	192:N7KsZYdB+xkfEVIoP0I3OCu6ci+AGR8CHqywFSv9g4d9uD4uZu0O4:lKsWdQThM8CHqywFSv9g4d9uDVw0O4
MD5:	13536465493F062960707225CB60FAD6
SHA1:	D770017B84EF5706D3558D3A5537394EFAD9CB99
SHA-256:	8ACB9DC91F069367A0FB0C9FEE77B97F4D030FBCD3C0960B38DA76BBAF165FA6
SHA-512:	C1FFC6622A135F9BB0C1EAAF06C0452F9B19C59928FD9CC63773886D95218C1AFC8FF6F884EBD6C49D71B4AF1211DF27655CE5E377404BB6C6ECEE326970C4BF
Malicious:	false
Preview:	#line 1 "IO/Socket/INET.pm".# IO::Socket::INET.pm.#.# Copyright (c) 1997-8 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself...package IO::Socket::INET;..use strict;.our(@ISA, $VERSION);.use IO::Socket;.use Socket;.use Carp;.use Exporter;.use Errno;..@ISA = qw(IO::Socket);.$VERSION = "1.35";..my $EINVAL = exists(&Errno::EINVAL) ? Errno::EINVAL() : 1;..IO::Socket::INET->register_domain( AF_INET );..my %socket_type = ( tcp => SOCK_STREAM,... udp => SOCK_DGRAM,... icmp => SOCK_RAW... );.my %proto_number;.$proto_number{tcp} = Socket::IPPROTO_TCP() if defined &Socket::IPPROTO_TCP;.$proto_number{udp} = Socket::IPPROTO_UDP() if defined &Socket::IPPROTO_UDP;.$proto_number{icmp} = Socket::IPPROTO_ICMP() if defined &Socket::IPPROTO_ICMP;.my %proto_name = reverse %proto_number;..sub new {. my $class = shift;. unshift(@_, "PeerAddr") if @_ == 1;. return $class->SU

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Socket\UNIX.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	5.314771065385789
Encrypted:	false
SSDEEP:	24:T8Vf8DMmQrl15wbQoEk++3mfk2onjO4UVX+qFvytF7vn/tTILkynsOhn5IbOh7:QVkDHQrl15wbQoEr+3mcNeVbOF79TY
MD5:	D229A0C926E4D3F7143D9869B930BD03
SHA1:	6E0174425C5BBB9BAB11AFC0499EEDDA12BEF43E
SHA-256:	B05B1390A34E99FFF4F740550BB83880ADA1C2DEB918C2D692BC0801777FB7AA
SHA-512:	A11C8475AB55C7D6F4C76FA7B5C07621ABE639D9F1F6618C221061CC2DF3FD53CDFC59F204D037A5D492110BBC5750B33AD3988C2F2247EB4641822BCE8BEAED
Malicious:	false
Preview:	#line 1 "IO/Socket/UNIX.pm".# IO::Socket::UNIX.pm.#.# Copyright (c) 1997-8 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself...package IO::Socket::UNIX;..use strict;.our(@ISA, $VERSION);.use IO::Socket;.use Carp;..@ISA = qw(IO::Socket);.$VERSION = "1.26";.$VERSION = eval $VERSION;..IO::Socket::UNIX->register_domain( AF_UNIX );..sub new {. my $class = shift;. unshift(@_, "Peer") if @_ == 1;. return $class->SUPER::new(@_);.}..sub configure {. my($sock,$arg) = @_;. my($bport,$cport);.. my $type = $arg->{Type} \|\| SOCK_STREAM;.. $sock->socket(AF_UNIX, $type, 0) or..return undef;.. if(exists $arg->{Local}) {..my $addr = sockaddr_un($arg->{Local});..$sock->bind($addr) or.. return undef;. }. if(exists $arg->{Listen} && $type != SOCK_DGRAM) {..$sock->listen($arg->{Listen} \|\| 5) or.. return undef;. }. elsif(exists $arg->{Peer}) {..my $addr =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Uncompress\Adapter\Inflate.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3323
Entropy (8bit):	4.584870930012098
Encrypted:	false
SSDEEP:	96:8Ff/SoaYOBLQ9VFo3r3W6MRD+40414SBnA7r:8FyoaYqLQ9VFo7G6MF+4vnA7r
MD5:	80C28EB9845921AE03EAE15B7782125D
SHA1:	C1CB30C3ED39F50184701964381E8D72E0BE1520
SHA-256:	902F1B4734DB301F492472F73F7F15E14A3CED4F311A02F86EB353901576028F
SHA-512:	1372EA0B3A752BF5767EAF779FB7C3A4599234A198542EB3D79ADDC77C38855562BC1C16B61C60568A8921F5E000A4D475DD8E3A1F31B1F0521A8444A3D1CE57
Malicious:	false
Preview:	#line 1 "IO/Uncompress/Adapter/Inflate.pm".package IO::Uncompress::Adapter::Inflate;..use strict;.use warnings;.#use bytes;..use IO::Compress::Base::Common 2.069 qw(:Status);.use Compress::Raw::Zlib 2.069 qw(Z_OK Z_BUF_ERROR Z_STREAM_END Z_FINISH MAX_WBITS);..our ($VERSION);.$VERSION = '2.069';....sub mkUncompObject.{. my $crc32 = shift \|\| 1;. my $adler32 = shift \|\| 1;. my $scan = shift \|\| 0;.. my $inflate ;. my $status ;.. if ($scan). {. ($inflate, $status) = new Compress::Raw::Zlib::InflateScan. #LimitOutput => 1,. CRC32 => $crc32,. ADLER32 => $adler32,. WindowBits => - MAX_WBITS ;. }. else. {. ($inflate, $status) = new Compress::Raw::Zlib::Inflate. AppendOutput => 1,. LimitOutput => 1,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Uncompress\Base.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	36859
Entropy (8bit):	4.645480550140707
Encrypted:	false
SSDEEP:	384:5l9H9dOnojrrOpbpbE1tGRPWfSYimII8/iR98NTI6W9jtyXjV:5l9H9AojrrOp1bwYAbiPiRyYZtqV
MD5:	6E6B09BFBB90C5DFB144B736F5E0D1CE
SHA1:	4383579241F7B42DCBCCC8EEDC49F2504F418ACF
SHA-256:	6F8AFF39711F201EDABCD1DE5473E5CF842D23E14545AF1ADA192FFEC512F03A
SHA-512:	8D40EEE120D4FEF5DBFA7E7BDB73E10F2567CB13B7C8EB02B1AA6BC3AAE2C3020D67A1C0F34282F1797877D5A356E452F7F02B17E77A761B403CC456FE7360C3
Malicious:	false
Preview:	#line 1 "IO/Uncompress/Base.pm"..package IO::Uncompress::Base ;..use strict ;.use warnings;.#use bytes;..our (@ISA, $VERSION, @EXPORT_OK, %EXPORT_TAGS);.@ISA = qw(Exporter IO::File);...$VERSION = '2.069';..use constant G_EOF => 0 ;.use constant G_ERR => -1 ;..use IO::Compress::Base::Common 2.069 ;..use IO::File ;.use Symbol;.use Scalar::Util ();.use List::Util ();.use Carp ;..%EXPORT_TAGS = ( );.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;..sub smartRead.{. my $self = $_[0];. my $out = $_[1];. my $size = $_[2];. $$out = "" ;.. my $offset = 0 ;. my $status = 1;... if (defined $self->{InputLength}) {. return 0. if $self->{InputLengthRemaining} <= 0 ;. $size = List::Util::min($size, $self->{InputLengthRemaining});. }.. if ( length $self->{Prime} ) {. $$out = substr($self->{Prime}, 0, $size) ;. substr($self->{Prime}, 0, $size) = '' ;. if (length $$out == $size) {. *$self->{InputLengthRemaining} -= le

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Uncompress\Gunzip.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7457
Entropy (8bit):	5.01865391636643
Encrypted:	false
SSDEEP:	96:2b5YP9sooyhWqW5jfrdx1AW6iHsH3amWngwCRgbeCB7Yr4nm6XI6/gWxp0vXX3:2d4+obWz5jfbl640cnx354II6/gWz6X3
MD5:	828A37F4E476D2C036151E66265D1D4E
SHA1:	FE85D79F09C79990C331BFF94DD593D06CA1450B
SHA-256:	17E7849CF7E4941FC38D960942D22E95D8F1C4863F2A005D817480AF94DEFA7E
SHA-512:	7952B4ECC339BB968E549875582957EABFA032E5F8F568E0D963C8F2DB6A9329DE9B65423D73A9A0CF6A45B871981F0A820CEB5B6F41FDFFA8482DCE6A0BECFE
Malicious:	false
Preview:	#line 1 "IO/Uncompress/Gunzip.pm"..package IO::Uncompress::Gunzip ;..require 5.006 ;..# for RFC1952..use strict ;.use warnings;.use bytes;..use IO::Uncompress::RawInflate 2.069 ;..use Compress::Raw::Zlib 2.069 () ;.use IO::Compress::Base::Common 2.069 qw(:Status );.use IO::Compress::Gzip::Constants 2.069 ;.use IO::Compress::Zlib::Extra 2.069 ;..require Exporter ;..our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, $GunzipError);..@ISA = qw( Exporter IO::Uncompress::RawInflate );.@EXPORT_OK = qw( $GunzipError gunzip );.%EXPORT_TAGS = %IO::Uncompress::RawInflate::DEFLATE_CONSTANTS ;.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');..$GunzipError = '';..$VERSION = '2.069';..sub new.{. my $class = shift ;. $GunzipError = '';. my $obj = IO::Compress::Base::Common::createSelfTiedObject($class, \$GunzipError);.. $obj->_create(undef, 0, @_);.}..sub gunzip.{. my $obj = IO::Compress::Base::Common::createSelfTiedObject(undef, \$GunzipError);. return $obj->_i

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\IO\Uncompress\RawInflate.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8753
Entropy (8bit):	4.87561233866443
Encrypted:	false
SSDEEP:	192:GAQ4DgFT4NW1MAWLdiIeXMssdiZFnZcYK0y2w4HE/hweLknLWZjz:GAlgFr3kZweLJ
MD5:	63CE67105D6B488ECE9F5A4C3F702E5D
SHA1:	F3C58BA219BFC0ED69F689E922B6818D4F0ADDAF
SHA-256:	7E72839F0F418B11121F81364FF71B28D39C06EA7102F44891795AC861DCF419
SHA-512:	1F4A8CDD87C6439BDDCA55903070970BF55EB66156E0CD13A0FCEB05F236D95FD2475472B9AF29BCE96C953B19B6FA609D1DD93815C32D107C2FE7AAB14AD966
Malicious:	false
Preview:	#line 1 "IO/Uncompress/RawInflate.pm".package IO::Uncompress::RawInflate ;.# for RFC1951..use strict ;.use warnings;.#use bytes;..use Compress::Raw::Zlib 2.069 ;.use IO::Compress::Base::Common 2.069 qw(:Status );..use IO::Uncompress::Base 2.069 ;.use IO::Uncompress::Adapter::Inflate 2.069 ;..require Exporter ;.our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $RawInflateError);..$VERSION = '2.069';.$RawInflateError = '';..@ISA = qw( Exporter IO::Uncompress::Base );.@EXPORT_OK = qw( $RawInflateError rawinflate ) ;.%DEFLATE_CONSTANTS = ();.%EXPORT_TAGS = %IO::Uncompress::Base::EXPORT_TAGS ;.push @{ $EXPORT_TAGS{all} }, @EXPORT_OK ;.Exporter::export_ok_tags('all');..#{.# # Execute at runtime .# my %bad;.# for my $module (qw(Compress::Raw::Zlib IO::Compress::Base::Common IO::Uncompress::Base IO::Uncompress::Adapter::Inflate)).# {.# my $ver = ${ $module . "::VERSION"} ;.# .# $bad{$module} = $ver.# if $ver ne $VERSION;.#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	346924
Entropy (8bit):	4.784053628175274
Encrypted:	false
SSDEEP:	3072:ry1561cHzUvgoR7meAPq1I6hfK59sVQ9D99U375nsBh1My38UYxmWBRfVcEgB2Jr:rYAcTdoR7mtPTSS59aJspMy3Y+HEH6u
MD5:	9EC5315EF7FBB84669C6D8F6788A2AF0
SHA1:	4F8620A59505ADD4FB509204318F767C70CCE719
SHA-256:	4369D015EB45BAAD9121D7B452CA9A7F63C0B8E7C2B281FDEAFA0EED390F36ED
SHA-512:	F9518B25831445691FFA7E0912092A58734794BA27460781DCE4AF1D4C584E6E1858B15AD7D29CE1556307ABB7A4032E1C996FC87B5D1575811BE142ED397E5C
Malicious:	false
Preview:	#line 1 "Image/ExifTool.pm".#------------------------------------------------------------------------------.# File: ExifTool.pm.#.# Description: Read and write meta information.#.# URL: http://owl.phy.queensu.ca/~phil/exiftool/.#.# Revisions: Nov. 12/2003 - P. Harvey Created.# (See html/history.html for revision history).#.# Legal: Copyright (c) 2003-2018, Phil Harvey (phil at owl.phy.queensu.ca).# This library is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself..#------------------------------------------------------------------------------..package Image::ExifTool;..use strict;.require 5.004; # require 5.004 for UNIVERSAL::isa (otherwise 5.002 would do).require Exporter;.use File::RandomAccess;..use vars qw($VERSION $RELEASE @ISA @EXPORT_OK %EXPORT_TAGS $AUTOLOAD @fileTypes. %allTables @tableOrder $exifAPP1hdr $xmpAPP1hdr $xmpExtAPP1hdr. $psAPP13hd

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\AES.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16694
Entropy (8bit):	4.924171226045102
Encrypted:	false
SSDEEP:	192:GrH8UL1B5YVIJlPVWYmdrrIu5Mq6zo6wA86vw67A6DtPxPHA+7xby/68Q88+SgRS:GrHxJgttdHMqRdpNZGD7IZU4/AFIks+
MD5:	570FA511F9CD5117AE8FA0D9EB2EFC4A
SHA1:	969EEF3A1376FC795C7AE2A6158C4E6514236A3A
SHA-256:	B2C66E57FF0A95218543272B105634798C914E2233A3840D72107EA0F6E97E4D
SHA-512:	F7D225833D2CE4EECA818B714E6F378F9DD85B7B3BF28225297A0198F9379B224D1E3CD538BFED1F86133BFE7D43BCDEA74919D782D116A7F09099950E638F1F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/AES.pm".#------------------------------------------------------------------------------.# File: AES.pm.#.# Description: AES encryption with cipher-block chaining.#.# Revisions: 2010/10/14 - P. Harvey Created.#.# References: 1) http://www.hoozi.com/Articles/AESEncryption.htm.# 2) http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdf.# 3) http://www.faqs.org/rfcs/rfc3602.html.#------------------------------------------------------------------------------..package Image::ExifTool::AES;..use strict;.use vars qw($VERSION @ISA @EXPORT_OK);.require Exporter;..$VERSION = '1.01';.@ISA = qw(Exporter);.@EXPORT_OK = qw(Crypt);..my $seeded; # flag set if we already seeded random number generator.my $nr; # number of rounds in AES cipher.my @cbc; # cipher-block chaining bytes..# arrays (all unsigned character) to hold intermediate results during encryption.my @state = ([],[],[],[]); # the 2-dimensional state array.my

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\AFCP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9127
Entropy (8bit):	4.556743998602481
Encrypted:	false
SSDEEP:	192:cxiUUZVlWmNhuhl/aF/HtzwkmOEeZ92ilLkzziKTey4PsxQw:cxiUUZzWYfwkkELY5F
MD5:	2124211408B31C8461BC10E942CE812C
SHA1:	D65E53F4072AEC8AE428CC97B81C090350F804B2
SHA-256:	C180149608D37DE5F04A953B8084946410235075EAC3D23E292D4BAB3C55A912
SHA-512:	E9B912F926BF10A44620B82D6D3292F3AF9062AE76A1F63511F9D20E1FCB984E74DA3797F4B7EC85FE42EC1A48354CD12FEA2B38C2281F163F0F4C6A556B322D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/AFCP.pm".#------------------------------------------------------------------------------.# File: AFCP.pm.#.# Description: Read/write AFCP trailer.#.# Revisions: 12/26/2005 - P. Harvey Created.#.# References: 1) http://web.archive.org/web/20080828211305/http://www.tocarte.com/media/axs_afcp_spec.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::AFCP;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.08';..sub ProcessAFCP($$);..%Image::ExifTool::AFCP::Main = (. PROCESS_PROC => \&ProcessAFCP,. NOTES => q{.AFCP stands for AXS File Concatenation Protocol, and is a poorly designed.protocol for appending information to the end of files. This can be used as.an auxiliary technique to store IPTC information in images, but is.incompatible with some file formats...ExifTool will read and write (but not create) AFCP IPTC information in JPEG.and TIFF im

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\AIFF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8144
Entropy (8bit):	5.033741724431239
Encrypted:	false
SSDEEP:	192:6wod7ZDqKbZdnLVtSA+4s7PZH8UnvCO2SxakWR:6wod7ZDqKDLNo7RWp
MD5:	76EA5220C0DD73A3DACCD8F732E4D157
SHA1:	51E2E080D6D5FD65677433E7C4B7EB66282BF3EC
SHA-256:	EC496A54C2261D8B75368391E68869542D2CEDDBD6B061E7068DA8E3992CFE6E
SHA-512:	9C67E2FFE08D39C54D2F93293D00BAC272084B9C9D4BA403D4FF791D80DC7F7AE34E84764536F4E4BFC06C6274F48F9DFF0D00469EDB39DF8253735AC3B1DF04
Malicious:	false
Preview:	#line 1 "Image/ExifTool/AIFF.pm".#------------------------------------------------------------------------------.# File: AIFF.pm.#.# Description: Read AIFF meta information.#.# Revisions: 01/06/2006 - P. Harvey Created.# 09/22/2008 - PH Added DjVu support.#.# References: 1) http://developer.apple.com/documentation/QuickTime/INMAC/SOUND/imsoundmgr.30.htm#pgfId=3190.# 2) http://astronomy.swin.edu.au/~pbourke/dataformats/aiff/.# 3) http://www.mactech.com/articles/mactech/Vol.06/06.01/SANENormalized/.#------------------------------------------------------------------------------..package Image::ExifTool::AIFF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::ID3;..$VERSION = '1.08';..# information for time/date-based tags (time zero is Jan 1, 1904).my %timeInfo = (. Groups => { 2 => 'Time' },. ValueConv => 'ConvertUnixTime($val - ((66 * 365 + 17) * 24 * 3600))',. PrintConv =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\APE.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8510
Entropy (8bit):	4.923825950210569
Encrypted:	false
SSDEEP:	192:pt0W5fB0I9hoIc76i/tR3srTSC5iqb+vgtivHozLmrhEMmXkcCyMneWx:v0W5fB9vC38RkvIzLmdE5Xu3
MD5:	B994FBB8B497CEDA290DB8F3CC61CDF1
SHA1:	31632FC3E3BBE6A5DE8A571C37DCC171C1D14335
SHA-256:	8E4D3707418019BC43250C444D7288693B21BD0542C826FA69673FE14926DE9A
SHA-512:	70BF4E118056F010106509B7F919F42594EC0F2226A46FD6175191F7D75E22FD15B8A0D1245FE23712435FE75E58599E989270E9937DF923AE90E629BD797216
Malicious:	false
Preview:	#line 1 "Image/ExifTool/APE.pm".#------------------------------------------------------------------------------.# File: APE.pm.#.# Description: Read Monkey's Audio meta information.#.# Revisions: 11/13/2006 - P. Harvey Created.#.# References: 1) http://www.monkeysaudio.com/.# 2) http://www.personal.uni-jena.de/~pfk/mpp/sv8/apetag.html.#------------------------------------------------------------------------------..package Image::ExifTool::APE;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.05';..# APE metadata blocks.%Image::ExifTool::APE::Main = (. GROUPS => { 2 => 'Audio' },. NOTES => q{. Tags found in Monkey's Audio (APE) information. Only a few common tags are. listed below, but ExifTool will extract any tag found. ExifTool supports. APEv1 and APEv2 tags, as well as ID3 information in APE files, and will also. read APE metadata from MP3 and MPC files.. },. Album =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\APP12.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10070
Entropy (8bit):	4.865082295986083
Encrypted:	false
SSDEEP:	192:RknoW7te3HDD6cVkL1dsVfzfVyafIwVDDztiRQWCLc8gvOkttfQ5:RCoBSdwVskdgvA
MD5:	B9C1F4F38FB0126AE61CBDA4438E4DD8
SHA1:	4E11497D62F5C26A481169F2D2BD187F7FF42271
SHA-256:	622F4B01DDEE8F695FAB69E797B8E5C4CE641F5C4201E834E4298E8C4FB09E1F
SHA-512:	4BB3814E2D4D37963B5EF31C0215C93E7FC0F2E08C58F0F5CD91E54DB8304F6AAD2190B95D0059ECCFE0C32F57FB72E60592669025D1698845F4396F65F77EE8
Malicious:	false
Preview:	#line 1 "Image/ExifTool/APP12.pm".#------------------------------------------------------------------------------.# File: APP12.pm.#.# Description: Read APP12 meta information.#.# Revisions: 10/18/2005 - P. Harvey Created.#.# References: 1) Heinrich Giesen private communication.#------------------------------------------------------------------------------..package Image::ExifTool::APP12;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.13';..sub ProcessAPP12($$$);.sub ProcessDucky($$$);.sub WriteDucky($$$);..# APP12 tags (ref PH).%Image::ExifTool::APP12::PictureInfo = (. PROCESS_PROC => \&ProcessAPP12,. GROUPS => { 0 => 'APP12', 1 => 'PictureInfo', 2 => 'Image' },. PRIORITY => 0,. NOTES => q{. The JPEG APP12 "Picture Info" segment was used by some older cameras, and. contains ASCII-based meta information. Below are some tags which have been. observed Agfa and Polaroid images, however ExifTool

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\ASF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	29773
Entropy (8bit):	5.074950924206094
Encrypted:	false
SSDEEP:	384:EGGR0GFHArqly0qqv2XzwLDZVlIanWF1j995jzITioB+prgOn1mgXHXSn:EGGR0GFHQ7zxjX5YTioBIgKW
MD5:	997CC291F6AF9043E95112C6D11AC8F7
SHA1:	8083928570ECA3B482017B8FBF5907BF5F62B0E0
SHA-256:	2EE3CA83375DB3E07E8EEE3039DA4B2D7FAEC7C0ECF7B5EDBDD615749BF44CB6
SHA-512:	1A1223A62ABBDFDD065F40FD5E773A50110496C632322E6307E28A6CFF6B33D847537E8E728560F0AE46D15CACFA5C91377DB3EBAB3CE6D95D4D890027C4490C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/ASF.pm".#------------------------------------------------------------------------------.# File: ASF.pm.#.# Description: Read ASF/WMA/WMV meta information.#.# Revisions: 12/23/2005 - P. Harvey Created.#.# References: 1) http://www.microsoft.com/windows/windowsmedia/format/asfspec.aspx.# 2) http://www.adobe.com/devnet/xmp/pdfs/XMPSpecificationPart3.pdf (Oct 2008).#------------------------------------------------------------------------------..package Image::ExifTool::ASF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::RIFF;..$VERSION = '1.24';..sub ProcessASF($$;$);.sub ProcessContentDescription($$$);.sub ProcessExtendedContentDescription($$$);.sub ProcessMetadata($$$);.sub ProcessPicture($$$);.sub ProcessCodecList($$$);..# GUID definitions.my %errorCorrection = (. '20FB5700-5B55-11CF-A8FD-00805F5C442B' => 'No Error Correction',. 'BFC3CD50-618F-11CF-8

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Apple.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4931
Entropy (8bit):	5.013920718730815
Encrypted:	false
SSDEEP:	96:bL6FVHtm1X3re34H8v9j3hfUdb3MQSHKDhG9nF9CPym2PyNGuNGh:ewX3reIH8vF3h86Q9lGv9CcPyUHh
MD5:	9DA24B9A35161BCBDD8BA49EDF59C7F5
SHA1:	B0284581A7D90BA97FE4004B242AFF241E0925A8
SHA-256:	3FBD4B10CCEBBB08D38110642C5F2195118D9BBE623C725E02699BC5833F62BA
SHA-512:	5105B761C2E1747FB1BDD6BCC5932B67B4DFECBE0B65F9F3B80678518CB603238F46A55DA480DB48D658EC0E775A6F592225D636802E1284FB87378020959D53
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Apple.pm".#------------------------------------------------------------------------------.# File: Apple.pm.#.# Description: Apple EXIF maker notes tags.#.# Revisions: 2013-09-13 - P. Harvey Created.#.# References: 1) http://www.photoinvestigator.co/blog/the-mystery-of-maker-apple-metadata/.#------------------------------------------------------------------------------..package Image::ExifTool::Apple;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;.use Image::ExifTool::PLIST;..$VERSION = '1.04';..# Apple iPhone metadata (ref PH).%Image::ExifTool::Apple::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. WRITABLE => 1,. GROUPS => { 0 => 'MakerNotes', 2 => 'Image' },. NOTES => 'Tags extracted from the maker notes of iPhone images.',. # 0x0001 - int32s: seen 0,1,2,3,4,9. # 0x0002 - binary plist with a single data object of size 512 bytes (iPhone5s). 0x00

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Audible.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11072
Entropy (8bit):	4.8965592899264125
Encrypted:	false
SSDEEP:	192:1esbFvc8FmbzA8dMf4vYquDBmeMVQWX68E5BWoSD8tiJEK9zluQRpRQkDr8bAQP5:1eslc8FmbzhdgEYqlh7zN92PUjI5
MD5:	C6D9DC0212D0DDBDBE6FF2CD00C85D68
SHA1:	B25B75DF2BAAD868ACD65FCC30A66FD27C908EBC
SHA-256:	509F004B854AA7921325D09FE7CE4B64D816374AEB134E50F48BB0DF2D4E0174
SHA-512:	6E949134D73AE9F0F918722F0706EB80463FC02873181D636E1D0AF430835490B4F585341AF3CDCC8DDFC5E3464CEB0A07F4E4DCFC6E1E61D135B95E585B1860
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Audible.pm".#------------------------------------------------------------------------------.# File: Audible.pm.#.# Description: Read metadata from Audible audio books.#.# Revisions: 2015/04/05 - P. Harvey Created.#.# References: 1) https://github.com/jteeuwen/audible.# 2) https://code.google.com/p/pyaudibletags/.# 3) http://wiki.multimedia.cx/index.php?title=Audible_Audio.#------------------------------------------------------------------------------..package Image::ExifTool::Audible;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..sub ProcessAudible_meta($$$);.sub ProcessAudible_cvrx($$$);..%Image::ExifTool::Audible::Main = (. GROUPS => { 2 => 'Audio' },. NOTES => q{. ExifTool will extract any information found in the metadata dictionary of. Audible .AA files, even if not listed in the table below.. },. # tags found in the metadata dictionary

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\BMP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9993
Entropy (8bit):	4.870085722830555
Encrypted:	false
SSDEEP:	192:aWU/DvEDOem5yQ6htvYv2S3H3JQa+7v9oboqXdN+0FpTiQWU:BoD1eJk6v9Uo8j53
MD5:	DFDD22F82829F7971608052803B29782
SHA1:	68F90E454D8A15F2F2EFDB17E7BCE5E8A097FA0D
SHA-256:	E8721C4947599A2D50BE70576BC56BF4F97F2A235340AA8EEDB0FC824B454F59
SHA-512:	95FC3190733276E168C6800743DB82A1F4187BE9E9DE5A25456CB05094604926B238C876A65C269FDC07432D3BED29E0F31BCAD474B53131BADAA4FDB7F162BB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/BMP.pm".#------------------------------------------------------------------------------.# File: BMP.pm.#.# Description: Read BMP meta information.#.# Revisions: 07/16/2005 - P. Harvey Created.#.# References: 1) http://www.fortunecity.com/skyscraper/windows/364/bmpffrmt.html.# 2) http://www.fourcc.org/rgb.php.# 3) https://msdn.microsoft.com/en-us/library/dd183381(v=vs.85).aspx.#------------------------------------------------------------------------------..package Image::ExifTool::BMP;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.09';..# conversions for fixed-point 2.30 format values.my %fixed2_30 = (. ValueConv => q{. my @a = split ' ', $val;. $_ /= 0x40000000 foreach @a;. "@a";. },. PrintConv => q{. my @a = split ' ', $val;. $_ = sprintf('%.6f', $_) foreach @a;. "@a";. },.);..# BMP chunks.%Image::ExifTool::BMP::Main =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\BPG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7171
Entropy (8bit):	4.853936488716383
Encrypted:	false
SSDEEP:	192:w4/FFkRKJvw8voMBF4+Q/4DSQd0Bvd61B5Hz6V7nE7QWfI:w+uK1w4mF4A6A7OI
MD5:	4676737D725A6FEAB698E575A20AEB15
SHA1:	3F1CCCB61BD66F0591DB9C5B1F1B30C866D862A2
SHA-256:	825490C80D4CE754FFCEDE8A8E385908E366A8F4BD4E439BEEB9F5C19EFA4F84
SHA-512:	C4AD55BC1B8A91205528321962CE4952D6325DFD1131FBFBE3AA471963A2AB9363613556294E23BA5E7F7EFA456F70D1AD96A6F66A0DF3CE24A897AE173C4DE7
Malicious:	false
Preview:	#line 1 "Image/ExifTool/BPG.pm".#------------------------------------------------------------------------------.# File: BPG.pm.#.# Description: Read BPG meta information.#.# Revisions: 2016-07-05 - P. Harvey Created.#.# References: 1) http://bellard.org/bpg/.#------------------------------------------------------------------------------..package Image::ExifTool::BPG;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.00';..# BPG information.%Image::ExifTool::BPG::Main = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. GROUPS => { 0 => 'File', 1 => 'File', 2 => 'Image' },. NOTES => q{. The information listed below is extracted from BPG (Better Portable. Graphics) images. See L<http://bellard.org/bpg/> for the specification.. },. 4 => {. Name => 'PixelFormat',. Format => 'int16u',. Mask => 0xe000,. PrintConv => {. 0x0000 => 'Grayscale',. 0x200

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\BZZ.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16785
Entropy (8bit):	4.749270029946329
Encrypted:	false
SSDEEP:	192:B58VgzUyPDR2NcFt0xFYHCgTq/PQPs/AihKZd2yixSCgrpNdiVsna8yPdD8XUrhq:P8VOye2FoYSMKP35iOyc7u7pGw7v2aE
MD5:	0E92D323D6F627549422D715ED1428B5
SHA1:	14A7DE6366C87B754A1444FAECC8D37CAF021833
SHA-256:	31D4B896D65340EDE5AA88ED3AA4D656E4AC3E711BFE3056BB4DB8C0EF7CC6C7
SHA-512:	B7E724E6711FA8DEFB450A6D5924D5168F0254E20F6CBABD3BD97F666DD60478C28FC3790C58723E271C18E9E8652552F90F5D5759813668D2A71265E70E2D70
Malicious:	false
Preview:	#line 1 "Image/ExifTool/BZZ.pm".#------------------------------------------------------------------------------.# File: BZZ.pm.#.# Description: Utility to decode BZZ compressed data.#.# Revisions: 09/22/2008 - P. Harvey Created.#.# References: 1) http://djvu.sourceforge.net/.# 2) http://www.djvu.org/.#.# Notes: This code based on ZPCodec and BSByteStream of DjVuLibre 3.5.21.# (see NOTES documentation below for license/copyright details).#------------------------------------------------------------------------------..package Image::ExifTool::BZZ;..use strict;.use integer; # IMPORTANT!! use integer arithmetic throughout.require Exporter;.use vars qw($VERSION @ISA @EXPORT_OK);..$VERSION = '1.00';.@ISA = qw(Exporter);.@EXPORT_OK = qw(Decode);..# constants.sub FREQMAX { 4 }.sub CTXIDS { 3 }.sub MAXBLOCK { 4096 }..# This table has been designed for the ZPCoder.# by running the following command in file 'zptable.sn':.# (fast-crude (steady-

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\BigTIFF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10275
Entropy (8bit):	4.509579820230627
Encrypted:	false
SSDEEP:	192:1gOtc68fBMg1AaiNeQEqERyDyARfdsrYyY/yVAYypgSg6+SXwXOv60TSLCDEhqwg:5tc68mRpcaRR1eY52LkWOvxEhqyEXL3p
MD5:	6937FF2D9164EF74DEC41F228A99B373
SHA1:	3B1C14A22462552D49EF9B965FBEC8076200E257
SHA-256:	E6C806A60C0C6E2C9A53213DA7973323DF6861207129CE9417B227C1EBBBCB79
SHA-512:	AC020D95B011086F7B85397BC9C3492544D77F63EA5DB5B39D87D0D99770AA15EFE30C5A9CE852674D26A4625ECC538F78903491772F2DD4336B77B1728FEE5C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/BigTIFF.pm".#------------------------------------------------------------------------------.# File: BigTIFF.pm.#.# Description: Read Big TIFF meta information.#.# Revisions: 07/03/2007 - P. Harvey Created.#.# References: 1) http://www.awaresystems.be/imaging/tiff/bigtiff.html.#------------------------------------------------------------------------------..package Image::ExifTool::BigTIFF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.06';..my $maxOffset = 0x7fffffff; # currently supported maximum data offset/size..#------------------------------------------------------------------------------.# Process Big IFD directory.# Inputs: 0) ExifTool object ref, 1) dirInfo ref, 2) tag table ref.# Returns: 1 on success, otherwise returns 0 and sets a Warning.sub ProcessBigIFD($$$).{. my ($et, $dirInfo, $tagTablePtr) = @_;. my $raf = $$dirInfo{RAF};. my $verbose = $$et{OPTION

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\BuildTagLookup.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	113491
Entropy (8bit):	4.55534156588026
Encrypted:	false
SSDEEP:	3072:o4oqpDPUEURK4VdtK2SILfmZM3DR6FDK0:oS4tKk45x
MD5:	C2EE854DB8C287893E7D8A06C3B7B0E1
SHA1:	0885D1B58A4AD3E8E0899AE7E602B9B22907D3C9
SHA-256:	926CF41ACD71C4BBE4C193F923810D19368FD38670460ABB4CB255A0C17E201B
SHA-512:	7BCD777DC3BD617F6368347CAF0E9A77DDC63E294A172FF62ADC102FF23945278978E463C90405BFA281F8F01A9DA61CB4068207C6F20616A51EE3654AF389BD
Malicious:	false
Preview:	#line 1 "Image/ExifTool/BuildTagLookup.pm".#------------------------------------------------------------------------------.# File: BuildTagLookup.pm.#.# Description: Utility to build tag lookup tables in Image::ExifTool::TagLookup.pm.#.# Revisions: 12/31/2004 - P. Harvey Created.# 02/15/2005 - PH Added ability to generate TagNames documentation.#.# Notes: Documentation for the tag tables may either be placed in the.# %docs hash below or in a NOTES entry in the table itself, and.# individual tags may have their own Notes entry..#------------------------------------------------------------------------------..package Image::ExifTool::BuildTagLookup;..use strict;.require Exporter;..BEGIN {. # prevent ExifTool from loading the user config file. $Image::ExifTool::configFile = '';. $Image::ExifTool::debug = 1; # enabled debug messages.}..use vars qw($VERSION @ISA);.use Image::ExifTool qw(:Utils :Vars);.use Image::ExifTool::

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CVS\Entries

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6873
Entropy (8bit):	4.82555078905767
Encrypted:	false
SSDEEP:	96:t0ZH1ss3OpyhXOEuRO+1OFwyWo8QziGiFzDJ/z9VrtEwI85HSI:tAOkXoRO+1OFwyWo8QziGi/rtEG3
MD5:	2FF8DE820BE921E43C645D36A266C9C6
SHA1:	F20507E787D1099B8192A70A25A9630E7F58AC3B
SHA-256:	62E841FF5372444EFEFDA689C9825B08A1A5D2161BFA57FE5A42A37AEFAADE89
SHA-512:	D2462102F70720A6FDC04E267353EC338896E465D28F571A112221ECBD7FEA8793D204501A325744AC62ACBBEBEF2BF9B60ABB1E858D22A1A045ACF893062F99
Malicious:	false
Preview:	D/Charset////.D/Lang////./AES.pm/1.34/Tue Jan 2 16:24:21 2018//./APE.pm/1.38/Tue Jan 2 16:24:21 2018//./APP12.pm/1.47/Tue Jan 2 16:24:21 2018//./Apple.pm/1.38/Tue Jan 2 16:24:21 2018//./Audible.pm/1.31/Tue Jan 2 16:24:22 2018//./BMP.pm/1.48/Tue Jan 2 16:24:22 2018//./BPG.pm/1.15/Tue Jan 2 16:24:22 2018//./BZZ.pm/1.26/Tue Jan 2 16:24:22 2018//./BigTIFF.pm/1.26/Tue Jan 2 16:24:22 2018//./CanonCustom.pm/1.148/Tue Jan 2 16:24:22 2018//./CanonRaw.pm/1.188/Tue Jan 2 16:24:22 2018//./CaptureOne.pm/1.23/Tue Jan 2 16:24:22 2018//./Casio.pm/1.136/Tue Jan 2 16:24:22 2018//./Charset.pm/1.56/Tue Jan 2 16:24:22 2018//./DICOM.pm/1.76/Tue Jan 2 16:24:22 2018//./DJI.pm/1.6/Tue Jan 2 16:24:22 2018//./DNG.pm/1.96/Tue Jan 2 16:24:22 2018//./DPX.pm/1.19/Tue Jan 2 16:24:22 2018//./DV.pm/1.19/Tue Jan 2 16:24:22 2018//./DjVu.pm/1.20/Tue Jan 2 16:24:22 2018//./EXE.pm/1.88/Tue Jan 2 16:24:22 2018//./FLIF.pm/1.22/Tue Jan 2 16:24:22 2018//./Fixup.pm/1.33/Tue Jan 2 16:24:22 2018//./FotoStati

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CVS\Repository

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.826874881864639
Encrypted:	false
SSDEEP:	3:E3Ly3:E3Ly3
MD5:	9B50DF67D5C1D5EB6D34A1B60897BCBC
SHA1:	337EA4C7BD211FDF74E7B203FF32D816BE90233B
SHA-256:	3FCA4111E9E41C4597E0E7B1FEF8336E2D0924F689805151A81C1C95DC992B03
SHA-512:	651B1EB26F59A45871C49CC8C77E27C4E1B1BDE65161641FE2C7515C9CB58DF9F6D5F839C03FD403E085D02D61CBBA46526B7B84DFCF4407EBC64ED506AE08A3
Malicious:	false
Preview:	lib/Image/ExifTool.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CVS\Root

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.542682803033967
Encrypted:	false
SSDEEP:	3:ARfVN5SLFViBKVW/AODRKmn:A5nWqBBAsRKmn
MD5:	40B9335FD2F3C1F68FD22B7364EA1D8B
SHA1:	E79514C2E349DFACEE74A8470848ADA647AA0E4B
SHA-256:	3641791FE2F62C505B05DA9CE982EBB341139C18B2C92C19A02A99BABB2F39D3
SHA-512:	A2A9A8EAF44765B255B9B71EB96EC89D13929D256D204FA5E862CA6EE112828D4967FF8B85326AB68F45C2DBAE7AF142632B73B94AD4C5E488210D1C3D5EBAE3
Malicious:	false
Preview:	:ext:phil@130.15.24.88:/Users/phil/cvs/exiftool2.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Canon.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	349512
Entropy (8bit):	4.951753235335787
Encrypted:	false
SSDEEP:	3072:3eARX7Jt7u+yfjtB3zbjzoQo1mROMNuwiQ2MyKdHhj5LlPVUdB84DFSTEW:3eARX7nFyD1dBOB84DFg
MD5:	2943A66C0EE6911CA91CD11E88E2613F
SHA1:	5D307BDF6120A64657B12308F26A33F72896CB36
SHA-256:	931FE39B57B490592862B47A40814835BDB363A47B04AB6A227E98DDDAB0780A
SHA-512:	C67C70BED7B133D72FB16E9613434EC13A56E81D2454F8AFE38F33CEA7FC1F8A84599DA8BA46EBEE8576148CF885794C50FF4A6EFC9EEF2AE470604DF0EE6C3C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Canon.pm".#------------------------------------------------------------------------------.# File: Canon.pm.#.# Description: Canon EXIF maker notes tags.#.# Revisions: 11/25/2003 - P. Harvey Created.# 12/03/2003 - P. Harvey Decode lots more tags and add CanonAFInfo.# 02/17/2004 - Michael Rommel Added IxusAFPoint.# 01/27/2005 - P. Harvey Disable validation of CanonAFInfo.# 01/30/2005 - P. Harvey Added a few more tags (ref 4).# 02/10/2006 - P. Harvey Decode a lot of new tags (ref 12).# [ongoing] - P. Harvey Constantly decoding new information.#.# Notes: Must check FocalPlaneX/YResolution values for each new model!.#.# References: 1) http://park2.wakwak.com/~tsuruzoh/Computer/Digicams/exif-e.html.# 2) Michael Rommel private communication (Digital Ixus).# 3) Daniel Pittman private communication (PowerShot S70).# 4) http:/

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CanonCustom.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	77639
Entropy (8bit):	4.458292722781166
Encrypted:	false
SSDEEP:	768:p6wV38TEw2c0YajjBrPOTv9cyKuaGoj+htnzy:4wN8TEw28ujBbOTm4h4Y2
MD5:	B173492C8B878D54CE5263F3ADEB2E73
SHA1:	4476520A503753E2D97728CB00E21FBD251BDFFE
SHA-256:	B7D3A6A04987194DC65B87C6AC55CA92B78EC0F8BC63BEEEB634A2D291E1D26D
SHA-512:	3B892EAA7A13244DC8A3B4B02B042C7856D7AB7DCEBB101219EF1DA8F1E042D22FA7029A6AD9C32E9BC02B911130985B2ACACBF63081769E8A0CF7550AE28BEE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/CanonCustom.pm".#------------------------------------------------------------------------------.# File: CanonCustom.pm.#.# Description: Read and write Canon Custom functions.#.# Revisions: 11/25/2003 - P. Harvey Created.#.# References: 1) http://park2.wakwak.com/~tsuruzoh/Computer/Digicams/exif-e.html.# 2) Christian Koller private communication (20D).# 3) Rainer Honle private communication (5D).# 4) David Pitcher private communication (1DmkIII firmware upgrade).#------------------------------------------------------------------------------..package Image::ExifTool::CanonCustom;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess);.use Image::ExifTool::Canon;.use Image::ExifTool::Exif;..$VERSION = '1.54';..sub ProcessCanonCustom($$$);.sub ProcessCanonCustom2($$$);.sub WriteCanonCustom($$$);.sub WriteCanonCustom2($$$);.sub CheckCanonCustom($$$);.sub ConvertPFn($);.sub ConvertPFnInv($);..my

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CanonRaw.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	29147
Entropy (8bit):	4.787669061325762
Encrypted:	false
SSDEEP:	384:yzKiHaYWsrH9vb3bQbwPbsbLbYbA3OAuyEGCnbni09t5I6sfF6/ATJYU7lDEhtaM:yzH6HuyGbnh/MJYUROExtM
MD5:	A72EDDBE507849EF30CFE9C357A05D4F
SHA1:	360A6BAE01BD938CC181BABAB3F14A872E8F3DD2
SHA-256:	14E79CB0CAD9C2FE7E26FA0C105E3B05BA5901951318131418CF3F62131078AF
SHA-512:	E05BEF46445A07958FE251973F6FE8842997B1777E26A136EF30779D4144069DB80947171115BA55B50930960E060EA17D448B4F1243DCA12CFE991D6F0FEEE4
Malicious:	false
Preview:	#line 1 "Image/ExifTool/CanonRaw.pm".#------------------------------------------------------------------------------.# File: CanonRaw.pm.#.# Description: Read Canon RAW (CRW) meta information.#.# Revisions: 11/25/2003 - P. Harvey Created.# 12/02/2003 - P. Harvey Completely reworked and figured out many.# more tags.#.# References: 1) http://www.cybercom.net/~dcoffin/dcraw/.# 2) http://www.wonderland.org/crw/.# 3) http://xyrion.org/ciff/CIFFspecV1R04.pdf.# 4) Dave Nicholson private communication (PowerShot S30).#------------------------------------------------------------------------------..package Image::ExifTool::CanonRaw;..use strict;.use vars qw($VERSION $AUTOLOAD %crwTagFormat);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::Canon;..$VERSION = '1.58';..sub WriteCRW($$);.sub ProcessCanonRaw($$$);.sub WriteCanonRaw($$$);.sub CheckCanonRaw($$$);.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CanonVRD.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	75291
Entropy (8bit):	4.794695780595656
Encrypted:	false
SSDEEP:	1536:j6U+TJ0NZ9okXDiU4v2zahhRZ8+Is3bj5:j6U+gzYhRhb9
MD5:	2F18AB00E36F0319FE84ABD046227C5E
SHA1:	63FDB5CE2D848F7E1D1078FFDFA13E6679A82EA5
SHA-256:	2D245E6F5FD34EE3C54FDBBC400DF7D43D088E31B84657AE867A46B3E5AB40A1
SHA-512:	FF4E766471A8469D772655ACC50CE9BF30EA0E1BA2E92C8B53F3B557F29E1272E317D051026421A1F78512C7070D35759A6E48CB01B20FEA97C9AB362D365A34
Malicious:	false
Preview:	#line 1 "Image/ExifTool/CanonVRD.pm".#------------------------------------------------------------------------------.# File: CanonVRD.pm.#.# Description: Read/write Canon VRD and DR4 information.#.# Revisions: 2006/10/30 - P. Harvey Created.# 2007/10/23 - PH Added new VRD 3.0 tags.# 2008/08/29 - PH Added new VRD 3.4 tags.# 2008/12/02 - PH Added new VRD 3.5 tags.# 2010/06/18 - PH Support variable-length CustomPictureStyle data.# 2010/09/14 - PH Added r/w support for XMP in VRD.# 2015/05/16 - PH Added DR4 support (DPP 4.1.50.0).# 2018/03/13 - PH Update to DPP 4.8.20.#.# References: 1) Bogdan private communication (Canon DPP v3.4.1.1).# 2) Gert Kello private communiation (DPP 3.8).#------------------------------------------------------------------------------..package Image::ExifTool::CanonVRD;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\CaptureOne.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7360
Entropy (8bit):	4.8407803249373
Encrypted:	false
SSDEEP:	192:VbHQR4QyNQwVhKl3RtqH0yKk5NWwDiztgDgDPE0Y45REWq:JHQRKhKlGBKk5ItgD+PB6
MD5:	8E5B0FC9428BFD8D2BEBE0090725AFAE
SHA1:	787D2C36ED4D33DD9829827E5E6D885341596C3D
SHA-256:	732085CF1EEB981720B42F63E43262A37A670634350D40BCC4E3838E4D2F6640
SHA-512:	F02B45A58501AE0B6763391EFB1BB1B596D792B185C6F84616F7CC103583F438E8259447A59B2E9327847E9E32BA625BBA1257AF131246DE8066FFC8A26CADAC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/CaptureOne.pm".#------------------------------------------------------------------------------.# File: CaptureOne.pm.#.# Description: Read Capture One EIP and COS files.#.# Revisions: 2009/11/01 - P. Harvey Created.#.# Notes: The EIP format is a ZIP file containing an image (IIQ or TIFF).# and some settings files (COS). COS files are XML based..#------------------------------------------------------------------------------..package Image::ExifTool::CaptureOne;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::XMP;.use Image::ExifTool::ZIP;..$VERSION = '1.04';..# CaptureOne COS XML tags.# - tags are added dynamically when encountered.# - this table is not listed in tag name docs.%Image::ExifTool::CaptureOne::Main = (. GROUPS => { 0 => 'XML', 1 => 'XML', 2 => 'Image' },. PROCESS_PROC => \&Image::ExifTool::XMP::ProcessXMP,. VARS => { NO_ID => 1 },. ColorCorrections => {

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Casio.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	62923
Entropy (8bit):	4.309160649707504
Encrypted:	false
SSDEEP:	768:vzj3J5v1noMGWeDJnRUOu1nvNqAzkYdBE:rjZ51noMGWeDJnRUOu1nvNqAzkYdBE
MD5:	308407B2E905A721AD8FC0846C15A1F3
SHA1:	3281BD089AD0CC5384245567AFE4264AA7F190D6
SHA-256:	5F2E7B7522A72EB063E5F8A1E3C092D40F6E2D1AFAEF9D6DC99240C898E1B0ED
SHA-512:	E44773831D2FC1B60D256C5AFE4A43BA8EEA23F72B1C7F8E5C9F99B2480F30CCDEB1138F58EB2F0A32EE2BFE113ADCD1B770D0DAE042EFFD7A1FBBE91963F445
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Casio.pm".#------------------------------------------------------------------------------.# File: Casio.pm.#.# Description: Casio EXIF maker notes tags.#.# Revisions: 12/09/2003 - P. Harvey Created.# 09/10/2004 - P. Harvey Added MakerNote2 (thanks to Joachim Loehr).#.# References: 1) http://park2.wakwak.com/~tsuruzoh/Computer/Digicams/exif-e.html.# 2) Joachim Loehr private communication.# 3) http://homepage3.nifty.com/kamisaka/makernote/makernote_casio.htm.# 4) http://gvsoft.homedns.org/exif/makernote-casio-type1.html.# 5) Robert Chi private communication (EX-F1).# 6) http://u88.n24.queensu.ca/exiftool/forum/index.php/topic,3701.html.# JD) Jens Duttke private communication.#------------------------------------------------------------------------------..package Image::ExifTool::Casio;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;..$VERS

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	15211
Entropy (8bit):	4.575734764224855
Encrypted:	false
SSDEEP:	192:3spPbHvcldNrZo6AX/OiQgoAiQ6cmiau3SjpY1mxcyqJPsyajfovYBJXkJiTXCSz:3spLmo6E/mfuT6Hf3GLY14zAMTr7iCc
MD5:	C00CF57ED635A337E1030E82CB31DCFA
SHA1:	64175135A123B62582991EF28AC4608338C08AE2
SHA-256:	81B47792DA50425F538B3CBC66A15216ED6E7CC76F073DB6AF15FB7AD129A125
SHA-512:	0B8A794F0A2D63C5409737C52EFC1D366C78F3EB13FD77811CAD64D565160F808E1F9FF3B7EF6A7FF4A116560DFB718182EB5E83B9C2CAEBABC8659A784A0B41
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset.pm".#------------------------------------------------------------------------------.# File: Charset.pm.#.# Description: ExifTool character encoding routines.#.# Revisions: 2009/08/28 - P. Harvey created.# 2010/01/20 - P. Harvey complete re-write.# 2010/07/16 - P. Harvey added UTF-16 support.#------------------------------------------------------------------------------..package Image::ExifTool::Charset;..use strict;.use vars qw($VERSION %csType);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.11';..my %charsetTable; # character set tables we've loaded..# lookup for converting Unicode to 1-byte character sets.my %unicode2byte = (. Latin => { # pre-load Latin (cp1252) for speed. 0x20ac => 0x80, 0x0160 => 0x8a, 0x2013 => 0x96,. 0x201a => 0x82, 0x2039 => 0x8b, 0x2014 => 0x97,. 0x0192 => 0x83, 0x0152 => 0x8c, 0x02dc => 0x98,. 0x201e => 0x84, 0x017d => 0x8e, 0x2122 => 0x99,. 0x202

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Arabic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.527386800782909
Encrypted:	false
SSDEEP:	24:TOyOVjaFpd+5F6TClThNZwtRDM4QyjS6F7vrXI0HwxWbfLI4G929YNDlEclofC4U:EaPd66WNgANyl36P9Fif585cwiQ
MD5:	A2534AB5D47A94014AB4843E391E14E4
SHA1:	973B60A8F593C8E8594644C917713C30CE52F6CE
SHA-256:	4A2C5B77A3C8FF20D4ADC4FFC5A8AB646D47B9A34128F5F8700B642B4A1E9431
SHA-512:	0A0FC4D220051269B250008CA46414BC16955869BF2E3E47B019F8C331560FA2D208817FE9069C5B6924CFA6F8D5F3FE2ED036C42A3C9E40BB372CADB798C6B2
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Arabic.pm".#------------------------------------------------------------------------------.# File: Arabic.pm.#.# Description: cp1256 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1256.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Arabic = (. 0x80 => 0x20ac, 0x81 => 0x067e, 0x82 => 0x201a, 0x83 => 0x0192,. 0x84 => 0x201e, 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021,. 0x88 => 0x02c6, 0x89 => 0x2030, 0x8a => 0x0679, 0x8b => 0x2039,. 0x8c => 0x0152, 0x8d => 0x0686, 0x8e => 0x0698, 0x8f => 0x0688,. 0x90 => 0x06af, 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c,. 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014,. 0x98 => 0x06a9, 0x99 => 0x2122, 0x9a => 0x0691, 0x9b => 0x203a,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Baltic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	4.555592389172574
Encrypted:	false
SSDEEP:	24:TOyzJjkWApd+5F6TflTuQDM0EQYHwxWbfaWljKld6EpOXNlm+TwxvMFvAi4KXQ78:Xpud66ZtA0X6uW9S6EY739IpnhkxX
MD5:	09BE4EFF632D8307B731978EECEE10F6
SHA1:	1D5795305FEEEBA0423662E3CAB5A3EBDAAABCD6
SHA-256:	4DAB3FBB08261AA41A3A618F687A794BA5AB63EE41E966B738A4491872E1BB08
SHA-512:	9C4ED043D80C36B1EE7EDC710A489B1265DBC0458E3A73A396A116565ED3F9165F0A84C686BFD5E38871AE766DC5A0D0FAC39128669E527A5D142B2CFA01A7EB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Baltic.pm".#------------------------------------------------------------------------------.# File: Baltic.pm.#.# Description: cp1257 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1257.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Baltic = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x84 => 0x201e, 0x85 => 0x2026,. 0x86 => 0x2020, 0x87 => 0x2021, 0x89 => 0x2030, 0x8b => 0x2039, 0x8d => 0xa8,. 0x8e => 0x02c7, 0x8f => 0xb8, 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c,. 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014,. 0x99 => 0x2122, 0x9b => 0x203a, 0x9d => 0xaf, 0x9e => 0x02db, 0xa8 => 0xd8,. 0xaa => 0x0156, 0xaf => 0xc6, 0xb8 => 0xf8, 0xba => 0x0157, 0xbf => 0xe6,. 0xc0 => 0x010

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\CVS\Entries

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	4.755977973684858
Encrypted:	false
SSDEEP:	24:jk5i0miGWurxVuzifdiRDV5acC3irAo/HKiU/oCniy:T3B3bzb
MD5:	4DBF1222C9323069B28FB08CA70F7D17
SHA1:	A768F34688F13D03E52072A46CA755BFF82BD1A1
SHA-256:	2C2C10FB5B0DFAE875B45E4E2790C90A10CF0371FF1B62A165C6A994A8E33EA3
SHA-512:	7966E47E646DFA31CB1104A09B156FCA8617324544714A2109450EA2F68431C2E5749F3311CF1C4A7E9D9333A96AF4B223FE5CA26AA23E5072DDD16E70144879
Malicious:	false
Preview:	/Arabic.pm/1.4/Wed Jul 14 16:28:43 2010//./Baltic.pm/1.4/Wed Jul 14 16:28:43 2010//./Cyrillic.pm/1.4/Wed Jul 14 16:28:44 2010//./Greek.pm/1.4/Wed Jul 14 16:28:44 2010//./Hebrew.pm/1.4/Wed Jul 14 16:28:44 2010//./JIS.pm/1.4/Wed Jul 14 16:28:44 2010//./Latin.pm/1.4/Wed Jul 14 16:28:44 2010//./Latin2.pm/1.4/Wed Jul 14 16:28:44 2010//./MacArabic.pm/1.4/Wed Jul 14 16:28:44 2010//./MacChineseCN.pm/1.5/Wed Jul 14 16:28:44 2010//./MacChineseTW.pm/1.5/Wed Jul 14 16:28:44 2010//./MacCroatian.pm/1.4/Wed Jul 14 16:28:44 2010//./MacCyrillic.pm/1.4/Wed Jul 14 16:28:44 2010//./MacGreek.pm/1.4/Wed Jul 14 16:28:44 2010//./MacHebrew.pm/1.4/Wed Jul 14 16:28:44 2010//./MacIceland.pm/1.4/Wed Jul 14 16:28:44 2010//./MacJapanese.pm/1.6/Wed Jul 14 16:28:44 2010//./MacKorean.pm/1.5/Wed Jul 14 16:28:44 2010//./MacLatin2.pm/1.4/Wed Jul 14 16:28:44 2010//./MacRSymbol.pm/1.4/Wed Jul 14 16:28:44 2010//./MacRoman.pm/1.4/Wed Jul 14 16:28:44 2010//./MacRomanian.pm/1.4/Wed Jul 14 16:28:44 2010//./MacThai.pm/1.4/Wed Jul

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\CVS\Repository

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.208410187268527
Encrypted:	false
SSDEEP:	3:E3LyVQHJn:E3LyVq
MD5:	5B0225D8CB4338B33E20496A930D055A
SHA1:	5F1A9A1AA40B08D2DFD2D5715DC2D9089391411E
SHA-256:	D9FA14960BFB1575EBFB308A9116924E7CB4640209DF6A783CFE76C5E7A2427D
SHA-512:	7F18B533A33516AE69B70193475C10E783D03C8898E1D4641EFD48AA7BA13E5BC66E2DC4F94F8322CF2706ADC9E90CBE2FAC015743D37442441D9734523C9E7D
Malicious:	false
Preview:	lib/Image/ExifTool/Charset.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\CVS\Root

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.542682803033967
Encrypted:	false
SSDEEP:	3:ARfVN5SLFViBKVW/AODRKmn:A5nWqBBAsRKmn
MD5:	40B9335FD2F3C1F68FD22B7364EA1D8B
SHA1:	E79514C2E349DFACEE74A8470848ADA647AA0E4B
SHA-256:	3641791FE2F62C505B05DA9CE982EBB341139C18B2C92C19A02A99BABB2F39D3
SHA-512:	A2A9A8EAF44765B255B9B71EB96EC89D13929D256D204FA5E862CA6EE112828D4967FF8B85326AB68F45C2DBAE7AF142632B73B94AD4C5E488210D1C3D5EBAE3
Malicious:	false
Preview:	:ext:phil@130.15.24.88:/Users/phil/cvs/exiftool2.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Cyrillic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2406
Entropy (8bit):	4.4224373944122535
Encrypted:	false
SSDEEP:	48:Dd8d663aADzZF4v2uakMeO5JG5pcDNWI8qH8u:CdBZzX02hkMeO+i8Ru
MD5:	A3B274239A1F5757CF25CDC18F5E2BA0
SHA1:	EA674B1B8EF9CBF4DF0EB66929A4D300AD456560
SHA-256:	125C63D099C836D744E2AB0787A87B621834197BCC584C65C1D0B03C1BE121DE
SHA-512:	590A69F9FE5DCA789482270AB001A5B66904DAEE024519CE997417FE23EA6E6BC292BF5CFD5982F34BE1BFA63B4395BA7BAE631D88988DC332A07AF477DFF57F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Cyrillic.pm".#------------------------------------------------------------------------------.# File: Cyrillic.pm.#.# Description: cp1251 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1251.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Cyrillic = (. 0x80 => 0x0402, 0x81 => 0x0403, 0x82 => 0x201a, 0x83 => 0x0453,. 0x84 => 0x201e, 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021,. 0x88 => 0x20ac, 0x89 => 0x2030, 0x8a => 0x0409, 0x8b => 0x2039,. 0x8c => 0x040a, 0x8d => 0x040c, 0x8e => 0x040b, 0x8f => 0x040f,. 0x90 => 0x0452, 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c,. 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014,. 0x99 => 0x2122, 0x9a => 0x0459, 0x9b => 0x203a, 0x9c => 0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\DOSLatin1.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2665
Entropy (8bit):	4.324549631341819
Encrypted:	false
SSDEEP:	48:D9Tcy66hvd3/YiKV9Mudu8JFID73aJFQmC3bKdIW2IxXZlpghf:+yvF3/s9bd1Jyn3WCLwnxXZQl
MD5:	92BA9FED0A767F0F0FB03A28F8AD6AD3
SHA1:	BE967174B8EFA1DD5CA746022BD2F7776E18F6DA
SHA-256:	87E1519225EB41915E677F1382B9F70833EFA347BE66DEE303FAE693E77CADC6
SHA-512:	80C9B426D039A8C3D7F94991503BDE1912327D162DD551A423309078D37ED354AFC207FD7C1449879D78158CEA58FAEEFDB73158C4C2572EF25EC7251743FFBB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/DOSLatin1.pm".#------------------------------------------------------------------------------.# File: DOSLatin1.pm.#.# Description: cp850 to Unicode.#.# Revisions: 2017/10/31- P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/CP850.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::DOSLatin1 = (. 0x80 => 0x00c7, 0x81 => 0x00fc, 0x82 => 0x00e9, 0x83 => 0x00e2,. 0x84 => 0x00e4, 0x85 => 0x00e0, 0x86 => 0x00e5, 0x87 => 0x00e7,. 0x88 => 0x00ea, 0x89 => 0x00eb, 0x8a => 0x00e8, 0x8b => 0x00ef,. 0x8c => 0x00ee, 0x8d => 0x00ec, 0x8e => 0x00c4, 0x8f => 0x00c5,. 0x90 => 0x00c9, 0x91 => 0x00e6, 0x92 => 0x00c6, 0x93 => 0x00f4,. 0x94 => 0x00f6, 0x95 => 0x00f2, 0x96 => 0x00fb, 0x97 => 0x00f9,. 0x98 => 0x00ff, 0x99 => 0x00d6, 0x9a => 0x00dc, 0x9b => 0x00f8

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\DOSLatinUS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	4.422710066483079
Encrypted:	false
SSDEEP:	48:Y2Ny66asd3/Yr/zV9MuxVXJFKr7JFQYpGwjMIrIO4Whf:hyYQ3/8R9bxVJYLpGDVOBl
MD5:	B57F103C6BC9B49B4C55D4AC46806BA1
SHA1:	59B8A5553F50F4461A47E395D7697B4E360CEC7D
SHA-256:	B02E98F3EF5423CC5B62EA208B73C1E9F459A40DE94D33344B0EBA6ECD6DFC93
SHA-512:	7A2E650CE57DC69409EAB44ABC8155B35204084DB5870810947969D8EA96E246A0B27D14B730B7CF3522E81693E43582B810005D8180BECE57615401F7FFBBCC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/DOSLatinUS.pm".#------------------------------------------------------------------------------.# File: DOSLatinUS.pm.#.# Description: cp437 to Unicode.#.# Revisions: 2017/10/31- P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/CP437.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::DOSLatinUS = (. 0x80 => 0x00c7, 0x81 => 0x00fc, 0x82 => 0x00e9, 0x83 => 0x00e2,. 0x84 => 0x00e4, 0x85 => 0x00e0, 0x86 => 0x00e5, 0x87 => 0x00e7,. 0x88 => 0x00ea, 0x89 => 0x00eb, 0x8a => 0x00e8, 0x8b => 0x00ef,. 0x8c => 0x00ee, 0x8d => 0x00ec, 0x8e => 0x00c4, 0x8f => 0x00c5,. 0x90 => 0x00c9, 0x91 => 0x00e6, 0x92 => 0x00c6, 0x93 => 0x00f4,. 0x94 => 0x00f6, 0x95 => 0x00f2, 0x96 => 0x00fb, 0x97 => 0x00f9,. 0x98 => 0x00ff, 0x99 => 0x00d6, 0x9a => 0x00dc, 0x9b => 0x0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Greek.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	4.50363194128464
Encrypted:	false
SSDEEP:	24:TOyajUMpd+5F6TjlTLotFDM0rHwxWbfKlbbrtjGjrS+LY8uwb+auQiLi+1wYIXuS:eUyd661AA0DSreJgKWqnsCMRevZ
MD5:	EAEE2F9F36314B80EFF1EBCE39862169
SHA1:	8147FCA7112F4B71721845840EC10890BC0ACA2B
SHA-256:	0E613DF80997E97649EE989D53617C6F4778222ADF8375398108EA952119E0FF
SHA-512:	5A948EEE378FC7DA2380B5FF2EAB6B1D475426F3AAFC62AE07E3D86621DDFB3F2210B4C9B1146AB76F5DDBC91EA0D536483DD0E0E71BA114EE28E719170E4CC4
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Greek.pm".#------------------------------------------------------------------------------.# File: Greek.pm.#.# Description: cp1253 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1253.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Greek = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x83 => 0x0192, 0x84 => 0x201e,. 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021, 0x89 => 0x2030,. 0x8b => 0x2039, 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c,. 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014,. 0x99 => 0x2122, 0x9b => 0x203a, 0xa1 => 0x0385, 0xa2 => 0x0386,. 0xaf => 0x2015, 0xb4 => 0x0384, 0xb8 => 0x0388, 0xb9 => 0x0389,. 0xba => 0x038a, 0xbc => 0x038c, 0xbe => 0x038e, 0xbf => 0x038f,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Hebrew.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1802
Entropy (8bit):	4.557490196907182
Encrypted:	false
SSDEEP:	24:TOyTjDCpd+5F6TllTootFDMefM/SkWbHpf1Xdxvz2+136wrtmW7wg1bX3zx3Q+DV:hDId66LDA4M/eld4GQnoGM636QFiZ
MD5:	299BA7CC4634BD24B5D65DEDB8E02D08
SHA1:	0A6431A37C59E569E0FCADF558DDADA9BF2FCF6E
SHA-256:	27C074197F311232714B41BDDA603B85590D2CF699C321E168C8A0B1326CD794
SHA-512:	50BFB1AD813B77E4CC0B3E0D0ACB0EF0BDD7B7007C6B10C1F3093B9CCC807EE984666C16CCB78CAC3A64ED8C7FAC3F31DBAB85DF70FE9828DBDF2D6619888CBE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Hebrew.pm".#------------------------------------------------------------------------------.# File: Hebrew.pm.#.# Description: cp1255 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1255.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Hebrew = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x83 => 0x0192, 0x84 => 0x201e,. 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021, 0x88 => 0x02c6,. 0x89 => 0x2030, 0x8b => 0x2039, 0x91 => 0x2018, 0x92 => 0x2019,. 0x93 => 0x201c, 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013,. 0x97 => 0x2014, 0x98 => 0x02dc, 0x99 => 0x2122, 0x9b => 0x203a,. 0xa4 => 0x20aa, 0xaa => 0xd7, 0xba => 0xf7, 0xc0 => 0x05b0, 0xc1 => 0x05b1,. 0xc2 => 0x05b2, 0xc3 => 0x05b3, 0xc4 => 0x05b4, 0xc

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\JIS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	127732
Entropy (8bit):	4.045831394379645
Encrypted:	false
SSDEEP:	3072:whtL7VJpOdoZueeZxhELTTFBqJIpb//PE1ToS7k6Bb4:whN7VJpOdoZu7Z0TFMJIpb/XE1ToS7kp
MD5:	2C8095D491C2BB138C1DEE1F7E91D095
SHA1:	36C946D68E39032FB9517779DC09CF280B923FF6
SHA-256:	5F1BE54C455457D6C479A9CDFBDCE43C389660C733645752A3D460FB2FD8AD94
SHA-512:	2D6DABA297D52C0E1142CEA2D4A10E283737AD95140B6EF51657689DD9C0628EB7409179EE2006A9CFDA9EEC82946CD82684EF1CDE1ADCE04D573F813F8FA2D5
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/JIS.pm".#------------------------------------------------------------------------------.# File: JIS.pm.#.# Description: JIS X 0208 (1990) to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/JIS0208.TXT.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::JIS = (. 0x2121 => 0x3000, 0x2122 => 0x3001, 0x2123 => 0x3002, 0x2124 => 0xff0c,. 0x2125 => 0xff0e, 0x2126 => 0x30fb, 0x2127 => 0xff1a, 0x2128 => 0xff1b,. 0x2129 => 0xff1f, 0x212a => 0xff01, 0x212b => 0x309b, 0x212c => 0x309c,. 0x212d => 0x00b4, 0x212e => 0xff40, 0x212f => 0x00a8, 0x2130 => 0xff3e,. 0x2131 => 0xffe3, 0x2132 => 0xff3f, 0x2133 => 0x30fd, 0x2134 => 0x30fe,. 0x2135 => 0x309d, 0x2136 => 0x309e, 0x2137 => 0x3003, 0x2138 => 0x4edd,. 0x2139 => 0x3005, 0x213a => 0x3006, 0x213b => 0x3007, 0x213c => 0x30fc,. 0x213d => 0x2015, 0x213

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Latin.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	995
Entropy (8bit):	4.790526876279942
Encrypted:	false
SSDEEP:	24:TOyYjCRpd+5F6TmlTFotFDMefjfb+HwxWbfLhS9BlmpN:cCzd66SuA4EAkN
MD5:	CBB081DAD89A540ABD44CB0CA3CC0007
SHA1:	BC5D21A75745EAD3A270416E0C4B0A0E285BF3E5
SHA-256:	AD1E79300B6FC033E8C792F596E0C57E4919A5260D507FEFEDAABFFBAB19EAF4
SHA-512:	1B0345538FB79A77895E64E30C2A95EF35F199598F66B0254FF43260F2C9C3D4E8B4ECAD962B3FBB5EFA3739EFD0817C902F22DD2508DA3696C5DAB44F3E9586
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Latin.pm".#------------------------------------------------------------------------------.# File: Latin.pm.#.# Description: cp1252 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Latin = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x83 => 0x0192, 0x84 => 0x201e,. 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021, 0x88 => 0x02c6,. 0x89 => 0x2030, 0x8a => 0x0160, 0x8b => 0x2039, 0x8c => 0x0152,. 0x8e => 0x017d, 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c,. 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014,. 0x98 => 0x02dc, 0x99 => 0x2122, 0x9a => 0x0161, 0x9b => 0x203a,. 0x9c => 0x0153, 0x9e => 0x017e, 0x9f => 0x0178,.);..1; # end.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Latin2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	4.547410131287415
Encrypted:	false
SSDEEP:	24:TOyoj67pd+5F6T0lTdQDM0jJLEryvlHwxWbfuS7gwGlmVlboYllGYlhwlNj2jsFY:E6Fd66k2A0kypGV34DJQX3MvT9
MD5:	FC74A0DD6FE145CCDAAC3B938E466F16
SHA1:	4BA9216A7B9C39D655D3F482770435860C7DAF8F
SHA-256:	966CC9C3C944A0272849050488083101D05BA7D6114B4754DCF21A74FFC56D03
SHA-512:	B1DDACEA2FE12D43AEFD469E468A6C987F2F0FEA6823639BD3F2240B65C0B49E2989C26E59777CFB5A06474C4E1C479DDD33266E4BE7634C7961E99AD7F367FD
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Latin2.pm".#------------------------------------------------------------------------------.# File: Latin2.pm.#.# Description: cp1250 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1250.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Latin2 = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x84 => 0x201e, 0x85 => 0x2026,. 0x86 => 0x2020, 0x87 => 0x2021, 0x89 => 0x2030, 0x8a => 0x0160,. 0x8b => 0x2039, 0x8c => 0x015a, 0x8d => 0x0164, 0x8e => 0x017d,. 0x8f => 0x0179, 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c,. 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014,. 0x99 => 0x2122, 0x9a => 0x0161, 0x9b => 0x203a, 0x9c => 0x015b,. 0x9d => 0x0165, 0x9e => 0x017e, 0x9f => 0x017a, 0xa1 => 0x02c7,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacArabic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2605
Entropy (8bit):	4.428683821135794
Encrypted:	false
SSDEEP:	48:PR5d660qG4ij2ROyV3IuvpzAFif58g3xoQQHLPD1gk:XdRG42vuvVA8BpqHP1l
MD5:	A1D482A8986AC72638DAD174D34FE3E1
SHA1:	935621C219915FF1204C85527FD20ABB3E97E97E
SHA-256:	60EB488406BB44A8332CD649A6E1CABB4FADA755D62F5533784998E41A0CBBC4
SHA-512:	3F538DC8B928057010EF738A04EFE71F2E7DF9AB826EFD00509C18AE4D0D7AB956B280C92DDE05B9BB68698CF6D9A6E3895810F2E362DA25AA06A9461863F70A
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacArabic.pm".#------------------------------------------------------------------------------.# File: MacArabic.pm.#.# Description: Mac Arabic to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/ARABIC.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.# and directional characters are ignored.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacArabic = (. 0x80 => 0xc4, 0x81 => 0xa0, 0x82 => 0xc7, 0x83 => 0xc9, 0x84 => 0xd1,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0x06ba, 0x8c => 0xab, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed, 0x93 => 0x2026,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3, 0x98 => 0xbb,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacChineseCN.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	129413
Entropy (8bit):	3.9190373477394393
Encrypted:	false
SSDEEP:	1536:CSuP9uxoCTz7g5cPmOa6n55u5bPSWGT5O:Fu1+TXoEmjg5IbaWw5O
MD5:	9CC0A2171470A364D651F2B909DCE0F6
SHA1:	C09CC47CD32D4879BEF61AC98A9E07BDD1B4CDEE
SHA-256:	FF6D7838CE6F14A0E7E98A4022852626D74DA29F84B9A1EDBA14B9CB1356E4D8
SHA-512:	9B5D2A448ED6B6D8EC05062199402780898E2D3A6B0ED58013A371D81E7013AC5FA22DD188A98EB3092EF35C9E42D86E8F25F64D7CB1A91FB44B8A826C835174
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacChineseCN.pm".#------------------------------------------------------------------------------.# File: MacChineseCN.pm.#.# Description: Mac Chinese Simplified to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/CHINSIMP.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacChineseCN = (. 0x80 => [0xfc,0xf87f], 0x81 => 0xf880, 0x82 => 0xf881, 0xfd => 0xa9,. 0xfe => 0x2122, 0xff => 0x2026,. 0xa1 => {. 0xa1 => 0x3000, 0xa2 => 0x3001, 0xa3 => 0x3002, 0xa4 => 0xb7,. 0xa5 => 0x02c9, 0xa6 => 0x02c7, 0xa7 => 0xa8, 0xa8 => 0x3003,. 0xa9 => 0x3005, 0xaa => 0x2014, 0xab => 0x301c, 0xac => 0x2016,. 0xad => 0x22ef, 0xae => 0x2018, 0xaf => 0x2019, 0xb0 => 0x201c,. 0xb1 => 0x201d, 0xb2 => 0x3014, 0xb3 => 0x301

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacChineseTW.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	231449
Entropy (8bit):	3.902398854653776
Encrypted:	false
SSDEEP:	3072:e1IqIfUVPNOulPPIyfXYDSzCExvyBbvDNZ8hXB:e7IfUVlOulPIyPY2eExvyBbvDNZ8hXB
MD5:	DF39E5D5FCF6717C0988EACF5E8087D1
SHA1:	37D24AD106494B9B3668413E7271F4736EC6169B
SHA-256:	EA91C22CD56881B3E1F7D7F44BFAE0C51A98DD572F855EF037D57173A138AC68
SHA-512:	57F7E5A0C4562BE4BFA351B242324FCE796457655A592077F9221E1D6919D63F2BC94E1196E00AFCB580DD65F41E406D73DBC0617183BEDD5AB30BCF9C0D4804
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacChineseTW.pm".#------------------------------------------------------------------------------.# File: MacChineseTW.pm.#.# Description: Mac Chinese Traditional to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/CHINTRAD.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacChineseTW = (. 0x80 => [0x5c,0xf87f], 0x81 => 0xf880, 0x82 => 0xf881, 0xfd => 0xa9,. 0xfe => 0x2122, 0xff => 0x2026,. 0xa1 => {. 0x40 => 0x3000, 0x41 => 0xff0c, 0x42 => 0x3001, 0x43 => 0x3002,. 0x44 => 0xff0e, 0x45 => 0xb7, 0x46 => 0xff1b, 0x47 => 0xff1a,. 0x48 => 0xff1f, 0x49 => 0xff01, 0x4a => 0xfe30, 0x4b => 0x22ef,. 0x4c => 0x2025, 0x4d => [0xff0c,0xf87d], 0x4e => [0x3001,0xf87d],. 0x4f => [0xff0e,0xf87d], 0x50 => [0xff0e

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacCroatian.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2454
Entropy (8bit):	4.432723868872716
Encrypted:	false
SSDEEP:	48:oW/Od66ImD5P2R0o3n+haH48nE99kQ+wGHaFFEGe4z:Mdqum+YHFOkQ+wLEGt
MD5:	3D1DEBB0A8FD792DA9753F5AE8986AE9
SHA1:	D1DAD5CDDEC90CF540D0A614AEA31949CC1FE8B5
SHA-256:	64241208F8DB5E2AA505A9B10C1506D45577FCF7A3A8F919238554F3100F0203
SHA-512:	F72EE40A1475444463CD049159F5511A35E5DDAEA0C04274C757F6A2920332C2F442CDFFD2CE842A763E1D97D1013512285C4476715BA054480C515552DB4120
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacCroatian.pm".#------------------------------------------------------------------------------.# File: MacCroatian.pm.#.# Description: Mac Croatian to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/CROATIAN.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacCroatian = (. 0x80 => 0xc4, 0x81 => 0xc5, 0x82 => 0xc7, 0x83 => 0xc9, 0x84 => 0xd1,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0xe3, 0x8c => 0xe5, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed, 0x93 => 0xec,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3, 0x98 => 0xf2,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xf5, 0x9c => 0xfa, 0x9d => 0xf9,. 0x9e => 0xfb,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacCyrillic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2592
Entropy (8bit):	4.412167794829323
Encrypted:	false
SSDEEP:	48:weT6d66cfQrI+S1unYnEGEjS14G12qPOI:t6dKIrI2zZSqS27I
MD5:	271A7FEA25FF170DEC7A6F55C4AB783B
SHA1:	B85412DCB43E43370868C76804B51276A2CE59DC
SHA-256:	2C707C49A36DE3BA501EE08BB9E997C8052C3D6A249CF0B096E11F12049DD11B
SHA-512:	884B8F83CADF6AFA7A8D842C515E1FA9F2AB7AEC1D322D90BF5DD274C2C5A25876B0D524E04037E81DA355742F9B8BC70312CA6943ECA68ED059C5E8D263DAA1
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacCyrillic.pm".#------------------------------------------------------------------------------.# File: MacCyrillic.pm.#.# Description: Mac Cyrillic to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/CYRILLIC.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacCyrillic = (. 0x80 => 0x0410, 0x81 => 0x0411, 0x82 => 0x0412, 0x83 => 0x0413,. 0x84 => 0x0414, 0x85 => 0x0415, 0x86 => 0x0416, 0x87 => 0x0417,. 0x88 => 0x0418, 0x89 => 0x0419, 0x8a => 0x041a, 0x8b => 0x041b,. 0x8c => 0x041c, 0x8d => 0x041d, 0x8e => 0x041e, 0x8f => 0x041f,. 0x90 => 0x0420, 0x91 => 0x0421, 0x92 => 0x0422, 0x93 => 0x0423,. 0x94 => 0x0424, 0x95 => 0x0425, 0x96 => 0x0426, 0x97 => 0x0427,. 0x98 => 0x0428, 0x99 => 0x0429, 0x9a => 0x042a, 0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacGreek.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2547
Entropy (8bit):	4.4047393817585725
Encrypted:	false
SSDEEP:	48:HYyxd66jgjr2mo8+ez5Pq6a02HZ/K4e9LIRdtn5N:7ddgPYgyo2HZjFRlN
MD5:	F74A84798EDD2B755AC6EA71484D29C0
SHA1:	BAABA30EC003690A2003B2EEF8C7BF4C64097F1F
SHA-256:	8C36AC94E86D0B49116963DC5525523B3F1CFB039F2EC518ADFF9B3F78D42A63
SHA-512:	0003958C43FF2416A3F8F7F72BEDF02AB67557A51E7DDB88CCA5F856BDEFCC5468132E54976136299B672234F6349A2908F15119C9DEADAF630F878254969788
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacGreek.pm".#------------------------------------------------------------------------------.# File: MacGreek.pm.#.# Description: Mac Greek to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/GREEK.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacGreek = (. 0x80 => 0xc4, 0x81 => 0xb9, 0x82 => 0xb2, 0x83 => 0xc9, 0x84 => 0xb3,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0x0385, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0x0384, 0x8c => 0xa8, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xa3, 0x93 => 0x2122,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0x2022, 0x97 => 0xbd, 0x98 => 0x2030,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xa6, 0x9c => 0x20ac, 0x9d => 0xf9,. 0x9e => 0xfb, 0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacHebrew.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2615
Entropy (8bit):	4.458071422354791
Encrypted:	false
SSDEEP:	48:mMprOd66FqG4iyFb2BogCCiCElgHFBkv9OuGrg2LU6qIMYaM:n6dqG4iw3VC+mFq9OusMYd
MD5:	A4E49E7E94D7EB94A7A3068E71C2FEE7
SHA1:	46D793CF36EFA7D220F9181F4E0ADD96786D1F5C
SHA-256:	83C5209D1765E3EECBCCA03150979983F52611B239BEC5D6748FC1F1DBD4EFE3
SHA-512:	422C5906780D7E9ACDD3C470E21C12899BED23531B9E8D3811DA4D2AECD37C9BF2883E826405C03D25FABCEAEE085E732098F2D6C52FE5910BF3ED12B17A4EED
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacHebrew.pm".#------------------------------------------------------------------------------.# File: MacHebrew.pm.#.# Description: Mac Hebrew to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/HEBREW.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.# and directional characters are ignored.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacHebrew = (. 0x80 => 0xc4, 0x81 => [0x05f2,0x05b7], 0x82 => 0xc7, 0x83 => 0xc9,. 0x84 => 0xd1, 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0,. 0x89 => 0xe2, 0x8a => 0xe4, 0x8b => 0xe3, 0x8c => 0xe5, 0x8d => 0xe7,. 0x8e => 0xe9, 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed,. 0x93 => 0xec, 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3,. 0x98 => 0xf2, 0x99 => 0xf4, 0x9a => 0xf6, 0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacIceland.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	4.429830759842735
Encrypted:	false
SSDEEP:	48:JHvyOd66ld5P2R0oPnI4IH4NYp4GCSuBKhone3NuUFd+A:5dDfGIXHXp4+uBKhRNuUFZ
MD5:	4A2F9E51235F41EFF88AF0DE192F3AF9
SHA1:	1B96BB877B44FA1B30699033769B180D513C9EF4
SHA-256:	E88CCB04D254316E25027CAFF6272377AD7C19834462E10EFF20795452BD8F06
SHA-512:	2590B83846AF793D321D46EF42FCDAE534ACD5084FCFD765621A0297727E647A363881ED7DB4D45AF3FC1C80F235FAD7439795DCBEB6E13DAAEC480D2F5B7565
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacIceland.pm".#------------------------------------------------------------------------------.# File: MacIceland.pm.#.# Description: Mac Icelandic to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/ICELAND.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacIceland = (. 0x80 => 0xc4, 0x81 => 0xc5, 0x82 => 0xc7, 0x83 => 0xc9, 0x84 => 0xd1,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0xe3, 0x8c => 0xe5, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed, 0x93 => 0xec,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3, 0x98 => 0xf2,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xf5, 0x9c => 0xfa, 0x9d => 0xf9,. 0x9e => 0xfb, 0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacJapanese.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	125419
Entropy (8bit):	3.920510124247878
Encrypted:	false
SSDEEP:	1536:ajJwBkZibxHXcrNuXifRSE+KnKSBRmiTl8cLqbgG:8JwBBHXcrNTRiKnKSBRmiT9ubgG
MD5:	1B619EA5C026B2EE7C32D49A2E0A6627
SHA1:	11E49E44D50B6387616DFA6C9B07AA552DB07304
SHA-256:	C55DE794B5C0DAC0F771C12BC71C7CBB2126BC346BF4B9A7A9024392CF8CA64F
SHA-512:	FAE96AFDC892856E6D83E2F2B27C23E5A5B1102EB97F1E0602445A09358133F902B8E99DCA15F740384CC99A5E285B14B8C0B2B0B1BC5AA0A6BFC0FDC3134FBD
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacJapanese.pm".#------------------------------------------------------------------------------.# File: MacJapanese.pm.#.# Description: Mac Japanese to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/JAPANESE.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.# This set re-maps characters with codepoints less than 0x80.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacJapanese = (. 0x5c => 0xa5, 0x80 => 0x5c, 0xa1 => 0xff61, 0xa2 => 0xff62, 0xa3 => 0xff63,. 0xa4 => 0xff64, 0xa5 => 0xff65, 0xa6 => 0xff66, 0xa7 => 0xff67,. 0xa8 => 0xff68, 0xa9 => 0xff69, 0xaa => 0xff6a, 0xab => 0xff6b,. 0xac => 0xff6c, 0xad => 0xff6d, 0xae => 0xff6e, 0xaf => 0xff6f,. 0xb0 => 0xff70, 0xb1 => 0xff71, 0xb2 => 0xff72, 0xb3 => 0xff73,. 0xb4 => 0xff74, 0xb5 => 0xff

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacKorean.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171977
Entropy (8bit):	3.974641038029574
Encrypted:	false
SSDEEP:	1536:ZQrV9txg6siqlZT1ZblkFMAUryHjL9jP+WF:qrV9roT1Zlk6pOjL9jmG
MD5:	528110E7E63AE08E065393631D227E8F
SHA1:	7FE8BCB7BD37D04B5D0CE53782BB636C0E308F34
SHA-256:	AB880B336D6CBB688D8416F18CEA9AE0616477CD800AE6E0D4FBB56A70E2D4F4
SHA-512:	8716879E8F09C7D12AFB02A24AE954CE018E85336523FB895A10C8A224980E87D830C1FFE76E42C73308EFEA6FB5F595EF04AAD122B6127683F86C41467F3939
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacKorean.pm".#------------------------------------------------------------------------------.# File: MacKorean.pm.#.# Description: Mac Korean to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/KOREAN.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacKorean = (. 0x80 => 0xa0, 0x81 => 0x20a9, 0x82 => [0x2013,0xf87f], 0x83 => 0xa9,. 0x84 => [0xff3f,0xf87f], 0xff => [0x2026,0xf87f],. 0xa1 => {. 0x41 => [0x300c,0xf87f], 0x42 => [0x300d,0xf87f], 0x43 => [0x300c,0xf87b],. 0x44 => [0x300d,0xf87b], 0x45 => [0x300c,0xf87c], 0x46 => [0x300d,0xf87c],. 0x47 => [0x300e,0xf87c], 0x48 => [0x300f,0xf87c], 0x49 => [0x300a,0xf878],. 0x4a => [0x300b,0xf878], 0x4b => [0x3008,0xf878], 0x4c => [0x3009,0xf878],. 0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacLatin2.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2572
Entropy (8bit):	4.421993919206973
Encrypted:	false
SSDEEP:	48:71Dd66WuTWwy36DOCnJkH4tAocB++jNOFGIj86:ddwuva0JkH2Ax++wj86
MD5:	81A9B909B3163715C80F5D75E6DB983C
SHA1:	FF20EF1B3647D7EDEAEB0B43A1315757CC52C4AE
SHA-256:	E2155D8AF9D8EB60A8341B8898055A81C9AD460A2D2F2E5F4CD0A0DDF8BB50B2
SHA-512:	9700E9AEF0F087797FFFB7271D5C752E1AA5D8C70CF09A20B727B5CB0121EC770C02B7C3F8FD7090F12B1DDD23D1E2E595CCEB2D9D3E85502DD54FBBDD2D5BE2
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacLatin2.pm".#------------------------------------------------------------------------------.# File: MacLatin2.pm.#.# Description: Mac Central European to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/CENTEURO.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacLatin2 = (. 0x80 => 0xc4, 0x81 => 0x0100, 0x82 => 0x0101, 0x83 => 0xc9, 0x84 => 0x0104,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0x0105, 0x89 => 0x010c,. 0x8a => 0xe4, 0x8b => 0x010d, 0x8c => 0x0106, 0x8d => 0x0107, 0x8e => 0xe9,. 0x8f => 0x0179, 0x90 => 0x017a, 0x91 => 0x010e, 0x92 => 0xed, 0x93 => 0x010f,. 0x94 => 0x0112, 0x95 => 0x0113, 0x96 => 0x0116, 0x97 => 0xf3, 0x98 => 0x0117,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xf5, 0x9c => 0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacRSymbol.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	129274
Entropy (8bit):	3.915919515138781
Encrypted:	false
SSDEEP:	1536:e/uP9uxoCTz7g5cPmOa6n55u5bPSWGT5e:gu1+TXoEmjg5IbaWw5e
MD5:	038DBA88FF77D517A0395816E3B14005
SHA1:	B0FA3D63974BFB8F2CA3B49D9E0D0361EE705E3A
SHA-256:	2AC3EDDE2E7E955E688B300993406B89712C5317FAE299EDEED95878A7F6F677
SHA-512:	3213FB355C4C7BA878CE842CC178F8D23DD71468C3E5441090FAEBC86C050AF22699031C4C6048C35861F14465E0E6D8C9BF4780BB66042484B2F830CE5B779E
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacRSymbol.pm".#------------------------------------------------------------------------------.# File: MacRSymbol.pm.#.# Description: Mac RSymbol (cp10008) to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://www.haible.de/bruno/charsets/conversion-tables/GB2312.tar.bz2.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacRSymbol = (. 0x81 => 0xf8d8, 0x82 => 0xf8d9, 0x83 => 0xf8da, 0x84 => 0xf8db,. 0x85 => 0xf8dc, 0x86 => 0xf8dd, 0x87 => 0xf8de, 0x88 => 0xf8df,. 0x89 => 0xf8e0, 0x8a => 0xf8e1, 0x8b => 0xf8e2, 0x8c => 0xf8e3,. 0x8d => 0xf8e4, 0x8e => 0xf8e5, 0x8f => 0xf8e6, 0x90 => 0xf8e7,. 0x91 => 0xf8e8, 0x92 => 0xf8e9, 0x93 => 0xf8ea, 0x94 => 0xf8eb,. 0x95 => 0xf8ec, 0x96 => 0xf8ed, 0x97 => 0xf8ee, 0x98 => 0xf8ef,. 0x99 => 0xf8f0, 0x9a => 0xf8f1, 0x9b

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacRoman.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2419
Entropy (8bit):	4.423157643549764
Encrypted:	false
SSDEEP:	48:4W+d662FGD5P2R0o3nI4IH4NYp4GCSuBKhoESzFNwOp44:WdAOmIXHXp4+uBKhaNwOX
MD5:	27632315D6A9D153AF0B9344036BAB16
SHA1:	27B3919E4084C3A7E782FEA74A765998FC571EAD
SHA-256:	0DF0BE4407C783B00C022125537BB4250081CA859FFE5D449576ACE494B862ED
SHA-512:	89425E453CDAD4D8FADC93AAC4484317911F3815A33929DA3D8D1BC56CD881CDBDAD298BDA08C63CB736A8415D594FDB9969314B29F862F97F1E7BEC0BB33E49
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacRoman.pm".#------------------------------------------------------------------------------.# File: MacRoman.pm.#.# Description: Mac Roman to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/ROMAN.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacRoman = (. 0x80 => 0xc4, 0x81 => 0xc5, 0x82 => 0xc7, 0x83 => 0xc9, 0x84 => 0xd1,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0xe3, 0x8c => 0xe5, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed, 0x93 => 0xec,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3, 0x98 => 0xf2,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xf5, 0x9c => 0xfa, 0x9d => 0xf9,. 0x9e => 0xfb, 0x9f => 0xfc,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacRomanian.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	4.436402744511355
Encrypted:	false
SSDEEP:	48:GMEd666pYD5P2R0o3nI5QH4NYpdDGCSuBKhoceRzFNwOp44:+dQp8mI6HXpt+uBKhdUNwOX
MD5:	B9E3B049A5B2C64FBCFB7403346CC020
SHA1:	BDB6AABFA81752AC39C6D18DB1FE3F6D7EE85032
SHA-256:	7F68D6BB1510479E94C1B75AC9F3E2D7C429B0E57A950BE241636EF5D2365FEF
SHA-512:	EC4F78EDE24F3D03205561FA13409BFBB505DF00E1A328897905C52FF18A885C6C116DDC62995A4BF67B1E62D65BC07DF1A6FAC980E067AE08EC6A1A4C17D7E6
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacRomanian.pm".#------------------------------------------------------------------------------.# File: MacRomanian.pm.#.# Description: Mac Romanian to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/ROMANIAN.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacRomanian = (. 0x80 => 0xc4, 0x81 => 0xc5, 0x82 => 0xc7, 0x83 => 0xc9, 0x84 => 0xd1,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0xe3, 0x8c => 0xe5, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed, 0x93 => 0xec,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3, 0x98 => 0xf2,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xf5, 0x9c => 0xfa, 0x9d => 0xf9,. 0x9e => 0xfb,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacThai.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2736
Entropy (8bit):	4.45949197784833
Encrypted:	false
SSDEEP:	48:c2E0Y+d66xd7ERevcmafTGxNLIbLoWQX2j5BF06KIMF61:C+dFFJpNLmo9GjGSMA1
MD5:	17B7D29D1F9E21935970C4B5085816FE
SHA1:	2DA3137E59D9D55EB66DD8072F9FEB676B43DEF7
SHA-256:	556B5F87272D1320F3CDB81140B97CB0F52D9552E8575ED52E42F31DFF388C05
SHA-512:	A7F87F73C04DDE6AC0396FC12CA5628FAC56CDE520449E04EB9AEDBD1CE76BFD8B76EE188BA27BB8FEFB7E08107584D96441C7A45834D78BD986F7DBC04BF69A
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacThai.pm".#------------------------------------------------------------------------------.# File: MacThai.pm.#.# Description: Mac Thai to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/THAI.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacThai = (. 0x80 => 0xab, 0x81 => 0xbb, 0x82 => 0x2026, 0x83 => [0x0e48,0xf875],. 0x84 => [0x0e49,0xf875], 0x85 => [0x0e4a,0xf875], 0x86 => [0x0e4b,0xf875],. 0x87 => [0x0e4c,0xf875], 0x88 => [0x0e48,0xf873], 0x89 => [0x0e49,0xf873],. 0x8a => [0x0e4a,0xf873], 0x8b => [0x0e4b,0xf873], 0x8c => [0x0e4c,0xf873],. 0x8d => 0x201c, 0x8e => 0x201d, 0x8f => [0x0e4d,0xf874], 0x91 => 0x2022,. 0x92 => [0x0e31,0xf874], 0x93 => [0x0e47,0xf874], 0x94 => [0x0e34,0xf874],. 0x95 => [0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\MacTurkish.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2429
Entropy (8bit):	4.447172758715701
Encrypted:	false
SSDEEP:	48:rVY2d66r75P2R0o3nI4IH4NYp4GCSuBKho4duzFNwOV44:K2dFZmIXHXp4+uBKhUNwOb
MD5:	4E3E19683B71BED431BEEE1D4A4DB16F
SHA1:	7C6C9686B200541E64DA23B9230A85FD21F3FAE2
SHA-256:	C73C4C4BA7B4AB37B2CFA6D6822AD5586E2BC0428E2DCB0BE0E1779274870E6E
SHA-512:	21F13D5518DD732237AF1EEAF574C036FFB8A5A086054B23BAF7A4CEB71587BBBF106133605AA970B13A864F18DEDCB747F8D5E7445C0957F36AF6A2796F6194
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/MacTurkish.pm".#------------------------------------------------------------------------------.# File: MacTurkish.pm.#.# Description: Mac Turkish to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/APPLE/TURKISH.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::MacTurkish = (. 0x80 => 0xc4, 0x81 => 0xc5, 0x82 => 0xc7, 0x83 => 0xc9, 0x84 => 0xd1,. 0x85 => 0xd6, 0x86 => 0xdc, 0x87 => 0xe1, 0x88 => 0xe0, 0x89 => 0xe2,. 0x8a => 0xe4, 0x8b => 0xe3, 0x8c => 0xe5, 0x8d => 0xe7, 0x8e => 0xe9,. 0x8f => 0xe8, 0x90 => 0xea, 0x91 => 0xeb, 0x92 => 0xed, 0x93 => 0xec,. 0x94 => 0xee, 0x95 => 0xef, 0x96 => 0xf1, 0x97 => 0xf3, 0x98 => 0xf2,. 0x99 => 0xf4, 0x9a => 0xf6, 0x9b => 0xf5, 0x9c => 0xfa, 0x9d => 0xf9,. 0x9e => 0xfb, 0x9f

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\PDFDoc.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	4.626393185765509
Encrypted:	false
SSDEEP:	24:TOyQjujpK+oDlTWXPhGqR+plQDmqwpVy6Dr4Ivt+oKpwt5QL1wh9q8lWclsVSL:guNKHRWfTfB073lgid9VAcK6
MD5:	51CB33ACAD5896E8AFF46773E6C748D0
SHA1:	F1D1FE8F565BA0EF8F9B47F3F3998242958B761E
SHA-256:	AC219D06CBBF0358590A582E68D9809DFBF11C8364F04618E8A712330858982A
SHA-512:	EAEC2EDE6030E748A31370FA0FDCDA0C249EE2A9167D648CDED4810A916EDA9CB113EA4C42E4C8FE5C2D18269D148ABB75AD8D72414335CE5ACFF7E4EBBB86AA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/PDFDoc.pm".#------------------------------------------------------------------------------.# File: PDFDoc.pm.#.# Description: PDFDocEncoding to Unicode.#.# Revisions: 2010/10/16 - P. Harvey created.#.# References: 1) http://www.adobe.com/devnet/pdf/pdf_reference.html.#.# Notes: The table omits 1-byte characters with the same values as Unicode.# This set re-maps characters with codepoints less than 0x80.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::PDFDoc = (. 0x18 => 0x02d8, 0x82 => 0x2021, 0x8c => 0x201e, 0x96 => 0x0152,. 0x19 => 0x02c7, 0x83 => 0x2026, 0x8d => 0x201c, 0x97 => 0x0160,. 0x1a => 0x02c6, 0x84 => 0x2014, 0x8e => 0x201d, 0x98 => 0x0178,. 0x1b => 0x02d9, 0x85 => 0x2013, 0x8f => 0x2018, 0x99 => 0x017d,. 0x1c => 0x02dd, 0x86 => 0x0192, 0x90 => 0x2019, 0x9a => 0x0131,. 0x1d => 0x02db, 0x87 => 0x2044, 0x91 => 0x201a,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\ShiftJIS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	119303
Entropy (8bit):	3.9108176437885755
Encrypted:	false
SSDEEP:	1536:CRJwBkZibxHXcrNuXifRSi+KnKSBRmiTl8cLqbgF:EJwBBHXcrNTRAKnKSBRmiT9ubgF
MD5:	DA3BFF15274E6BFC9B012FE79A455101
SHA1:	85BACA97E876BB2A3787369F1D29339DD718162D
SHA-256:	AB29A427C492E740941C9BCAF0AA86048909357868B9A004E1617DCEE43DFCAD
SHA-512:	47C7B081319644A37F0AC6DFFE43193016BF2B212CD73B23B75559C4BE2ECEA9E2076D9184711F937CFDF999A0CA476ECD8E217A15F49D9B79C26D192B2C5308
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/ShiftJIS.pm".#------------------------------------------------------------------------------.# File: ShiftJIS.pm.#.# Description: Shift-JIS to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.# 2010/07/30 - P. Harvey fixed to use variable-width characters.#.# References: 1) http://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/SHIFTJIS.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::ShiftJIS = (. 0x5c => 0xa5, 0x7e => 0x203e,. 0x81 => {. 0x40 => 0x3000, 0x41 => 0x3001, 0x42 => 0x3002, 0x43 => 0xff0c,. 0x44 => 0xff0e, 0x45 => 0x30fb, 0x46 => 0xff1a, 0x47 => 0xff1b,. 0x48 => 0xff1f, 0x49 => 0xff01, 0x4a => 0x309b, 0x4b => 0x309c,. 0x4c => 0xb4, 0x4d => 0xff40, 0x4e => 0xa8, 0x4f => 0xff3e, 0x50 => 0xffe3,. 0x51 => 0xff3f, 0x52 => 0x30fd, 0x53 => 0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Symbol.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3043
Entropy (8bit):	4.419551739818619
Encrypted:	false
SSDEEP:	48:syadXtnju2X1TA7QEGBJWRjVcflVkDMTfCZiHVWIInF0t:md9juiAkEYJqglV+gqaNIFO
MD5:	929502CDC51EE49DA4F0160F2B931A5B
SHA1:	AECE72BFF54013679EF763C57265F626453B72CD
SHA-256:	5F5B199CB5A39BED92317B003F96DA42D97A8B2101AF7C4B617CADFB255A7E00
SHA-512:	FE811254D70EC20411B39A59220720FCE8448746D86FFCCB5AED1CE08F030CD7B508CF8E9450D86A97DA5898CE2A5A8DDE3CB014C2F69F36DC6732F8131783CE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Symbol.pm".#------------------------------------------------------------------------------.# File: Symbol.pm.#.# Description: Symbol to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://blogs.msdn.com/michkap/archive/2005/11/08/490495.aspx.#.# Notes: The table omits 1-byte characters with the same values as Unicode..# This set re-maps characters with codepoints less than 0x80.# (Although all bytes >= 0x20 should be mapped according to the.# reference, I didn't map chars below 0x80 because I have some.# samples where these are regular ASCII characters, even though.# I think the encoding is probably incorrect for these samples).#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Symbol = (. 0x80 => 0xf080, 0x81 => 0xf081, 0x82 => 0xf082, 0x83 => 0xf083,. 0x84 => 0xf084

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Thai.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	4.4263324085372915
Encrypted:	false
SSDEEP:	48:Gcyd66dt/elPTGxNLIbLoWQX2j5+F06KIM46A:OdTtLNLmo9GjJSM1A
MD5:	23F7B8C02D14635B5DA88F1435CEB7C4
SHA1:	D5E67DFDC1050701978624ECA6D9E776BFA5242B
SHA-256:	7523B59FEC9EE9CCB9AC069D8C63883B0B775246B4BBC1ADFF221C09605EDA27
SHA-512:	A1816DD3EB2B704E4AC4B8391A76485350A63D9BC8557CE149077053CF9A2E584A59CAF8D6E9AABBC16088DEB5A683D2A131D5206173E64E6A331C7D455ACA8F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Thai.pm".#------------------------------------------------------------------------------.# File: Thai.pm.#.# Description: cp874 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP874.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Thai = (. 0x80 => 0x20ac, 0x85 => 0x2026, 0x91 => 0x2018, 0x92 => 0x2019,. 0x93 => 0x201c, 0x94 => 0x201d, 0x95 => 0x2022, 0x96 => 0x2013,. 0x97 => 0x2014, 0xa1 => 0x0e01, 0xa2 => 0x0e02, 0xa3 => 0x0e03,. 0xa4 => 0x0e04, 0xa5 => 0x0e05, 0xa6 => 0x0e06, 0xa7 => 0x0e07,. 0xa8 => 0x0e08, 0xa9 => 0x0e09, 0xaa => 0x0e0a, 0xab => 0x0e0b,. 0xac => 0x0e0c, 0xad => 0x0e0d, 0xae => 0x0e0e, 0xaf => 0x0e0f,. 0xb0 => 0x0e10, 0xb1 => 0x0e11, 0xb2 => 0x0e12, 0xb3 => 0x0e13,. 0xb4

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Turkish.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	4.790898819971592
Encrypted:	false
SSDEEP:	24:TOySjc/pd+5F6TaBlTrotFDMefjfs/bff1bS74phS3BrjLwWRNV7:mcBd66GrgA4abhkN
MD5:	94DB73A4C738BA84B32EC2D763FDE0E5
SHA1:	FAF6341C4E7D389B0A8274B60CBE8F3615735826
SHA-256:	228D4DA1F2EBF3EE03424AAE1290542313D8DDD22D67E00D8D1BC524E0BF8CA7
SHA-512:	D4A708D93BB82B0BD81DD327CA9943D1E1C864AD83FDC61D00C45AF0D8F41014881A7712F59710F80AA8049001398E64FEB23927068FCB86FE83CC0A20521B34
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Turkish.pm".#------------------------------------------------------------------------------.# File: Turkish.pm.#.# Description: cp1254 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1254.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Turkish = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x83 => 0x0192, 0x84 => 0x201e,. 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021, 0x88 => 0x02c6,. 0x89 => 0x2030, 0x8a => 0x0160, 0x8b => 0x2039, 0x8c => 0x0152,. 0x91 => 0x2018, 0x92 => 0x2019, 0x93 => 0x201c, 0x94 => 0x201d,. 0x95 => 0x2022, 0x96 => 0x2013, 0x97 => 0x2014, 0x98 => 0x02dc,. 0x99 => 0x2122, 0x9a => 0x0161, 0x9b => 0x203a, 0x9c => 0x0153,. 0x9f => 0x0178, 0xd0 => 0x011e, 0xdd => 0x0130, 0xde => 0x01

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Charset\Vietnam.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	4.723212554517733
Encrypted:	false
SSDEEP:	24:TOyTajJOPLpd+5F6T8lT/votFDMefQkkWRff1RJwphN+bXpEtNjZwBjSYgrNtV:xoJOdd66s/cA4hP0hiS9
MD5:	0C747166F2ADE6ABD401FCAEFD1F7EC0
SHA1:	B7361C9B3060264861D79D2F8AC8B8EECF0EEB0A
SHA-256:	67AAB2363B5A137E9A6576A5D851E5227F7E76E3760C0764BDD3A17D6D0B0CCA
SHA-512:	5BB44204B7600DBB64385FB6925364A1475E8BE4465FFDED9BEF24FEBB49FF691D5B495673B54E113E20CA372E73AB97E343B70096FEC648E6331C7DA273B276
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Charset/Vietnam.pm".#------------------------------------------------------------------------------.# File: Vietnam.pm.#.# Description: cp1258 to Unicode.#.# Revisions: 2010/01/20 - P. Harvey created.#.# References: 1) http://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1258.TXT.#.# Notes: The table omits 1-byte characters with the same values as Unicode.#------------------------------------------------------------------------------.use strict;..%Image::ExifTool::Charset::Vietnam = (. 0x80 => 0x20ac, 0x82 => 0x201a, 0x83 => 0x0192, 0x84 => 0x201e,. 0x85 => 0x2026, 0x86 => 0x2020, 0x87 => 0x2021, 0x88 => 0x02c6,. 0x89 => 0x2030, 0x8b => 0x2039, 0x8c => 0x0152, 0x91 => 0x2018,. 0x92 => 0x2019, 0x93 => 0x201c, 0x94 => 0x201d, 0x95 => 0x2022,. 0x96 => 0x2013, 0x97 => 0x2014, 0x98 => 0x02dc, 0x99 => 0x2122,. 0x9b => 0x203a, 0x9c => 0x0153, 0x9f => 0x0178, 0xc3 => 0x0102,. 0xcc => 0x0300, 0xd0 => 0x0110, 0xd2 => 0x0309, 0xd5 => 0x01

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DICOM.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	249453
Entropy (8bit):	4.9656062642049745
Encrypted:	false
SSDEEP:	3072:b++ACYSoumZ5Wel8uda9p/e9cq6nZ3IIU:b++ACYvumDWel88a9p/e9cq6nZ3W
MD5:	BF02338046A107D99FDE179CABA058A4
SHA1:	3418F4D7A0E3C956C047EBC645AF1F6CE839B532
SHA-256:	CC49EED7F89A1051BD98FD6717C85547D52F1BFEA2CD2B6A6E8BF5FB03F01370
SHA-512:	DECFCDEF8074E2558DF4C11694A6A7610F178DFD6949864F58AF87AF3FFA39D0738C8B3AC64CF31E70B83B4F6C28F498F236AA52D28A2C9B32C978E0A66DF5CC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DICOM.pm".#------------------------------------------------------------------------------.# File: DICOM.pm.#.# Description: Read DICOM and ACR-NEMA medical images.#.# Revisions: 2005/11/09 - P. Harvey Created.# 2009/11/19 - P. Harvey Added private GE tags from ref 4.# 2009/12/11 - P. Harvey Updated to DICOM 2008 spec.# 2010/04/08 - P. Harvey Updated to DICOM 2009 spec.#.# References: 1) http://medical.nema.org/.# 2) http://www.sph.sc.edu/comd/rorden/dicom.html.# 3) http://www.dclunie.com/.# 4) http://www.gehealthcare.com/usen/interoperability/dicom/docs/2258357r3.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::DICOM;..use strict;.use vars qw($VERSION %uid);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.19';..# DICOM VR (Value Representation) format conversions.my %dicomFormat = (. FD => 'd

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DJI.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	5.129085913275834
Encrypted:	false
SSDEEP:	48:YSOLwHpur56ULVd2hwYSq3yvXzsfudZ6P1z++:9UV6wYV3hz++
MD5:	420F12288D882BFE02B39CD2FD20F2CD
SHA1:	FBCF0EF45AAAD11C69D6FD86BB6ED50B6119C150
SHA-256:	B40A98C1CDCCEE9D0757B26F9622CABE555B1D1009D4B389ED59F3DB4BCE530C
SHA-512:	4A3E70A2B2A20FBF43CF029C75DC9A9E94F0A01F7DFEE0CDD633ADBFCB7D359619EA40508B385176D38867B2E25F4584C1F19C6C6C293D36C7FCA156A42C646D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DJI.pm".#------------------------------------------------------------------------------.# File: DJI.pm.#.# Description: DJI Phantom maker notes tags.#.# Revisions: 2016-07-25 - P. Harvey Created.# 2017-06-23 - PH Added XMP tags.#------------------------------------------------------------------------------..package Image::ExifTool::DJI;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;.use Image::ExifTool::XMP;..$VERSION = '1.01';..my %convFloat2 = (. PrintConv => 'sprintf("%+.2f", $val)',. PrintConvInv => '$val',.);..# DJI maker notes (ref PH, mostly educated guesses based on DJI QuickTime::UserData tags).%Image::ExifTool::DJI::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. NOTES => q{. This table lists tags found in the maker notes of images from some DJI. Phantom drones.. },

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DNG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	31356
Entropy (8bit):	4.6373310415028435
Encrypted:	false
SSDEEP:	384:c4uT+SzKh0yHhPP6k2Hc9YuEg9fTihwYM0ds8FQvWGJl2syDB6EOLSL:vuUyyHhH72HcWNhwaFQvWM+lOL+
MD5:	20EDF9982106E42CD4F12D7A23ACAC74
SHA1:	5DF6C18137B6D7318E66DE337794D2CF39309DD1
SHA-256:	35604026022A0EE5AA431148098B545C0ED579C30CDECE04144294D49F957EBB
SHA-512:	ABA4A0F139D52915C5C2D17D20E524E3FAC2917C9E203FD2C069C36EF865F19ADD57900D50AAB91D379EE14D52877EC0D473A72851401F3CA910540FDDFBF172
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DNG.pm".#------------------------------------------------------------------------------.# File: DNG.pm.#.# Description: Read DNG-specific information.#.# Revisions: 01/09/2006 - P. Harvey Created.#.# References: 1) http://www.adobe.com/products/dng/.#------------------------------------------------------------------------------..package Image::ExifTool::DNG;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::MakerNotes;.use Image::ExifTool::CanonRaw;..$VERSION = '1.22';..sub ProcessOriginalRaw($$$);.sub ProcessAdobeData($$$);.sub ProcessAdobeMakN($$$);.sub ProcessAdobeCRW($$$);.sub ProcessAdobeRAF($$$);.sub ProcessAdobeMRW($$$);.sub ProcessAdobeSR2($$$);.sub ProcessAdobeIFD($$$);.sub WriteAdobeStuff($$$);..# data in OriginalRawFileData.%Image::ExifTool::DNG::OriginalRaw = (. GROUPS => { 2 => 'Image' },. PROCESS_PROC => \&ProcessOriginalRaw,. NOTES => q{. Th

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DPX.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6721
Entropy (8bit):	4.962956277185899
Encrypted:	false
SSDEEP:	96:g0gV62Pt+9D3KWIs1iXUvF3xOVE8gOOsX+SBbvWYl3W/:6zt033IuiX/H8SZvWYxW/
MD5:	DC988CC7C9D5357776B5A798A1ACFA92
SHA1:	C840AFA3D16286F6D480533484667929632573E7
SHA-256:	C33AB012AD1EF85D7E45CF922BB9593BA8AC787A3487B26BD7C64602D1A45E42
SHA-512:	BE715E07B7485257576D7D14D240B53420101EEDB5F6CB321E2E3093929941A6A483CE51565E007CB21B31D98EF2FD193100FA6B7D11CF5779BFB4E896D17C12
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DPX.pm".#------------------------------------------------------------------------------.# File: DPX.pm.#.# Description: Read DPX meta information.#.# Revisions: 2013-09-19 - P. Harvey created.#.# References: 1) http://www.cineon.com/ff_draft.php.#------------------------------------------------------------------------------..package Image::ExifTool::DPX;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.03';..# DPX tags.%Image::ExifTool::DPX::Main = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. GROUPS => { 0 => 'File', 1 => 'File', 2 => 'Image' },. NOTES => 'Tags extracted from DPX (Digital Picture Exchange) images.',. 0 => { Name => 'ByteOrder', Format => 'undef[4]', PrintConv => { SDPX => 'Big-endian', XPDS => 'Little-endian' } },. 8 => { Name => 'HeaderVersion', Format => 'string[8]' },. # 24 => { Name => 'GenericHeaderSize', Format => 'int32u' }, # = 1664. # 2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DV.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9479
Entropy (8bit):	4.8640034488700215
Encrypted:	false
SSDEEP:	192:AyWRA3BLf9PLAAARFa8RfeibhXO2go6ZluBwqUAW6VEr80YWWtPyiYldluZXWd:AyDRLRLNepFgo6ZqEr88Ce
MD5:	79252F87128448227F3C526F51990677
SHA1:	A9BFA17AE9EF702E9C1A652658BA6E33B587E8CA
SHA-256:	510A63703A5FE1779D14F97B544A66F2B691B93B64BDA8EC669111B38FE794B0
SHA-512:	1607BEBFD1306433AE855B2C09580BAE90508A5B4EDFE9EBAD39FF3A3645B61633B827D5901B549ABDC30A51A7F649AFAF00D809EBF8D4C11C138F4720F0D7FA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DV.pm".#------------------------------------------------------------------------------.# File: DV.pm.#.# Description: Read DV meta information.#.# Revisions: 2010/12/24 - P. Harvey Created.#.# References: 1) http://www.ffmpeg.org/.# 2) http://dvswitch.alioth.debian.org/wiki/DV_format/.#------------------------------------------------------------------------------..package Image::ExifTool::DV;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.01';..# DV profiles (ref 1).my @dvProfiles = (. {. DSF => 0,. VideoSType => 0x0,. FrameSize => 120000,. VideoFormat => 'IEC 61834, SMPTE-314M - 525/60 (NTSC)',. VideoScanType => 'Progressive',. Colorimetry => '4:1:1',. FrameRate => 30000/1001,. ImageHeight => 480,. ImageWidth => 720,. },{. DSF => 1,. VideoSType => 0x0,. FrameSize => 144000,. VideoFormat => '

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DarwinCore.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	14327
Entropy (8bit):	4.034386246482537
Encrypted:	false
SSDEEP:	192:eLIIlZBDQikuhVwTBOgzovZi+XaDOoCJGpFRsYI8Rh5bxpLjjLbT++3h:4IYZBUik88FovZi+qI4ukHzh
MD5:	1625D26F104147EC5EEC1E895A6BCAC4
SHA1:	564553F805F5E7D7C0EB595399274AE2656C7325
SHA-256:	D076A256F119702F72944099B593C908113707409F5244A9E4194D6F21507AD9
SHA-512:	4BE495D2D96025EFF2394910AA74BE6859C4E1BC76D5C6BA1697C48D10D2FE0D736D591C1C33F6B24D3DFD8DFEC7A2AC287D3B4D19B942BC69E1F0602B039C52
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DarwinCore.pm".#------------------------------------------------------------------------------.# File: DarwinCore.pm.#.# Description: Darwin Core XMP tags.#.# Revisions: 2013-01-28 - P. Harvey Created.#.# References: 1) http://rs.tdwg.org/dwc/index.htm.# 2) http://u88.n24.queensu.ca/exiftool/forum/index.php/topic,4442.0/all.html.#------------------------------------------------------------------------------..package Image::ExifTool::DarwinCore;..use strict;.use vars qw($VERSION);.use Image::ExifTool::XMP;..$VERSION = '1.02';..my %dateTimeInfo = (. # NOTE: Do NOT put "Groups" here because Groups hash must not be common!. Writable => 'date',. Shift => 'Time',. PrintConv => '$self->ConvertDateTime($val)',. PrintConvInv => '$self->InverseDateTime($val,undef,1)',.);..my %materialSample = (. STRUCT_NAME => 'DarwinCore MaterialSample',. NAMESPACE => 'dwc',. materialSampleID => { },.);..my %event = (. STR

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\DjVu.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11825
Entropy (8bit):	4.8675451502126466
Encrypted:	false
SSDEEP:	192:DAgJTOC/dkNQWWHw4wGypJv+sewruS086VWNIOniQWBEafy+tOWsPk9G0:DAgJTOskNkQ4yJzec0WjzUJ
MD5:	2D18206F6AAF6FF8A483FDC763B06EAE
SHA1:	71BD65621BEFF961698A76DEC770927CAD167FC6
SHA-256:	ADF58EAC481316153426E8FEE7AB28DF439C0D45672D62555E61587E4F1001F8
SHA-512:	F05337D2DDE462B83BA6E151A56F8F008FC590CC32D1C3555C3E28B715D0FAD572CD90E17B5A4C5D7358CEBB53899E05527652E66FEE43F3D04DB5E1E1F97ABD
Malicious:	false
Preview:	#line 1 "Image/ExifTool/DjVu.pm".#------------------------------------------------------------------------------.# File: DjVu.pm.#.# Description: Read DjVu archive meta information.#.# Revisions: 09/25/2008 - P. Harvey Created.#.# References: 1) http://djvu.sourceforge.net/ (DjVu v3 specification, Nov 2005).# 2) http://www.djvu.org/.#.# Notes: DjVu files are recognized and the IFF structure is processed.# by Image::ExifTool::AIFF.#------------------------------------------------------------------------------..package Image::ExifTool::DjVu;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.05';..sub ParseAnt($);.sub ProcessAnt($$$);.sub ProcessMeta($$$);.sub ProcessBZZ($$$);..# DjVu chunks that we parse (ref 4).%Image::ExifTool::DjVu::Main = (. GROUPS => { 2 => 'Image' },. NOTES => q{. Information is extracted from the following chunks in DjVu images. See. L<http://www.djvu.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\EXE.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	49127
Entropy (8bit):	4.706757837583928
Encrypted:	false
SSDEEP:	768:RQofc/Ce6HYz6egMq8PVzKI2E/DcmIQE7mRahCdWhldjwbnQMvhyKwZESAvU7:R1fI6egMq8PVz1/ImPTRSxcQ+hyBZEDk
MD5:	6A19B0D891966F9A54948D1A508E8D08
SHA1:	2E3E1584C9DFFA31127E03179D1522CF85BE16B5
SHA-256:	49994B87A9AEE333932CE972DB95627598B247EF960D2D4542091FD887714D6F
SHA-512:	FE2E5E9692A05E61F2136A5231405E31C89363A2D00C8EAEC394BC6F8F39781EEB043A09AB703326318AADD59784E28D2282B1A63FE2799EBA9E65D5996A3471
Malicious:	false
Preview:	#line 1 "Image/ExifTool/EXE.pm".#------------------------------------------------------------------------------.# File: EXE.pm.#.# Description: Read meta information of various executable file formats.#.# Revisions: 2008/08/28 - P. Harvey Created.# 2011/07/12 - P. Harvey Added CHM (ok, not EXE, but it fits here).#.# References: 1) http://www.openwatcom.org/ftp/devel/docs/pecoff.pdf.# 2) http://support.microsoft.com/kb/65122.# 3) http://www.opensource.apple.com.# 4) http://www.skyfree.org/linux/references/ELF_Format.pdf.# 5) http://msdn.microsoft.com/en-us/library/ms809762.aspx.# 6) http://code.google.com/p/pefile/.# 7) http://www.codeproject.com/KB/DLL/showver.aspx.#------------------------------------------------------------------------------..package Image::ExifTool::EXE;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.14';..su

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Exif.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	226500
Entropy (8bit):	4.651615518844234
Encrypted:	false
SSDEEP:	3072:fSy3z4YQEgrejsklLzR3SEaJlvg62IAZ9b9FmtucwEDW:t8YQL6jsSRCvJlvgNV6uP
MD5:	61C860BA3B487A674119069A30D7D3A1
SHA1:	4268ED54312990A7DE829A553DF8E51D39C3CBAF
SHA-256:	178AFAF1708A7E06DF72CA5FDA52D406C8848AB4611F6A5B6BE67F60E67DFDD2
SHA-512:	93D29EE6EDDD702F5D06977816EC0D7D70A092FBEBDBB572D2A04F53254DF42278D68493D194F5D3A5154EBF573F6DF233032D02765793E1B6918BF79E8B1375
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Exif.pm".#------------------------------------------------------------------------------.# File: Exif.pm.#.# Description: Read EXIF/TIFF meta information.#.# Revisions: 11/25/2003 - P. Harvey Created.# 02/06/2004 - P. Harvey Moved processing functions from ExifTool.# 03/19/2004 - P. Harvey Check PreviewImage for validity.# 11/11/2004 - P. Harvey Split off maker notes into MakerNotes.pm.# 12/13/2004 - P. Harvey Added AUTOLOAD to load write routines.#.# References: 0) http://www.exif.org/Exif2-2.PDF.# 1) http://partners.adobe.com/asn/developer/pdfs/tn/TIFF6.pdf.# 2) http://www.adobe.com/products/dng/pdfs/dng_spec_1_3_0_0.pdf.# 3) http://www.awaresystems.be/imaging/tiff/tifftags.html.# 4) http://www.remotesensing.org/libtiff/TIFFTechNote2.html.# 5) http://www.exif.org/dcf.PDF.# 6) http://park2.wakwak.com/~tsuruzoh

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\FLAC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9470
Entropy (8bit):	4.746962906498496
Encrypted:	false
SSDEEP:	192:eDpYFNvfFos/x8n9knDv9rT6zbei3idBBXmiVidBBC8hyMOfQWQc766DS8IhuZXu:eDqFpfOs/Zb04OEtHXm7F
MD5:	6AE7DAEF4CBE68F9B1DACB03A688DD14
SHA1:	89B969EE4999684A26DE846D14C774850318D075
SHA-256:	DDCA25343A0343078C8876C8B6B7388C9064061B330E64685D691A022F329750
SHA-512:	E4E08D69FE5F35C63A022C7CEA4946AEB62E05FBA5FDE63D70D92B6B311B3BC19715FDD0BC47E5C8C0F84BE8E024FF74C34727F0B27C0716EDA4013C18A35A2F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/FLAC.pm".#------------------------------------------------------------------------------.# File: FLAC.pm.#.# Description: Read Free Lossless Audio Codec information.#.# Revisions: 11/13/2006 - P. Harvey Created.#.# References: 1) http://flac.sourceforge.net/.#------------------------------------------------------------------------------..package Image::ExifTool::FLAC;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.08';..sub ProcessBitStream($$$);..# FLAC metadata blocks.%Image::ExifTool::FLAC::Main = (. NOTES => q{. Free Lossless Audio Codec (FLAC) meta information. ExifTool also extracts. ID3 information from these files.. },. 0 => {. Name => 'StreamInfo',. SubDirectory => { TagTable => 'Image::ExifTool::FLAC::StreamInfo' },. },. 1 => { Name => 'Padding', Binary => 1, Unknown => 1 },. 2 => { Name => 'Application', Binary => 1, Unknown => 1 },. 3 =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\FLIF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11263
Entropy (8bit):	4.720021930137138
Encrypted:	false
SSDEEP:	192:DCHneVVkg8QFBxQYKhEKZtDGAZdCyMG1ZNqc06S+vAFiQWLx/hzUhKtiQWr:2HeVVkwnxAZD0kBx2D
MD5:	F2FE561BFB7E446752EDBEC0DF598983
SHA1:	41B9F4020C8B6E2CD228083AFC3ECA5BB428FA22
SHA-256:	D5285DFD6AAE70F329F79BA07553DD0033762FDEAB56E1F3A5F16A0047B25CDE
SHA-512:	FFE802075A891861B135277030B640F84F884364DBA2F1E43B14308E81F42A54BCDBF944F0647E9B310D4956778944A58CCC13D0F80F84E5ED444748748AFB43
Malicious:	false
Preview:	#line 1 "Image/ExifTool/FLIF.pm".#------------------------------------------------------------------------------.# File: FLIF.pm.#.# Description: Read/write FLIF meta information.#.# Revisions: 2016/10/11 - P. Harvey Created.# 2016/10/14 - PH Added write support.#.# References: 1) http://flif.info/.# 2) https://github.com/FLIF-hub/FLIF/blob/master/doc/metadata.#------------------------------------------------------------------------------..package Image::ExifTool::FLIF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..my %flifMap = (. EXIF => 'FLIF',. XMP => 'FLIF',. ICC_Profile => 'FLIF',. IFD0 => 'EXIF',. IFD1 => 'IFD0',. ExifIFD => 'IFD0',. GPS => 'IFD0',. SubIFD => 'IFD0',. GlobParamIFD => 'IFD0',. PrintIM => 'IFD0',. InteropIFD => 'ExifIFD',. MakerNotes => 'ExifIFD',.);..# FLIF tags.%Image::

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\FLIR.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	55161
Entropy (8bit):	5.026799567077266
Encrypted:	false
SSDEEP:	768:ox21hATBJc0t0VSs4KHpSGuZRpv3wfaRvvOTRE1l3hOHpm4vg:S21h0BJc0t094EQGuZruaRvvOFNm4vg
MD5:	E17F9514FECA4A3FC9302DA9E74B4A01
SHA1:	53D59D4D4DEC61D75A48C27A4B1D8B4FBB877E50
SHA-256:	0AA15DD4DE87237ACC3CA07D306C027B584346B690717B1A319C556DD91312D1
SHA-512:	28A2D58946DB15C9DCB2CF921B9F1C0A8A3089C8577E07A59E65FB27E1B503587831B8C1A6F7B283CA2B9EFCF4D3260A061BC85048A659D7D38B243022203357
Malicious:	false
Preview:	#line 1 "Image/ExifTool/FLIR.pm".#------------------------------------------------------------------------------.# File: FLIR.pm.#.# Description: Read FLIR meta information.#.# Revisions: 2013/03/28 - P. Harvey Created.#.# References: 1) http://u88.n24.queensu.ca/exiftool/forum/index.php/topic,4898.0.html.# 2) http://www.nuage.ch/site/flir-i7-some-analysis/.# 3) http://www.workswell.cz/manuals/flir/hardware/A3xx_and_A6xx_models/Streaming_format_ThermoVision.pdf.# 4) http://support.flir.com/DocDownload/Assets/62/English/1557488%24A.pdf.# 5) http://code.google.com/p/dvelib/source/browse/trunk/flirPublicFormat/fpfConverter/Fpfimg.h?spec=svn3&r=3.# 6) http://u88.n24.queensu.ca/exiftool/forum/index.php/topic,5538.0.html.# JD) Jens Duttke private communication.#.# Glossary: FLIR = Forward Looking Infra Red.#------------------------------------------------------------------------------..packa

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Fixup.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11243
Entropy (8bit):	4.688072782498249
Encrypted:	false
SSDEEP:	192:ji9kLoe0++iOiQ4gyzyrusRbtyRb6DDBDyiQWOQCYQi+kX28yRhwx488yRtiQA2l:ji91ePR9yrhb+0+6uC4il
MD5:	6624DB2054801F23B6A64AB73F9DE538
SHA1:	BD0A8509FDB9CD6428FF6FB9F3E8D25321B5E062
SHA-256:	D54A7EBAE35EBF6CBD52F381722D11CCA2E110FD45AE3BCAC4136B54A16BCFA6
SHA-512:	F5D5C0F985A7970A62324D5BB909123158A8E870677CA3E380C93B74B31560B23DB5CD23EEA177AA38DD5CBBDA83E923B29AF5FB54C6D553C967A0E7DBFF28AE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Fixup.pm".#------------------------------------------------------------------------------.# File: Fixup.pm.#.# Description: Utility to handle pointer fixups.#.# Revisions: 01/19/2005 - P. Harvey Created.# 04/11/2005 - P. Harvey Allow fixups to be tagged with a marker,.# and add new marker-related routines.# 06/21/2006 - P. Harvey Patch to work with negative offsets.# 07/07/2006 - P. Harvey Added support for 16-bit pointers.# 02/19/2013 - P. Harvey Added IsEmpty().#.# Data Members:.#.# Start - Position in data where a zero pointer points to..# Shift - Amount to shift offsets (relative to Start)..# Fixups - List of Fixup object references to to shift relative to this Fixup..# Pointers - Hash of references to fixup pointer arrays, keyed by ByteOrder.# string (with "2" added if pointer is 16-bit [default is 32-bit],.# plus "_

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Flash.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	26908
Entropy (8bit):	4.67555542336249
Encrypted:	false
SSDEEP:	384:nb5DpsSvXleC7GT3Gjkm1aAG75t8nGQC31YW2WpWkq:b5+SvXoC7+GjkmAAG78nDC31Q
MD5:	74B35DEDAC05C5BD3DBE85A1396686AC
SHA1:	AE2086E1BC89F5CA64E30A64D4A7F1864CD6B62F
SHA-256:	6788F17E5E2D69FC9325D0F80690BD7D926126F0CA5EB9FAF148EE40FBCFBD57
SHA-512:	A76934F5179D8D47F5C37B9CEB1918AAFB2EB35010515E6D549DC0358859E909E43B5A28037310F4DC4590FA9E12378F8B5EB6C4F8455882B67980751F21279D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Flash.pm".#------------------------------------------------------------------------------.# File: Flash.pm.#.# Description: Read Shockwave Flash meta information.#.# Revisions: 05/16/2006 - P. Harvey Created.# 06/07/2007 - PH Added support for FLV (Flash Video) files.# 10/23/2008 - PH Added support for XMP in FLV and SWF.#.# References: 1) http://www.the-labs.com/MacromediaFlash/SWF-Spec/SWFfileformat.html.# 2) http://sswf.sourceforge.net/SWFalexref.html.# 3) http://osflash.org/flv/.# 4) http://www.irisa.fr/texmex/people/dufouil/ffmpegdoxy/flv_8h.html.# 5) http://www.adobe.com/devnet/xmp/pdfs/XMPSpecificationPart3.pdf (Oct 2008).# 6) http://www.adobe.com/devnet/swf/pdf/swf_file_format_spec_v9.pdf.# 7) http://help.adobe.com/en_US/FlashMediaServer/3.5_Deving/WS5b3ccc516d4fbf351e63e3d11a0773d56e-7ff6.html.# 8) http://www.adobe.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\FlashPix.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	72154
Entropy (8bit):	4.883168931683731
Encrypted:	false
SSDEEP:	1536:BS371bBMWYm5W7wzLtOq7ZEavvaI0j35KBTQAkM/1D:meWv5W0HtOq7Zxy35KxQVM/1D
MD5:	EE0A84A3804A322EAD3A742BA01EAE74
SHA1:	863FDD6B1384269E5207C8E1E5A224EF9E355C55
SHA-256:	74C81044663999D81FD6F47260FEC8118896590761F4F9477755DFDB797A5A98
SHA-512:	33197A19BB08489FCF99238A6318CFB63AA0D55C21DB252BCD5F4A78C2ADDD1AC9F2BF2530564CF581B2CF53EB655B081B51BEF12D985356ED9108AFD21D04B4
Malicious:	false
Preview:	#line 1 "Image/ExifTool/FlashPix.pm".#------------------------------------------------------------------------------.# File: FlashPix.pm.#.# Description: Read FlashPix meta information.#.# Revisions: 05/29/2006 - P. Harvey Created.#.# References: 1) http://www.exif.org/Exif2-2.PDF.# 2) http://www.graphcomp.com/info/specs/livepicture/fpx.pdf.# 3) http://search.cpan.org/~jdb/libwin32/.# 4) http://msdn.microsoft.com/en-us/library/aa380374.aspx.#------------------------------------------------------------------------------..package Image::ExifTool::FlashPix;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::ASF; # for GetGUID()..$VERSION = '1.30';..sub ProcessFPX($$);.sub ProcessFPXR($$$);.sub ProcessProperties($$$);.sub ReadFPXValue($$$$$;$$);.sub ProcessHyperlinks($$);.sub ProcessContents($$$);.sub SetDocNum($$;$$$);..# sector type constants.sub HDR_SIZE

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Font.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	26527
Entropy (8bit):	4.923174251754697
Encrypted:	false
SSDEEP:	768:1S7ydOiwJLgCSbf21/w+1E4gb/IYfcqm568:ytxjlE4gb/IAcqm5n
MD5:	6CE6064720AF713F8CEA788EDFE423A1
SHA1:	008EB827854B5C02C9060D4D589D4D5376D1C9CC
SHA-256:	162FF0D9794F105C7F03EA2257CBBEDC232BAD1D43B9A644E78C2B6D85C776EA
SHA-512:	C893C4AE8C8294830E67D009DFF5418BEF1325487E0E798C2398ADF850F2ECBD5805C7B37F4FBFC720BAD55F1A68E6EDF8510B17678B837C35872D10BDCBE4A7
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Font.pm".#------------------------------------------------------------------------------.# File: Font.pm.#.# Description: Read meta information from font files.#.# Revisions: 2010/01/15 - P. Harvey Created.#.# References: 1) http://developer.apple.com/textfonts/TTRefMan/RM06/Chap6.html.# 2) http://www.microsoft.com/typography/otspec/otff.htm.# 3) http://partners.adobe.com/public/developer/opentype/index_font_file.html.# 4) http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf.# 5) http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/modules/compiler/src/java/flex2/compiler/util/MimeMappings.java.# 6) http://www.adobe.com/devnet/font/pdfs/5004.AFM_Spec.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Font;..use strict;.use vars qw($VERSION %ttLang);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\FotoStation.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	4.641644313874439
Encrypted:	false
SSDEEP:	192:Ur7oCRAJpL7y7+ZVkodFyhtT0ReSwEiCCeyzike:U3oCRAJpLO7q3dkx8v
MD5:	12692996C3696CB21E41BA16896AEE7F
SHA1:	0AF6DAB1D36A644AAE3F53E90AD18A75F578D3E4
SHA-256:	4470FC1B6AD9825A3180C3697294E7FA8CF64DF14D4C9459E46F330B733FDBA5
SHA-512:	6D2DD352C8155100D730E51113E74C25E00B9E8872296988A883DCD9F34213F78471DEAA08C11B62F64AF4B20AA352E335ABAC8AD8444B4CB611692D9F51A967
Malicious:	false
Preview:	#line 1 "Image/ExifTool/FotoStation.pm".#------------------------------------------------------------------------------.# File: FotoStation.pm.#.# Description: Read/write FotoWare FotoStation trailer.#.# Revisions: 10/28/2006 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::FotoStation;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.04';..sub ProcessFotoStation($$);..%Image::ExifTool::FotoStation::Main = (. PROCESS_PROC => \&ProcessFotoStation,. WRITE_PROC => \&ProcessFotoStation,. GROUPS => { 2 => 'Image' },. NOTES => q{. The following tables define information found in the FotoWare FotoStation. trailer.. },. 0x01 => {. Name => 'IPTC',. SubDirectory => {. TagTable => 'Image::ExifTool::IPTC::Main',. },. },. 0x02 => {. Name => 'SoftEdit',. SubDirectory => {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\FujiFilm.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	42157
Entropy (8bit):	4.769304841136165
Encrypted:	false
SSDEEP:	768:EdzwYzay3VoURoJmGR/qwLW1C7CEKcNCZR3:MeESJmG8EsC7CEKcoR3
MD5:	C31C8B9C5FAD29EBC1324ED25B0DBAF3
SHA1:	36D8A358ECD2E9452F9E52766CE880C6F0059231
SHA-256:	AEF2C8F3B5D3899178900DE574073D955EA38FBC22B06E5278192E3D3ED27DCF
SHA-512:	F823C73FE76C4313114A9A18334E53AFD019C46A38B0E7493FB24858DDC615477FEE56ACE3532E994040EF7022DC72E898900FAE8AB43D3F99AD6F9BBDEC7F75
Malicious:	false
Preview:	#line 1 "Image/ExifTool/FujiFilm.pm".#------------------------------------------------------------------------------.# File: FujiFilm.pm.#.# Description: Read/write FujiFilm maker notes and RAF images.#.# Revisions: 11/25/2003 - P. Harvey Created.# 11/14/2007 - PH Added abilty to write RAF images.#.# References: 1) http://park2.wakwak.com/~tsuruzoh/Computer/Digicams/exif-e.html.# 2) http://homepage3.nifty.com/kamisaka/makernote/makernote_fuji.htm (2007/09/11).# 3) Michael Meissner private communication.# 4) Paul Samuelson private communication (S5).# 5) http://www.cybercom.net/~dcoffin/dcraw/.# 6) http://forums.dpreview.com/forums/readflat.asp?forum=1012&thread=31350384.# and http://forum.photome.de/viewtopic.php?f=2&t=353&p=742#p740.# 7) Kai Lappalainen private communication.# 8) http://u88.n24.queensu.ca/exiftool/forum/index.php/topic,5223.0.h

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\GE.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1517
Entropy (8bit):	5.0365248104107065
Encrypted:	false
SSDEEP:	24:TOyRvjKvBwrur5bUya6nM6v9YDC5Xjy8aYlNiU+QVQ2X0GF2sJX20Yr/:D7Kpw6r5bUypu8aJVQVQ2XdVQr/
MD5:	797FF492083800D26E035ACED988E654
SHA1:	B91924E456FE92E03C31A60EC71A802236B2B6E1
SHA-256:	EAA14BFDD49F3A6C6D9E605D1D224184539A4A25DE48DB841CA9120AFAC59F19
SHA-512:	DD682D5EC59AC2AF3E1518D2CA51F6803E3C5F6C3011E2CC7945E2B08D0A5BBBCA4DE46F9542B86920A53AEA8E9182A44E888447F5AE31A109B0E1A0DE9AD7F6
Malicious:	false
Preview:	#line 1 "Image/ExifTool/GE.pm".#------------------------------------------------------------------------------.# File: GE.pm.#.# Description: General Imaging maker notes tags.#.# Revisions: 2010-12-14 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::GE;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.00';..sub ProcessGE2($$$);..# GE type 1 maker notes (ref PH).# (similar to Kodak::Type11 and Ricoh::Type2).%Image::ExifTool::GE::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. WRITABLE => 1,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. NOTES => q{. This table lists tags found in the maker notes of some General Imaging. camera models.. },. # 0x0104 - int32u. # 0x0200 - int32u[3] (with invalid offset of 0). 0x0202 => {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\GIF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21280
Entropy (8bit):	4.461900812073993
Encrypted:	false
SSDEEP:	384:m5iVnDOzksIvC9gAEsgSflvkXbnWWqBA2PQqki8haUjPFL:m5iB6gsMC9gLsgslcXbnWWqBAqQti8hV
MD5:	A3A1956795C400E7A8B24E3EC8D46722
SHA1:	25FC9F5166B1BF4341E47E77C630B9E47DD4B1DE
SHA-256:	192E1F51F80A7C30607507FBB5CE5B941E5D0AEE9EC5BF2904A19558335ACE5D
SHA-512:	C4A5C16AD656CE3D1DB9FF24BA52C3658496FF125CA0FC4556F8AEC5AB9469FD62890AC81F0A738103F11D82605C1348E58FDDB0CCC6349DBFCAA9002993CC6F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/GIF.pm".#------------------------------------------------------------------------------.# File: GIF.pm.#.# Description: Read and write GIF meta information.#.# Revisions: 10/18/2005 - P. Harvey Separated from ExifTool.pm.# 05/23/2008 - P. Harvey Added ability to read/write XMP.# 10/28/2011 - P. Harvey Added ability to read/write ICC_Profile.#.# References: 1) http://www.w3.org/Graphics/GIF/spec-gif89a.txt.# 2) http://www.adobe.com/devnet/xmp/.# 3) http://graphcomp.com/info/specs/ani_gif.html.# 4) http://www.color.org/icc_specs2.html.# 5) http://www.midiox.com/mmgif.htm.#------------------------------------------------------------------------------..package Image::ExifTool::GIF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.15';..# road map of directory locations in GIF images.my %gifMap = (. XMP => 'GIF',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\GIMP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6698
Entropy (8bit):	4.867636874041832
Encrypted:	false
SSDEEP:	96:DIOFEV62oP6OPKuZS1Q8c3qB9dR3D/LocfpFk+QWRXDSBb1xgzBOBK3B+QWfd:2/a9S1nc3GnfFlQWZSZ1xgzIBK3cQWfd
MD5:	907BD75EF2AF3F46E4EC520128BBB7EF
SHA1:	1D33F7CF65BB0173851C4335FC56A337ED7861D2
SHA-256:	00641E940B907BA03FFA0FB19660404328C13F2A3C0DF00C0514799EE58C56A4
SHA-512:	749F7F97CA5D2C76896E9D26D7EC18189B75575575E85F6053B1CE69A66154F60ED002696033D9EC43D78A02FC7F8A471FCD1651301D3B2A2B220E49437D610B
Malicious:	false
Preview:	#line 1 "Image/ExifTool/GIMP.pm".#------------------------------------------------------------------------------.# File: GIMP.pm.#.# Description: Read meta information from GIMP XCF images.#.# Revisions: 2010/10/05 - P. Harvey Created.#.# References: 1) GIMP source code.# 2) http://svn.gnome.org/viewvc/gimp/trunk/devel-docs/xcf.txt?view=markup.#------------------------------------------------------------------------------..package Image::ExifTool::GIMP;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..sub ProcessParasites($$$);..# GIMP XCF properties (ref 2).%Image::ExifTool::GIMP::Main = (. GROUPS => { 2 => 'Image' },. VARS => { ALPHA_FIRST => 1 },. NOTES => q{. The GNU Image Manipulation Program (GIMP) writes these tags in its native. XCF (eXperimental Computing Facilty) images.. },. header => { SubDirectory => { TagTable => 'Image::ExifTool::GIMP::Header' } },. 17 => {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\GPS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	4.738432501205105
Encrypted:	false
SSDEEP:	192:ur5hbLDTJ/pgPYBo6J3bsX5Xlst336RwI1Cac70/nMQgOA2p+mu9cBGiH3X0nUiW:urLx/PBhrspdc4nrn4nmlq4T
MD5:	2B6BFE6152C80A12772EF1B5A700AFAB
SHA1:	16EDDF10BB48BEF0931E0C33742F62281FB07705
SHA-256:	992E585EEE11F4803A4544C693A0A5D1059674A77183659AEC65CDE9A73D0CB9
SHA-512:	F1310F661F5BA9B735B1AA065B736C543AC19FD75D49FBE4CDC9577249F7DE6CC08E110CF180EEAD42AE30A97F5F8468825D10DEE3086064F0AA5E0FB56D8E2C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/GPS.pm".#------------------------------------------------------------------------------.# File: GPS.pm.#.# Description: EXIF GPS meta information tags.#.# Revisions: 12/09/2003 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::GPS;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;..$VERSION = '1.49';..my %coordConv = (. ValueConv => 'Image::ExifTool::GPS::ToDegrees($val)',. ValueConvInv => 'Image::ExifTool::GPS::ToDMS($self, $val)',. PrintConv => 'Image::ExifTool::GPS::ToDMS($self, $val, 1)',. PrintConvInv => 'Image::ExifTool::GPS::ToDegrees($val)',.);..%Image::ExifTool::GPS::Main = (. GROUPS => { 0 => 'EXIF', 1 => 'GPS', 2 => 'Location' },. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. WRITABLE => 1,. WRITE_GROUP => 'GPS',. 0x0000 => {. Name => 'GPSVersionID',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\GeoTiff.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	88549
Entropy (8bit):	4.357120433962132
Encrypted:	false
SSDEEP:	1536:xOG/uPgsdwChSEUWmLKUjF1rzKbO8PM0FNmVwiUCIKk6bh5iUMuooaRgxroEveM6:xOG/uPgsdwChSEUWmLKUjHrzKbO8Ekm+
MD5:	D63937ACF1A92BE9DAC16BF051B621B9
SHA1:	AD7DCF0F1F90BC4626318CDAA3B1D67786F1D9F0
SHA-256:	07B347EB4CE44FC0149EEF7101FFF9C68813218CBD01EB2AFDB23C6656DF8EB1
SHA-512:	B4078270E90198585E629B10DD2E582D6748AB0C66A51921231FB9FA437DC35160C3DDB629C19DD65E19F597FB986AAB6F67928B695C0A774628E1FC3340F070
Malicious:	false
Preview:	#line 1 "Image/ExifTool/GeoTiff.pm".#------------------------------------------------------------------------------.# File: GeoTiff.pm.#.# Description: Read GeoTiff meta information.#.# Revisions: 02/23/2004 - P. Harvey Created.# 02/25/2004 - PH Added new codes from libgeotiff-1.2.1.# 02/01/2007 - PH Added new codes from libgeotiff-1.2.3.# 01/22/2014 - PH Added new code from libgeotiff-1.4.0.# 01/19/2015 - PH Added ChartTIFF tags.#.# References: 1) ftp://ftp.remotesensing.org/geotiff/libgeotiff/libgeotiff-1.1.4.tar.gz.# 2) http://www.charttiff.com/whitepapers.shtml.#------------------------------------------------------------------------------..package Image::ExifTool::GeoTiff;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.11';..# format codes for geoTiff directory entries.my %geoTiffFormat = (. 0 => 'int16u',. 0x87b0 => 'double',. 0x87b1 =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Geotag.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	54954
Entropy (8bit):	4.568977515745789
Encrypted:	false
SSDEEP:	768:T8QrOpo2pkAcDO5+T/LcXpDGy+c6WHpUCUlPBwARV6zcEMPLR+Y:QQqpo9K5+T/Lc8NpAMcY
MD5:	3E9D0E00A1575FDB93A581E94BA0BFE6
SHA1:	43CDF8E8E18AFCAEBDDBA4138689015C1040E560
SHA-256:	527B6DEB8CADC2354B07025BCA8C206E67433AFD222DB28091DA0A218C06E028
SHA-512:	D63F4692DEE0D535BD1A530806FB9ADC836BCCF2D202BC9F1F58ED8A53D55FF1FE4A6987F3F1C41EF54144C54B5D172040E5958AA4C518B958381965A9D481CE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Geotag.pm".#------------------------------------------------------------------------------.# File: Geotag.pm.#.# Description: Geotagging utility routines.#.# Revisions: 2009/04/01 - P. Harvey Created.# 2009/09/27 - PH Added Geosync feature.# 2009/06/25 - PH Read Garmin TCX track logs.# 2009/09/11 - PH Read ITC GPS track logs.# 2012/01/08 - PH Extract orientation information from PTNTHPR.# 2012/05/08 - PH Read Winplus Beacon .TXT files.# 2015/05/30 - PH Read Bramor gEO log files.# 2016/07/13 - PH Added ability to geotag date/time only.#.# References: 1) http://www.topografix.com/GPX/1/1/.# 2) http://www.gpsinformation.org/dale/nmea.htm#GSA.# 3) http://code.google.com/apis/kml/documentation/kmlreference.html.# 4) http://www.fai.org/gliding/system/files/tech_spec_gnss.pdf.#-----------------------------------------

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\GoPro.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	25490
Entropy (8bit):	5.052804165266163
Encrypted:	false
SSDEEP:	768:WiDNvUVW9h+e6KGxp7tXLGaJcKc3OlMYO80y:zNj9v6K6hXLGaJcKc3OleRy
MD5:	9CD2F36134422E8C1B51A338A8494D7F
SHA1:	52D146C13A61BF967C0CEE0226E66B53F798F92E
SHA-256:	BD3DE8D8CFA5FB8AAFEAD1669CF539AD1DAAA63A452EBCF18BEB6EDD224A14CD
SHA-512:	48C2330B5EF0CEDB8E2AADCDF3C0C0B5885CB17A949EB2FB052FA4A5453F3CD9F45F4C18944672FD269189A0F1406B8DA623967CFB14095965DF9508F7022A26
Malicious:	false
Preview:	#line 1 "Image/ExifTool/GoPro.pm".#------------------------------------------------------------------------------.# File: GoPro.pm.#.# Description: Read information from GoPro videos.#.# Revisions: 2018/01/12 - P. Harvey Created.#.# References: 1) https://github.com/gopro/gpmf-parser.# 2) https://github.com/stilldavid/gopro-utils.#------------------------------------------------------------------------------..package Image::ExifTool::GoPro;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::QuickTime;..$VERSION = '1.02';..sub ProcessGoPro($$$);.sub ProcessString($$$);.sub ScaleValues($$);.sub AddUnits($$$);.sub ConvertSystemTime($$);..# GoPro data types that have ExifTool equivalents (ref 1).my %goProFmt = ( # format codes. # 0x00 - container (subdirectory). 0x62 => 'int8s', # 'b'. 0x42 => 'int8u', # 'B'. 0x63 => 'string', # 'c' (possibly null terminated). 0x73 => 'int16s', # 's'. 0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\H264.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	38735
Entropy (8bit):	4.852836187033332
Encrypted:	false
SSDEEP:	384:xA79Ocw+3WowF5TXJQwOlXlOyzrBNuBnZAca39xJ7KiBUi:i73NWtFB7egyzrLuBycaBx
MD5:	3A0471213D37795D91421A0063927B84
SHA1:	563A2388C07EAAFED8D8C7F4468A303FAA1298E9
SHA-256:	A1ECAE7451BFC9AEF3F6D7F69CF4CE0E2FA67C5DAE951E4E40474C0A1BA1ACA8
SHA-512:	0BBA6610752B62E4551B6BCABE14773CDCEFEBC928708B43EA486197D457DC45E6B71DBBADEF12D06FDA58A425171724F13E4D923688916043B542F69377AEE9
Malicious:	false
Preview:	#line 1 "Image/ExifTool/H264.pm".#------------------------------------------------------------------------------.# File: H264.pm.#.# Description: Read meta information from H.264 video.#.# Revisions: 2010/01/31 - P. Harvey Created.#.# References: 1) http://www.itu.int/rec/T-REC-H.264/e (T-REC-H.264-200305-S!!PDF-E.pdf).# 2) http://miffteevee.co.uk/documentation/development/H264Parser_8cpp-source.html.# 3) http://ffmpeg.org/.# 4) US Patent 2009/0052875 A1.# 5) European Patent (EP2 051 528A1) application no. 07792522.0 filed 08.08.2007.# 6) Dave Nicholson private communication.# 7) http://www.freepatentsonline.com/20050076039.pdf.# 8) Michael Reitinger private communication (RX100).#.# Glossary: RBSP = Raw Byte Sequence Payload.#------------------------------------------------------------------------------..package Image::ExifTool::H264;..use strict;.use vars qw($VERSION %c

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\HP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7641
Entropy (8bit):	4.890459396211452
Encrypted:	false
SSDEEP:	192:CvTFVvZ1liZHUv8HuwKgpzixtQKQWAurcroQWq:CbF5WSRQz
MD5:	3F66466E18A388571769639E2341BCF4
SHA1:	5AC80AACB0AA872D0FD752D4D5E11DE7E290C125
SHA-256:	481F6FCBA75BF3B84B45003E26367C6F01AA5C463FAA70599626581D197B08D2
SHA-512:	E4B57FA67592040DECA1D19FFD30A657C26B960265E536C414DFB1A9A2F8C23217E9B5901725BFCC35174DABAF44AAB63F3DFF6E039DF46F7DD4685FAF7840CE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/HP.pm".#------------------------------------------------------------------------------.# File: HP.pm.#.# Description: Hewlett-Packard maker notes tags.#.# Revisions: 2007-05-03 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::HP;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.04';..sub ProcessHP($$$);.sub ProcessTDHD($$$);..# HP EXIF-format maker notes (or is it Vivitar?).%Image::ExifTool::HP::Main = (. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. NOTES => q{. These tables list tags found in the maker notes of some Hewlett-Packard. camera models... The first table lists tags found in the EXIF-format maker notes of the. PhotoSmart 720 (also used by the Vivitar ViviCam 3705, 3705B and 3715).. },. 0x0e00 => {. Name => 'PrintIM',. Description => 'Print Image Matching',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\HTML.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21451
Entropy (8bit):	4.84123147131626
Encrypted:	false
SSDEEP:	384:6rM0FZnyQWsrqLqHI9b8T/x9SL94MAGPAilHaJnsW0:6rM0PnXxqWHI9uJ98C3GPVlHaJsx
MD5:	C7FE73D050CB95BC93860C0453837920
SHA1:	DCC71183B61121593B5CADE51AB2A15322B148B7
SHA-256:	8238153C2FCD8E7BAE424EFFC432AD9A53A23B86A5DE95FC9127BD0F401CE341
SHA-512:	8B0B6255D9EB1082FF02065B3D131BDD9363332100C0D3507DC7D768D0D9501ECE0F5BCFD037F7F6F780ECBF3CE4D1E6B9EE013C3967013F6F4D39B82F9AA861
Malicious:	false
Preview:	#line 1 "Image/ExifTool/HTML.pm".#------------------------------------------------------------------------------.# File: HTML.pm.#.# Description: Read HTML meta information.#.# Revisions: 01/30/2007 - P. Harvey Created.#.# References: 1) http://www.w3.org/TR/html4/.# 2) http://www.daisy.org/publications/specifications/daisy_202.html.# 3) http://vancouver-webpages.com/META/metatags.detail.html.# 4) http://www.html-reference.com/META.htm.#------------------------------------------------------------------------------..package Image::ExifTool::HTML;..use strict;.use vars qw($VERSION @ISA @EXPORT_OK);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::PostScript;.use Image::ExifTool::XMP qw(EscapeXML UnescapeXML);.require Exporter;..$VERSION = '1.15';.@ISA = qw(Exporter);.@EXPORT_OK = qw(EscapeHTML UnescapeHTML);..sub SetHTMLCharset($$);..# convert HTML charset (lower case) to ExifTool Charset name.my %htmlCharset = (.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\HtmlDump.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	31553
Entropy (8bit):	4.626092091780415
Encrypted:	false
SSDEEP:	768:CvjoQKsvB+g3tyTjHVVsut7S5Iryu4EZYZU:6joQKsvBCXHrsU7S5YD
MD5:	3553B22707BD7C7DF32E73967D4D50D8
SHA1:	9E7DEFC1C283F9E6852247E984B74E8B3DCA4B9C
SHA-256:	1E7BA26C0B9AF4E4FA6780F28B438148E0B96D362F812E0C227853D08EFF2934
SHA-512:	D09245D6B7E6909319FACD51560455B52FD7E5999D26B497C56AABF220E6259F82D8CEBC00632ABECE52363777019B4C0AB6FA25951512EFF9333056F9AF5BDD
Malicious:	false
Preview:	#line 1 "Image/ExifTool/HtmlDump.pm".#------------------------------------------------------------------------------.# File: HtmlDump.pm.#.# Description: Dump information in hex to HTML page.#.# Revisions: 12/05/2005 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::HtmlDump;..use strict;.use vars qw($VERSION);.use Image::ExifTool; # only for FinishTiffDump().use Image::ExifTool::HTML qw(EscapeHTML);..$VERSION = '1.34';..sub DumpTable($$$;$$$$$);.sub Open($$$;@);.sub Write($@);..my ($bkgStart, $bkgEnd, @bkgSpan);..my $htmlHeader1 = <<_END_PART_1_;.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN". "http://www.w3.org/TR/1998/REC-html40-19980424/loose.dtd">.<html>.<head>.<title>._END_PART_1_..# Note: Don't change font-weight style because it can affect line height.my $htmlHeader2 = <<_END_PART_2_;.</title>.<style type="text/css">. ./* character style ID's /..D { color: #000000 } /

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\ICC_Profile.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	43048
Entropy (8bit):	4.925035279567526
Encrypted:	false
SSDEEP:	384:Kiyrl9SBSzaecxjS6dGogYuiJhvQGDCytHq70x8JMmv0N2w4a5ounhQDQMrmA9Vt:KE4f8uQGeVlKW8JM60dXhQ7AGfZYrJLA
MD5:	D6BED333DC67104B89C65A300955224B
SHA1:	BE5831B89FC8DC23B68B773B74CE83284F15FC86
SHA-256:	371FC6E45569792C4CCF25F0461B33069E32A146D4BC983BA802BB9163448940
SHA-512:	0582E42636F5244FDA9E4314C8040BC15AEED652C1F8D22997620D854DE9B47323DB5D7A2F431BABBF1201DD7B86AEEBFF1275EC275D5B29D2D96181EA92CB57
Malicious:	false
Preview:	#line 1 "Image/ExifTool/ICC_Profile.pm".#------------------------------------------------------------------------------.# File: ICC_Profile.pm.#.# Description: Read ICC Profile meta information.#.# Revisions: 11/16/2004 - P. Harvey Created.#.# References: 1) http://www.color.org/icc_specs2.html (ICC.1:2003-09).# 2) http://www.color.org/icc_specs2.html (ICC.1:2001-04).# 3) http://developer.apple.com/documentation/GraphicsImaging/Reference/ColorSync_Manager/ColorSync_Manager.pdf.# 4) http://www.color.org/privatetag2007-01.pdf.# 5) http://www.color.org/icc_specs2.xalter (approved revisions, 2010-07-16).# 6) Eef Vreeland private communication.#.# Notes: The ICC profile information is different: the format of each.# tag is embedded in the information instead of in the directory.# structure. This makes things a bit more complex because I need.# an extra level o

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\ID3.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	53386
Entropy (8bit):	4.919637309911965
Encrypted:	false
SSDEEP:	1536:Q/UFOwwrUI/laN0dBDtyo111Xs0IxqJam:/OwwrUI/l9Dtyd0IMJam
MD5:	3F30ECEB888B312AD2473F0757BCF013
SHA1:	CEE49D9B93083CAE52847B19F4180088ACFB1251
SHA-256:	668C173CD5F21EB9929377018945081B680581ECBB6691D39053B593CFE3DB6B
SHA-512:	5B8F4CC80CF9BC7584144AFEECAFF27C0B1BDC9E1C26BBDDE14C376709EF84B0AD33BD0C45F763DE00F25148A54A434865B0D70842B13BCF7408476531885A00
Malicious:	false
Preview:	#line 1 "Image/ExifTool/ID3.pm".#------------------------------------------------------------------------------.# File: ID3.pm.#.# Description: Read ID3 meta information.#.# Revisions: 09/12/2005 - P. Harvey Created.#.# References: 1) http://www.id3.org/.# 2) http://www.mp3-tech.org/.# 3) http://www.fortunecity.com/underworld/sonic/3/id3tag.html.#------------------------------------------------------------------------------..package Image::ExifTool::ID3;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.50';..sub ProcessID3v2($$$);.sub ProcessPrivate($$$);.sub ProcessSynText($$$);.sub ConvertID3v1Text($$);.sub ConvertTimeStamp($);..# audio formats that we process after an ID3v2 header (in order).my @audioFormats = qw(APE MPC FLAC OGG MP3);..# audio formats where the processing proc is in a differently-named module.my %audioModule = (. MP3 => 'ID3',. OGG => 'Ogg',.);..# picture types for 'PIC' a

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\IPTC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	38562
Entropy (8bit):	4.7272792319789545
Encrypted:	false
SSDEEP:	768:+X7fQUlr0UtR+JxavH/kU0cGkGZDwXQiv5M610jsiCIQr:7Ujv/kU0zy5MiXIQr
MD5:	9A7866679481675A26146BE3E6340E74
SHA1:	BF3AB65BD62FC662586119BC8E1623792061895F
SHA-256:	F34F9A5D4BEFC5E7041F472E1E45CAC417969EBB57809BA9F0E56FB615FD5DB2
SHA-512:	43EDCCE4EF08BC0BDC8454931B333313C4C203A8F861785D64C8DE8313AB2B1388D0E403F0BBB53B918C8AB80D4DDA58C28128C0CB77092FD4F423E1192B0D6A
Malicious:	false
Preview:	#line 1 "Image/ExifTool/IPTC.pm".#------------------------------------------------------------------------------.# File: IPTC.pm.#.# Description: Read IPTC meta information.#.# Revisions: Jan. 08/2003 - P. Harvey Created.# Feb. 05/2004 - P. Harvey Added support for records other than 2.#.# References: 1) http://www.iptc.org/IIM/.#------------------------------------------------------------------------------..package Image::ExifTool::IPTC;..use strict;.use vars qw($VERSION $AUTOLOAD %iptcCharset);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.56';..%iptcCharset = (. "\x1b%G" => 'UTF8',. # don't translate these (at least until we handle ISO 2022 shift codes). # because the sets are only designated and not invoked. # "\x1b,A" => 'Latin', # G0 = ISO 8859-1 (similar to Latin1, but codes 0x80-0x9f are missing). # "\x1b-A" => 'Latin', # G1 ". # "\x1b.A" => 'Latin', # G2. # "\x1b/A" => 'Latin', # G3.);..sub ProcessIPTC($$$);.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\ISO.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6381
Entropy (8bit):	5.111483607045621
Encrypted:	false
SSDEEP:	96:eHtFV6+BVpHtI0J9V6M4WIbn1UqeD7oMNvDNMJUnTTEYOeqkHy8k4JkCXqNFBtfF:k5X7ZT5q2k4aHFPiSBPQY
MD5:	AD1544E7D196920FE944B4AABC8751FA
SHA1:	3D5D60D519B9A7D6488B56D9442ABFCE83684C4B
SHA-256:	2859A0C6EA72687A8BB29AB9527C99EC49C2C5B4DCCBA052B9EE04A0255B1162
SHA-512:	ABB78EF1450CDADCD989053AEA85B08761B96583CA77015688827D67DB0A8C979D0EEA5AEAC658E21F9998F42A22CD6819C76362B37B581594D3C862CD185155
Malicious:	false
Preview:	#line 1 "Image/ExifTool/ISO.pm".#------------------------------------------------------------------------------.# File: ISO.pm.#.# Description: Read information from ISO 9660 disk images.#.# Revisions: 2016-04-07 - P. Harvey created.#.# References: 1) http://wiki.osdev.org/ISO_9660.#------------------------------------------------------------------------------..package Image::ExifTool::ISO;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.01';..# trim trailing spaces and ignore tag if empty.my %rawStr = (. RawConv => sub {. my $val = shift;. $val =~ s/ +$//;. return length($val) ? $val : undef;. },.);..# tag info for date/time tags.my %dateInfo = (. Format => 'undef[17]',. Groups => { 2 => 'Time' },. ValueConv => q{. return undef if $val !~ /[^0\0 ]/; # ignore if empty. if ($val =~ s/(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(.)/$1:$2:$3 $4:$5:$6.$7/s) {. $val

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\ITC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6066
Entropy (8bit):	4.674266243422436
Encrypted:	false
SSDEEP:	96:x9mfV6n4QRjjCXvSLBYRKQRYHXiKBzMfBKvnBvk9B+dOexpEMolsIi3H:csrLOPRaRNMfSnZskdO4qM5Ii3H
MD5:	A22E1A7B3E8B51CC628CBA270DC6F4D3
SHA1:	8E568E65B505907E870F020A10A362DD0DAB3C50
SHA-256:	776B89E55A635CF8F4CF8E949FA7F486CD502CB1C2C092294CD3ACDC9C3B79B1
SHA-512:	D2CE69444DC7FD0A6D0C97138F41AA290580B1EF62B8B85607B9E779E58BE6676FAF2314558CA8A7C5856C09155FBB9AEEE5D5638B14676ED8DF1D05C6B0BDDF
Malicious:	false
Preview:	#line 1 "Image/ExifTool/ITC.pm".#------------------------------------------------------------------------------.# File: ITC.pm.#.# Description: Read iTunes Cover Flow meta information.#.# Revisions: 01/12/2008 - P. Harvey Created.#.# References: 1) http://www.waldoland.com/dev/Articles/ITCFileFormat.aspx.# 2) http://www.falsecognate.org/2007/01/deciphering_the_itunes_itc_fil/.#------------------------------------------------------------------------------..package Image::ExifTool::ITC;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..sub ProcessITC($$);..# tags used in ITC files.%Image::ExifTool::ITC::Main = (. NOTES => 'This information is found in iTunes Cover Flow data files.',. itch => { SubDirectory => { TagTable => 'Image::ExifTool::ITC::Header' } },. item => { SubDirectory => { TagTable => 'Image::ExifTool::ITC::Item' } },. data => {. Name => 'ImageData',. Notes => 'embedded

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Import.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11445
Entropy (8bit):	4.552250941844173
Encrypted:	false
SSDEEP:	192:6oh13+oJXSzCbJ7gHD3isNoq4JhKKMM9hsfA4rKCP5yV4fLKqLexQ3wwwRJOT2LE:6ohUcLTpsJmquE
MD5:	76C13F4141753975D693EC25E69FE370
SHA1:	4288EF5B124F955C6459BC5F78A13CD801166B88
SHA-256:	6502704BC4BD63EAD5B0B663DEFF2EE1E50D18569865E3B6BB5465985DB894CB
SHA-512:	986B001F4BF9369E4B1E3F9E523B95213FF0A881FD37214871FFA9DD7A7C05273BE842BD9C25BFAC896A4A156FC9B55BD76C7448AEC7E68AB11E9EC7F73773EA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Import.pm".#------------------------------------------------------------------------------.# File: Import.pm.#.# Description: Import CSV and JSON database files.#.# Revisions: 2011-03-05 - P. Harvey Created.#------------------------------------------------------------------------------.package Image::ExifTool::Import;..use strict;.require Exporter;..use vars qw($VERSION @ISA @EXPORT_OK);..$VERSION = '1.09';.@ISA = qw(Exporter);.@EXPORT_OK = qw(ReadCSV ReadJSON);..sub ReadJSONObject($;$);..my %unescapeJSON = ( 't'=>"\t", 'n'=>"\n", 'r'=>"\r" );.my $charset;..#------------------------------------------------------------------------------.# Read CSV file.# Inputs: 0) CSV file name, file ref or RAF ref, 1) database hash ref, 2) missing tag value.# Returns: undef on success, or error string.# Notes: There are various flavours of CSV, but here we assume that only.# double quotes are escaped, and they are escaped by doubling them.sub ReadCSV($$;$).{.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\InDesign.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9719
Entropy (8bit):	4.58549212500419
Encrypted:	false
SSDEEP:	192:pHL6S24S7M2aCUnVW5rx0wzr9yx7hlNmZjSvnC6SFUgiUC/7S+j3S3iRwMQWa:Z5sx3Il2UgiM
MD5:	B2AA07AC65B086F6176387C7DE048ADE
SHA1:	99C05D9C2679FB4BDE79C57E969BF80D3C4F4FA3
SHA-256:	56A9F0923C567BDB8D39B045D02B7B5453F3B26F8C3A2878DC203444C4375C53
SHA-512:	1A4EA494FF84C4FFF3C9EE8C412DA4083D2E29C1670BAEE9BBEBB7492BEECFC0343A98FFB0B4C5B8189E716FBEB86613776C9D1C238D9F1507A7D5ADF82745D2
Malicious:	false
Preview:	#line 1 "Image/ExifTool/InDesign.pm".#------------------------------------------------------------------------------.# File: InDesign.pm.#.# Description: Read/write meta information in Adobe InDesign files.#.# Revisions: 2009-06-17 - P. Harvey Created.#.# References: 1) http://www.adobe.com/devnet/xmp/pdfs/XMPSpecificationPart3.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::InDesign;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.06';..# map for writing metadata to InDesign files (currently only write XMP).my %indMap = (. XMP => 'IND',.);..# GUID's used in InDesign files.my $masterPageGUID = "\x06\x06\xed\xf5\xd8\x1d\x46\xe5\xbd\x31\xef\xe7\xfe\x74\xb7\x1d";.my $objectHeaderGUID = "\xde\x39\x39\x79\x51\x88\x4b\x6c\x8E\x63\xee\xf8\xae\xe0\xdd\x38";.my $objectTrailerGUID = "\xfd\xce\xdb\x70\xf7\x86\x4b\x4f\xa4\xd3\xc7\x28\xb3\x41\x71\x06";..#----------------

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\JPEG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	19700
Entropy (8bit):	4.995776274833284
Encrypted:	false
SSDEEP:	384:D8+QC9ZNSW8r3f+6AUMfc1sBWgQs9Tcke:DEsBX9Tcke
MD5:	5871A064AAE6D550140BC7BA3330B16E
SHA1:	20CF7C964B277265CFFB83882B8BD8E38222B78A
SHA-256:	CE265EA04B802D28201FD90BD79AFBEFEDABF7D6CF33AC398002C46A31321945
SHA-512:	A10E97535887B9502358E02F06F8F8F1EDA6AB5BCDE6CFF8010EEBAAD40C62503D38EF60369AC53E63FD170224792DEAFE26EEBFB373696EFFDAC67A80FB158C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/JPEG.pm".#------------------------------------------------------------------------------.# File: JPEG.pm.#.# Description: Definitions for uncommon JPEG segments.#.# Revisions: 10/06/2006 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::JPEG;.use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.25';..sub ProcessOcad($$$);.sub ProcessJPEG_HDR($$$);..# (this main JPEG table is for documentation purposes only).%Image::ExifTool::JPEG::Main = (. NOTES => 'This table lists information extracted by ExifTool from JPEG images.',. APP0 => [{. Name => 'JFIF',. Condition => '$$valPt =~ /^JFIF\0/',. SubDirectory => { TagTable => 'Image::ExifTool::JFIF::Main' },. }, {. Name => 'JFXX',. Condition => '$$valPt =~ /^JFXX\0\x10/',. SubDirectory => { TagTable => 'Image::ExifTool::JFIF::Extension' },.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\JPEGDigest.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	216628
Entropy (8bit):	5.192380510671391
Encrypted:	false
SSDEEP:	3072:lurMRriSh7/fbnj1KpyRIYT11SywtVQk2P4j937:krMR2Sh7/Dnj1Kp2IYT11SHVQk2iL
MD5:	8BD6F0D2BC360F50C01EE257046AB617
SHA1:	26C92F0F77A8D8647AF8B1B5C6CC04FBFDB1A0A4
SHA-256:	D1D08539B1C7BE108F9E78E390FB0DF6B6EDB4E9AEB879CDB3D1A90AEFE702E0
SHA-512:	E7B7B05AA62C7E361346F40B950FD3E06D84C950C4F86BDF2BFA85D4E334CD8F9D423EED588E366D69A7C5C671024C80543CB5D06FD4F3E2570DAD427FA44208
Malicious:	false
Preview:	#line 1 "Image/ExifTool/JPEGDigest.pm".#------------------------------------------------------------------------------.# File: JPEGDigest.pm.#.# Description: Calculate JPEGDigest and JPEGQualityEstimate.#.# Revisions: 2008/09/15 - P. Harvey Created.# 2016/01/05 - PH Added calculation of JPEGQualityEstimate.#.# References: JD) Jens Duttke.# 2) Franz Buchinger private communication.# 3) https://github.com/ImageMagick/ImageMagick/blob/master/coders/jpeg.c.#------------------------------------------------------------------------------..package Image::ExifTool::JPEGDigest;.use strict;.use vars qw($VERSION);..$VERSION = '1.06';..# the print conversion for the JPEGDigest tag.my %PrintConv = ( #JD. # No DQT defined. 'd41d8cd98f00b204e9800998ecf8427e' => 'No DQT defined',.. # Tested with:. # - Independent JPEG Group library (used by many applications) X3 (Win). # - Different subsamplings possible. # - Dynamic Photo HDR

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\JSON.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	4.892840765295853
Encrypted:	false
SSDEEP:	96:ioEVEyRuMa4tPcPlpa+ZWTgbEu4HfPrXV4hj8Pdy6hiQWr:iFfw4KIjUbL4HfPqjIdy8iQWr
MD5:	DEC354DED0DB2BFF381E165C0F4A5F0C
SHA1:	46F780CE933EA926C3B3DA55064330F380728D0B
SHA-256:	F2E46005C60A6D6A49122953E30B4A33DA27A8183CC77AB4020496E97F56332C
SHA-512:	D2BECEAA1A526547DB1B1750E1EBB04D4BDCF40250E9E527279F497BFE710B3014E85E4B899AB28C4EE630483B846EC0B4BDA87B1B85E58B3F038A56218CA5BE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/JSON.pm".#------------------------------------------------------------------------------.# File: JSON.pm.#.# Description: Read JSON files.#.# Notes: Set ExifTool MissingTagValue to "null" to ignore JSON nulls.#.# Revisions: 2017/03/13 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::JSON;.use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Import;..$VERSION = '1.01';..sub ProcessTag($$$$%);..%Image::ExifTool::JSON::Main = (. GROUPS => { 0 => 'JSON', 1 => 'JSON', 2 => 'Other' },. NOTES => q{. No JSON tags have been pre-defined, but ExifTool will read any existing. tags from basic JSON-formatted files.. },.);..#------------------------------------------------------------------------------.# Store a tag value.# Inputs: 0) ExifTool ref, 1) tag table, 2) tag ID, 3) value, 4) tagInfo flags.sub FoundTag($

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\JVC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3157
Entropy (8bit):	4.9746100686826695
Encrypted:	false
SSDEEP:	96:xQSsVbtsaMkJfGV9soJ0CEqEQh97CtfQWt:xO3s1k9uJu/Qh97CtfQWt
MD5:	92819138F9C6C4FAB5CE02D3FBCF4C8C
SHA1:	ED8B9978C7E43C43FF223FDC0DDA55D12029BADB
SHA-256:	40C0F48E45558BCE9ED94FA9D73FA5E668364428E21E5B91DE91A1E73DC1DAD5
SHA-512:	0248B0F60E21DBE68113EE3CD18995C862486FE457F4FC3E2EE907B3CD0E95FBC8FA6C2DD992FFE2751759FF46A0026B689C82326F5C696D46EA0D31B3903F09
Malicious:	false
Preview:	#line 1 "Image/ExifTool/JVC.pm".#------------------------------------------------------------------------------.# File: JVC.pm.#.# Description: JVC EXIF maker notes tags.#.# Revisions: 12/21/2005 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::JVC;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.03';..sub ProcessJVCText($$$);..# JVC EXIF-based maker notes.%Image::ExifTool::JVC::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. NOTES => 'JVC EXIF maker note tags.',. #0x0001 - almost always '2', but '3' for GR-DV700 samples. 0x0002 => { #PH. Name => 'CPUVersions',. # remove trailing nulls/spaces and split at remaining nulls/spaces. ValueConv => '$_=$val; s/(\s\0)+$//; s/(\s\0)

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Jpeg2000.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	31403
Entropy (8bit):	4.715553937034084
Encrypted:	false
SSDEEP:	768:2AbfysAxuHi/MQC36zs3mKFDDyV1n1KTVq6SG:2HsAvs3TFoPHG
MD5:	D75746BFDA3953463DDA9C6DB16C5AA4
SHA1:	8FB8E4D5652E824F311E165779D4863444F24869
SHA-256:	23463669921AC594100FEEBE0AF67E672FACB2531726F542F12DECBBBE81D7AC
SHA-512:	C989D66942AEFF1D4AB017932BFF6EEF524DC08DA87207AE2CB0B46D8EFB6DC7A5F68C7AFCD6544EC2272667F9403C1A6171BB118F5C537644626CF4BE0EF199
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Jpeg2000.pm".#------------------------------------------------------------------------------.# File: Jpeg2000.pm.#.# Description: Read JPEG 2000 meta information.#.# Revisions: 02/11/2005 - P. Harvey Created.# 06/22/2007 - PH Added write support (EXIF, IPTC and XMP only).#.# References: 1) http://www.jpeg.org/public/fcd15444-2.pdf.# 2) ftp://ftp.remotesensing.org/jpeg2000/fcd15444-1.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Jpeg2000;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.26';..sub ProcessJpeg2000Box($$$);..my %resolutionUnit = (. -3 => 'km',. -2 => '100 m',. -1 => '10 m',. 0 => 'm',. 1 => '10 cm',. 2 => 'cm',. 3 => 'mm',. 4 => '0.1 mm',. 5 => '0.01 mm',. 6 => 'um',.);..# map of where information is written in JPEG2000 image.my %jp2Map = (. IPTC => 'UU

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Kodak.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	69491
Entropy (8bit):	4.952632297392909
Encrypted:	false
SSDEEP:	384:0u4YndbD/VIl+NUX94rwLi8f0PfmouUS0e/OR87/cAko4LSKSE0wVtmHauZWoQvr:14YNDdePi8+m7TkocbD8Y
MD5:	FDB62E3704B6148BCCC09A38105AE714
SHA1:	35F366D7B4D92CBB889BCB4060F374CA20B118E3
SHA-256:	5EF92611C7368034B0753655BFF0D528F1A80780FC513B1656C0F7EB8D4B5285
SHA-512:	6A9B1629E272B6F8E908D8FF5DA8F8FF86F02728B6B81FC8BD36D05A1727DF7A2D26DA5EADD900425058860BE78BD32F7FA9B3F03D657E3187A3FDB2E2C51B20
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Kodak.pm".#------------------------------------------------------------------------------.# File: Kodak.pm.#.# Description: Kodak EXIF maker notes and APP3 "Meta" tags.#.# Revisions: 03/28/2005 - P. Harvey Created.#.# References: 1) http://search.cpan.org/dist/Image-MetaData-JPEG/.# 2) http://www.ozhiker.com/electronics/pjmt/jpeg_info/meta.html.# 3) http://www.cybercom.net/~dcoffin/dcraw/.# IB) Iliah Borg private communication (LibRaw).#.# Notes: There really isn't much public information about Kodak formats..# The only source I could find was Image::MetaData::JPEG, which.# didn't provide information about decoding the tag values. So.# this module represents a lot of work downloading sample images.# (about 100MB worth!), and testing with my daughter's CX4200..#------------------------------------------------------------------------------..pack

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\KyoceraRaw.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	4.895430038421077
Encrypted:	false
SSDEEP:	48:aUkZfDWDr56U3VY2wOMoG3R4wj7Dh07Nb2TNbL2ZNbM/NbCJcdCJcv2VhC6QRX13:YfDWDV6v2Y943hlHKX/BzZFFeoW2
MD5:	82FA0927585665EE26E3B52BDD128D1D
SHA1:	CD36D7074B73D71BA73A2F98B67FA5B3D5A9439B
SHA-256:	1717D6E95C06EB827D92AB12BE5901335BADF1380B6D9A8429B9875162541153
SHA-512:	832E2548059C0DD6021A6CF9A65F28D4FA877BD1C1CBE9C05DE41972D7BEC9A232E5DB71C11556ED6078CFAC99DC59485B7F2489BF6C80DE3440AC7E7CE6F738
Malicious:	false
Preview:	#line 1 "Image/ExifTool/KyoceraRaw.pm".#------------------------------------------------------------------------------.# File: KyoceraRaw.pm.#.# Description: Read Kyocera RAW meta information.#.# Revisions: 02/17/2006 - P. Harvey Created.#.# References: 1) http://www.cybercom.net/~dcoffin/dcraw/.#------------------------------------------------------------------------------..package Image::ExifTool::KyoceraRaw;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.03';..sub ProcessRAW($$);..# utility to reverse order of characters in a string.sub ReverseString($) { pack('C',reverse unpack('C',shift)) }..# Contax N Digital tags (ref PH).%Image::ExifTool::KyoceraRaw::Main = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. NOTES => 'Tags for Kyocera Contax N Digital RAW images.',. 0x01 => {. Name => 'FirmwareVersion',. Format => 'string[10]',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\LNK.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21828
Entropy (8bit):	4.744903532233959
Encrypted:	false
SSDEEP:	384:N8cmysSEbCyMnh/ujiz5W8wJW5pKl6y8nQbS6l:N8XSEbjMneW5W8gCIlv8C9l
MD5:	393FA52472D5F4D3D8569FD932DE29FF
SHA1:	970EFA703CA9C89B212D281B0578C0419EA62E08
SHA-256:	F474DAFFCCD5F2AC93FE266B9FF31ED0E337BC9D92A4BB106EDAC7246FB34FB6
SHA-512:	E63432BFE3BC15DA756718944A8229B5019848F2F813212140BAD056052F3AD7540870A3F31249454B5E275B68D135B25257C59B26B3AE7B85B9391640B321AA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/LNK.pm".#------------------------------------------------------------------------------.# File: LNK.pm.#.# Description: Read meta information from MS Shell Link files.#.# Revisions: 2009/09/19 - P. Harvey Created.#.# References: 1) http://msdn.microsoft.com/en-us/library/dd871305(PROT.10).aspx.# 2) http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::LNK;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.07';..sub ProcessItemID($$$);.sub ProcessLinkInfo($$$);..# Information extracted from LNK (Windows Shortcut) files.%Image::ExifTool::LNK::Main = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. GROUPS => { 2 => 'Other' },. VARS => { HEX_ID => 1 }, # print hex ID's in documentation. NOTES => 'Information extracted from MS Shell Link (Windows shortcut

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\CVS\Entries

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.45004108002896
Encrypted:	false
SSDEEP:	12:8Mah3PUTahnU7MahFtahgoahgahrnah/V3itah4ahqfMahglahiZahb1ahwahgd9:w/UknU7dFOgx58/UOBqlrBaJVQ
MD5:	679164E03116CD517B3ED5CDA7E245D0
SHA1:	9A576029B6D540C23F9E41D49FCEC2DCA341BC96
SHA-256:	094B2182BB97D3ECF147C017A846A51A4C0F3C5C8E12234C4274711B28545113
SHA-512:	DBF536FC281A80BB91E297188FD8182BC391C937D2ECD0A7D756F805B37BEB2E435B5E9189B3074C3D61BB7F1E3E020DE4123A0051B35B91445131E211A14D64
Malicious:	false
Preview:	/cs.pm/1.37/Tue Jan 2 16:24:28 2018//./de.pm/1.148/Tue Jan 2 16:24:28 2018//./en_ca.pm/1.49/Tue Jan 2 16:24:28 2018//./en_gb.pm/1.42/Tue Jan 2 16:24:28 2018//./fi.pm/1.17/Tue Jan 2 16:24:28 2018//./it.pm/1.78/Tue Jan 2 16:24:28 2018//./ja.pm/1.84/Tue Jan 2 16:24:28 2018//./ko.pm/1.42/Tue Jan 2 16:24:28 2018//./nl.pm/1.75/Tue Jan 2 16:24:28 2018//./pl.pm/1.45/Tue Jan 2 16:24:28 2018//./ru.pm/1.29/Tue Jan 2 16:24:28 2018//./sv.pm/1.30/Tue Jan 2 16:24:28 2018//./tr.pm/1.25/Tue Jan 2 16:24:29 2018//./zh_cn.pm/1.29/Tue Jan 2 16:24:29 2018//./zh_tw.pm/1.32/Tue Jan 2 16:24:29 2018//./es.pm/1.65/Fri May 4 15:21:55 2018//./fr.pm/1.116/Fri May 4 15:21:55 2018//.D.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\CVS\Repository

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.9701755214643457
Encrypted:	false
SSDEEP:	3:E3Lya5n:E3Lygn
MD5:	61EC6ECE77060F263E696EB14FBD0817
SHA1:	9BFC1CEF99D1D8F148DC78D1CEE61A8DB87EEE05
SHA-256:	C7BC2E05EA87598D15B1EDD259AD3B2606E6B5377FE8DED89D7B2FD5CDD21BC8
SHA-512:	EA9817EE2F149663B4F9D7F9DA9FBA6D1A74AC3AC5131D962F1774D286562EA6CA9E8E2CCA97A651B084F327F8EED9A523A1120C47BB27778D759DDBB1D7FB07
Malicious:	false
Preview:	lib/Image/ExifTool/Lang.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\CVS\Root

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.542682803033967
Encrypted:	false
SSDEEP:	3:ARfVN5SLFViBKVW/AODRKmn:A5nWqBBAsRKmn
MD5:	40B9335FD2F3C1F68FD22B7364EA1D8B
SHA1:	E79514C2E349DFACEE74A8470848ADA647AA0E4B
SHA-256:	3641791FE2F62C505B05DA9CE982EBB341139C18B2C92C19A02A99BABB2F39D3
SHA-512:	A2A9A8EAF44765B255B9B71EB96EC89D13929D256D204FA5E862CA6EE112828D4967FF8B85326AB68F45C2DBAE7AF142632B73B94AD4C5E488210D1C3D5EBAE3
Malicious:	false
Preview:	:ext:phil@130.15.24.88:/Users/phil/cvs/exiftool2.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\cs.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	46189
Entropy (8bit):	4.77059867678018
Encrypted:	false
SSDEEP:	768:56Uv8yByk6z6KvZKjzcecXOLi8/PARAtMJA:4UvdByFvYjzeO3/4G
MD5:	6DACDAE1D7E7D47F267E888C3A49DDF5
SHA1:	C2344D2DE6F723B4F07C6A217F1428FB825F4F58
SHA-256:	49B5B056CB352F62EDE163137588A4E4B0022629F620CF08690F9675DD53CF13
SHA-512:	109A257BC693AD1C767AA4A5A5BD69A3D12DD4D0CDA42ABB002693730B9E00A85A3F398C0AC47C6D91824A7DFC8063543367F4C424F833603521C9C885AA6D34
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/cs.pm".#------------------------------------------------------------------------------.# File: cs.pm.#.# Description: ExifTool Czech language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::cs;..use strict;.use vars qw($VERSION);..$VERSION = '1.07';..%Image::ExifTool::Lang::cs::Translate = (. 'AEMeteringMode' => {. PrintConv => {. 'Multi-segment' => 'Multi segment',. },. },. 'AEProgramMode' => {. PrintConv => {. 'Landscape' => 'Krajina',. 'Macro' => 'Makro',. 'Portrait' => 'Portr.t',. },. },. 'AFPoint' => {. PrintConv => {. 'None' => '..dn.',. },. },. 'AFPointBrightness' => {. PrintConv => {. 'Normal' => 'Norm.ln.',. },. },. 'AFPointSelectionMethod' => {. PrintConv => {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\de.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	298893
Entropy (8bit):	4.759643432938898
Encrypted:	false
SSDEEP:	1536:gLIJhUn4EsDJPhUn4Es4JPVm0n4Es4JP0VM4Df4sg4bSJWvkK4p4I4KRNo6Eeykq:gTpDxCcEs1ebIxtUjp
MD5:	A4B58BFCA32F3802D12D12D5DF50DDC4
SHA1:	FD60BA4D7D3857E7F7D3D522369C42E402B076F7
SHA-256:	2E03015D1BCB369987E49DC508AC3D3AEFBEC48418543E12C83A3A4564174833
SHA-512:	AD9F2C07FA7A86F808B54ADAB56E4301916B5C5711EA24C414480821AED6CB0A7E710283E7064124A4921FBBE731F2A3C60D663594DA0181736AFD034560147F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/de.pm".#------------------------------------------------------------------------------.# File: de.pm.#.# Description: ExifTool German language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::de;..use strict;.use vars qw($VERSION);..$VERSION = '1.33';..%Image::ExifTool::Lang::de::Translate = (. 'AEAperture' => 'AE-Blende',. 'AEBAutoCancel' => {. Description => 'Automatisches Bracketingende',. PrintConv => {. 'Off' => 'Aus',. 'On' => 'Ein',. },. },. 'AEBBracketValue' => 'AEB-Korrekturwert',. 'AEBSequence' => 'Bracketing-Sequenz',. 'AEBSequenceAutoCancel' => {. Description => 'WB-Sequenz/autom. Abschaltung',. PrintConv => {. '-,0,+/Disabled' => '-,0,+/Aus',. '-,0,+/Enabled' => '-,0,+/Ein',. '0,-,+/Disabled' => '0,-,+/Aus',

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\en_ca.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	38062
Entropy (8bit):	4.606367575519943
Encrypted:	false
SSDEEP:	384:pg6XIiTHutU8/VylC417qB0tHM+Nouyhy:pDHh1uB01No8
MD5:	641077DF5B79D1AB09D4397CCAA1A50A
SHA1:	4C1111123FFB790DE0ADDC599D8AB5C0A8D43780
SHA-256:	FA6B2F6ED772612F229BF53554A39FADD02513760E89B36F627D2984322BC1FA
SHA-512:	D49D0375515FF1F17B0B4567F24F407B018627C853CC11C26F22A7888334AF33BB623DC0E02C3E8EC6105C74D9D343107D05D7501C094C945440A63EA0637C64
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/en_ca.pm".#------------------------------------------------------------------------------.# File: en_ca.pm.#.# Description: ExifTool Canadian English language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::en_ca;..use strict;.use vars qw($VERSION);..$VERSION = '1.12';..%Image::ExifTool::Lang::en_ca::Translate = (. 'AboveColor' => 'Above Colour',. 'AdvancedFilter' => {. PrintConv => {. 'Partial Color Blue' => 'Partial Colour Blue',. 'Partial Color Green' => 'Partial Colour Green',. 'Partial Color Orange' => 'Partial Colour Orange',. 'Partial Color Purple' => 'Partial Colour Purple',. 'Partial Color Red' => 'Partial Colour Red',. 'Partial Color Yellow' => 'Partial Colour Yellow',. 'Pop Color' => 'Pop Colour',. },. },. 'Advanc

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\en_gb.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	39980
Entropy (8bit):	4.636384148028681
Encrypted:	false
SSDEEP:	384:sgqXIiTHutU8/VylC4LWu3IqBGLHM+twAynJ:szHhimBGHtwf
MD5:	E6D5275FBB83624932D11DDC3793CA64
SHA1:	DEAD27CF98124A78656862748917703B8CA40D16
SHA-256:	9CA7DFD73EAA4F4AF6B610E4F49FED1DDFE884070855828003E6BBBA13393894
SHA-512:	268B90E329373C1AC94E866D62964197739B3DCEDFC1815A304EB67E5A40C03F42F7C5D28E17D6C7FB758BF4797E352B6DA9B0A7D72BB91DFC995585889C5DEA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/en_gb.pm".#------------------------------------------------------------------------------.# File: en_gb.pm.#.# Description: ExifTool British English language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::en_gb;..use strict;.use vars qw($VERSION);..$VERSION = '1.13';..%Image::ExifTool::Lang::en_gb::Translate = (. 'AboveColor' => 'Above Colour',. 'AdvancedFilter' => {. PrintConv => {. 'Partial Color Blue' => 'Partial Colour Blue',. 'Partial Color Green' => 'Partial Colour Green',. 'Partial Color Orange' => 'Partial Colour Orange',. 'Partial Color Purple' => 'Partial Colour Purple',. 'Partial Color Red' => 'Partial Colour Red',. 'Partial Color Yellow' => 'Partial Colour Yellow',. 'Pop Color' => 'Pop Colour',. },. },. 'Advance

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\es.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	122326
Entropy (8bit):	4.615581974096677
Encrypted:	false
SSDEEP:	1536:EbNhi1wGqHGHfCpUx5i7VpSwaivs5AQNL7dFwHlt9l5Nbkc6JQ8biFGP:Wih1CpUTi7VpSwaivs5AaWlbkc6GWP
MD5:	5B57AC3464FD65B31349D71BC5795E06
SHA1:	37A6DE2289FBBFCED918F2CCFF3F9A985DC3F214
SHA-256:	443AE253AF6DEC0440C1ECA487E43E37199E9AECE0AAD23168BFEC13EA2F4F27
SHA-512:	82D6A96DD59445B0D7968C91CE4B6FD6E583488898C4260A122C1333FDCD894F9D93DAF03FC2CCB3B44FC81F36D32ED9D3A30538DF9C7B11EF58F7599BC90B51
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/es.pm".#------------------------------------------------------------------------------.# File: es.pm.#.# Description: ExifTool Spanish language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::es;..use strict;.use vars qw($VERSION);..$VERSION = '1.15';..%Image::ExifTool::Lang::es::Translate = (. 'AEAperture' => 'Aperture AE',. 'AELock' => 'Bloqueo AE',. 'AELockButton' => {. Description => 'Bot.n Bloqueo AE',. PrintConv => {. 'None' => 'Ninguno',. },. },. 'AELockButtonPlusDials' => {. PrintConv => {. 'None' => 'Ninguno',. },. },. 'AEMaxAperture2' => 'Apertura m.xima AE 2',. 'AEMinAperture' => 'Apertura m.nima AE',. 'AEProgramMode' => {. PrintConv => {. 'Landscape' => 'Paisaje',. 'Portrait' => 'Retrato',. 'S

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\fi.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	110176
Entropy (8bit):	4.822078995873278
Encrypted:	false
SSDEEP:	1536:wTqu78E3ud3/ilNS73jMxBAkUuwtX9D67hz+SW:yf3uQs3jMY5Xohz+t
MD5:	C7E584F41B7BCD22246DBC360EE69768
SHA1:	7B3A9C494CB72A5783C4FAA2CE80D9230621EE3F
SHA-256:	1C01B80958252C82B8F3D30373524471D751AB875801CC1CBB3CD522BD733D4A
SHA-512:	6EB9570CD81276CA854C8808111C60465499B8BA0EF3F69AD0C656F28280CEF50B897019666D6556AECDF2105189F96CDAB0D43A03B034C51A66C27538191562
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/fi.pm".#------------------------------------------------------------------------------.# File: fi.pm.#.# Description: ExifTool Finnish language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::fi;..use strict;.use vars qw($VERSION);..$VERSION = '1.02';..%Image::ExifTool::Lang::fi::Translate = (. 'AEAperture' => 'AE-aukko',. 'AEBBracketValue' => 'AEB-haarukointiarvo',. 'AEBXv' => 'AEB-valotuksen korjaus',. 'AEExposureTime' => 'AE-valotusaika',. 'AEInfo' => 'Automaattivalotustiedot',. 'AELock' => {. Description => 'AE-lukitus',. PrintConv => {. 'Off' => 'Pois',. 'On' => 'P..ll.',. },. },. 'AELockButton' => 'AE-lukituspainike',. 'AEMeteringMode' => 'AE-valotuksen mittaustapa',. 'AEMeteringSegments' => 'AE-mittaussegmentit',. 'AEProgramMode'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\fr.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	162060
Entropy (8bit):	4.679721619860858
Encrypted:	false
SSDEEP:	1536:4rK9LtSCiVUlj7GZtScBnTYwT9gEHBHg6WUXM2nFlZMtv+9u6DcJKSJ2wCQGTB3b:47TYwT9gE6iLp7AaHhXKENSXY
MD5:	0B1DDA90DF58CDAE8DF9A752FF6CD248
SHA1:	4A8A756A3847E5DD68A7F8DE06DD23330E6F6BE4
SHA-256:	7B37880196C83F6D3B7268AE0E0F98EF7A81909A41F7730185009C148177CBD7
SHA-512:	CA83124229B210BF0D33D3CBA44CFCAC36A41241ED92516BD871911B3FA5ACCB5705C6AA98C572F6F86AC671C7C75B3A5ADD687AE634283712398923E32C62EF
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/fr.pm".#------------------------------------------------------------------------------.# File: fr.pm.#.# Description: ExifTool French language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::fr;..use strict;.use vars qw($VERSION);..$VERSION = '1.32';..%Image::ExifTool::Lang::fr::Translate = (. 'AEAperture' => 'Ouverture AE',. 'AEBAutoCancel' => {. Description => 'Annulation bracketing auto',. PrintConv => {. 'Off' => 'Arr.t',. 'On' => 'Marche',. },. },. 'AEBSequence' => 'S.quence de bracketing',. 'AEBSequenceAutoCancel' => {. Description => 'S.quence auto AEB/annuler',. PrintConv => {. '-,0,+/Disabled' => '-,0,+/D.sactiv.',. '-,0,+/Enabled' => '-,0,+/Activ.',. '0,-,+/Disabled' => '0,-,+/D.sactiv.',. '0,-,+/

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\it.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	250104
Entropy (8bit):	4.690998183535554
Encrypted:	false
SSDEEP:	1536:/VoHVhVyOadLmaYZavcoVqAiZ2ntyoz198zQZJ8krl3G0DqVob3WXjDu2v0DiX:1dLIoVqRZ2ntB198Ml3GwNbmfu2v0DiX
MD5:	8A30B5E104EB1D6B6CC640E92DE6B48C
SHA1:	8D41F9E4A4205D922395AB370C884AF6C5D764F5
SHA-256:	C6EFCB45FA8BB8FE27F42AA2FF5DCBBEB4277985FF2DA3D8887E3F028A3CD209
SHA-512:	C9015BA0EA6DA74C1ED73E8497890DCC0E3FC416668EE556FE8E85B5E11D24747A47C66BD64A51FBC04E5D23366605CE565F3B37DA45480494305B9ECC79DC80
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/it.pm".#------------------------------------------------------------------------------.# File: it.pm.#.# Description: ExifTool Italian language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::it;..use strict;.use vars qw($VERSION);..$VERSION = '1.13';..%Image::ExifTool::Lang::it::Translate = (. 'A100DataOffset' => 'Offset dati A100',. 'AAFManufacturerID' => 'ID AAF produttore',. 'ACoordOfBottomRightCorner' => 'Una coord in basso a destra',. 'ACoordOfTopRightCorner' => 'Una coord in alto a destra',. 'AEAperture' => 'Apertura esposizione automatica',. 'AEBAutoCancel' => {. PrintConv => {. 'Off' => 'Spento',. },. },. 'AEBSequenceAutoCancel' => {. PrintConv => {. '-,0,+/Disabled' => '-,0,+/Disabilitato',. '-,0,+/Enabled' => '-,0,+/Abilitato',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\ja.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	208714
Entropy (8bit):	5.3480395192643915
Encrypted:	false
SSDEEP:	1536:QwHKsRZ1LAKk3Bu57Jx/wF1L4YXSrzkoT8:QRu5JZ41L4YXSrM
MD5:	E0E2F15E1D9367430143EAD52228EE2B
SHA1:	5EC85FB8DDBA069A9070A15A83947332B9334104
SHA-256:	D1CF1B050AB62DC1FC27A7584D2C0F1E4E2C708BCDB0A7D2E246B237E2EFE8F3
SHA-512:	D6FFBD2AA9F39255233A9FCFF473963E92BB4716C377410F8EA546A97CDF1B1131B680D7F8DA909C54F351EDAA8F0E19EDC3A4E0ACF3A1E6FD71144CA25464EB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/ja.pm".#------------------------------------------------------------------------------.# File: ja.pm.#.# Description: ExifTool Japanese language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::ja;..use strict;.use vars qw($VERSION);..$VERSION = '1.23';..%Image::ExifTool::Lang::ja::Translate = (. 'AEAperture' => 'AE..',. 'AEBAutoCancel' => {. Description => '...........',. PrintConv => {. 'Off' => '..',. 'On' => '..',. },. },. 'AEBBracketValue' => 'AEB......',. 'AEBSequence' => '.........',. 'AEBSequenceAutoCancel' => {. Description => '........./....',. PrintConv => {. '-,0,+/Disabled' => '..0 ../...',. '-,0,+/Enabled' => '.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\ko.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	67503
Entropy (8bit):	5.146910069843386
Encrypted:	false
SSDEEP:	768:4ft0toAtHheni/l8ofuIaKM2W7MtPBKuDEct:Wt0tptBei/lE1Ct3
MD5:	D89E0E9E559B9220D3D546D0FD386432
SHA1:	75FBC775E34AB910E7CCFE42FB05A01DC7C9038C
SHA-256:	97E8C0BA96DAA42737EB0A822E035D175138109D875166AF4868C7670402BF65
SHA-512:	FAD8FE1D13CD7D3262B3E0ADD334A79BF522B8A6F7FAD1AAE19BC83BA0B8CD93C637D6B4AE3CA70A34B6FC63CACC3D4B975EE76D7BC8BD5066094591F115BD6F
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/ko.pm".#------------------------------------------------------------------------------.# File: ko.pm.#.# Description: ExifTool Korean language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::ko;..use strict;.use vars qw($VERSION);..$VERSION = '1.06';..%Image::ExifTool::Lang::ko::Translate = (. 'AELock' => {. Description => 'AE ..',. PrintConv => {. 'Off' => '..',. 'On' => '..',. },. },. 'AELockButton' => {. Description => 'AE-L/AF-L',. PrintConv => {. 'AE Lock (hold)' => 'AE ..(..)',. 'AE Lock Only' => 'AE ..',. 'AE/AF Lock' => 'AE/AF ..',. 'AF Lock Only' => 'AF ..',. },. },. 'AF-CPrioritySelection' => {. Description => 'AF-C .. ..',. PrintConv => {. 'F

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\nl.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	90935
Entropy (8bit):	4.509738101661355
Encrypted:	false
SSDEEP:	768:A7xHhyvPShIScFr1s2y4qK7ZrHedhvsAuYef1ckhLPHUNssL/P5giQ/hMB:0xHhaFr6LQrHedhvsAutdhLPUL3NUU
MD5:	0FAFA5D1B4A1D1F426E2DE61266866FB
SHA1:	73CB58070D131A6452F4ACEDD5F7615113797155
SHA-256:	BEC999851A8DFC8061A97535F291279F0E0200A452C83592BEF8C6F6E5772F7C
SHA-512:	7AA1DD7697440737311EE1964AD4DBB896B07C858E823A71D818DFA43CD1AC0F31BB7DC412BB82B4F6C83435432DD28241433A1319DEFE14F644559D25869C9D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/nl.pm".#------------------------------------------------------------------------------.# File: nl.pm.#.# Description: ExifTool Dutch language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::nl;..use strict;.use vars qw($VERSION);..$VERSION = '1.11';..%Image::ExifTool::Lang::nl::Translate = (. 'AEBAutoCancel' => {. PrintConv => {. 'Off' => 'Uit',. 'On' => 'Aan',. },. },. 'AELock' => {. Description => 'AE-vergrendeling',. PrintConv => {. 'Off' => 'Uit',. 'On' => 'Aan',. },. },. 'AELockButton' => {. Description => 'AE-L/AF-L',. PrintConv => {. 'AE Lock (hold)' => 'AE-vergrendeling vast',. 'AE Lock Only' => 'AE-vergrendeling',. 'AE-L/AF Area' => 'AE-L/AF veld',. 'AE-L/AF-L/AF Area' => 'AE-L/AF-

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\pl.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	45992
Entropy (8bit):	4.938417284021034
Encrypted:	false
SSDEEP:	768:PQBklw/LD/LHBoL6Ay2JIXifHGixfQv/LEYSP6LMz6NZSdLEoXC:IBkG/LD/LHBoL6e1xfQv/L3CLz6nSdL6
MD5:	42AF2D3919BBCE636785232FF1FF8080
SHA1:	50798F0ED7F5F854AA9C324D35B7FA98B805B9E4
SHA-256:	3E0F923EBB61D27B045B99D2FF6304839CB797A81ED94E620CC915EF7D6C4AB5
SHA-512:	89C6065E781FD61C9EA1A895629686F7CC4D3522C3D39D53E2EB317DDBA417FBBEC85CF7C6368C83BC74821194233222A6B4A952D1BA0071883F2617FFCDF0BC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/pl.pm".#------------------------------------------------------------------------------.# File: pl.pm.#.# Description: ExifTool Polish language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::pl;..use strict;.use vars qw($VERSION);..$VERSION = '1.10';..%Image::ExifTool::Lang::pl::Translate = (. 'A100DataOffset' => 'Przesuni.cie danych A100',. 'AEAperture' => 'Priorytet AE',. 'AEExposureTime' => 'Czas ekspozycji AE',. 'AEInfo' => 'Informacja o automatycznej ekspozycji',. 'AELock' => {. Description => 'Blokada AE',. PrintConv => {. 'Off' => 'Wy..czona',. 'On' => 'W..czona',. },. },. 'AEMeteringMode' => 'Tryb pomiaru AE',. 'AEMeteringSegments' => 'Segmenty pomiaru AE',. 'AEProgramMode' => 'Tryb programu AE',. 'AFAdjustment' => 'Korekta AF',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\ru.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	37963
Entropy (8bit):	5.08062903710232
Encrypted:	false
SSDEEP:	768:Kl68hx46dHoc77E0P67IfZZHWWt/QNL2poQ:T8/PoIB9R6Q
MD5:	63269D3E7B86437A8D4BB839A35E795D
SHA1:	354B6C5130FC40367859E7FB81871479A482E21E
SHA-256:	13C236D5444598925C221785623575025AF646F15A3D5A86DFAF5E583E07D3A7
SHA-512:	5406076667E87ED09BA005057FBAAC7374270C63F6A45194651C5AD4D6AB098C99B9E1260B50FBBC102C92686BC8FF54CCDF2F0452CCAB834B9C2557AE8C4024
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/ru.pm".#------------------------------------------------------------------------------.# File: ru.pm.#.# Description: ExifTool Russian language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::ru;..use strict;.use vars qw($VERSION);..$VERSION = '1.04';..%Image::ExifTool::Lang::ru::Translate = (. 'ActiveArea' => '........ .......',. 'Album' => '......',. 'AnalogBalance' => '.......... ...... ......',. 'AntiAliasStrength' => '............. .... ............. ....... .......',. 'Aperture' => '.........',. 'ApertureValue' => '.........',. 'Artist' => '...........',. 'AsShotICCProfile' => 'ICC ....... ......',. 'AsShotNeutral' => '...........

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\sv.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21105
Entropy (8bit):	4.779197607103336
Encrypted:	false
SSDEEP:	384:mJcMvKo2O3ZX/A84kq+y60Ii2p1U02q0/+QXKF:mJcMvKm9Zd0afOX+QXg
MD5:	CEE0D4BAEC269425DFC818F42EB2EBA0
SHA1:	CA6CE5E6AFBE40CA18D7A3ECC8893157622776EE
SHA-256:	33717B4BC0DCA4CC02583026ECEC1D567ED7C5E865966D5FE0BE6E3BE6F8D737
SHA-512:	0999B2A7BC392B286CAF095AE982CD8ADF6B6C26EC63B44B5D6D92EE3760493930EBA67AA7C8682B34D8612983E6624DE8719B4CFD3FD267844EBD477C7F5736
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/sv.pm".#------------------------------------------------------------------------------.# File: sv.pm.#.# Description: ExifTool Swedish language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::sv;..use strict;.use vars qw($VERSION);..$VERSION = '1.05';..%Image::ExifTool::Lang::sv::Translate = (. 'Aperture' => 'Bl.ndare',. 'ApertureValue' => 'Bl.ndare',. 'Artist' => 'Upphovsman',. 'Author' => 'Upphovsman',. 'AuthorsPosition' => 'F.rfattarens befattning',. 'BitsPerSample' => 'Antal bitar per komponent',. 'Brightness' => 'Ljusstyrka',. 'By-line' => 'Upphovsman',. 'CFAPattern' => 'CFA-m.nster',. 'CalibrationIlluminant1' => {. PrintConv => {. 'Cloudy' => 'Mulet',. 'Cool White Fluorescent' => 'Kalljusr.r (W 3800 - 4500 k)',. 'Day White Fluorescent'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\tr.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	18544
Entropy (8bit):	4.937167242652555
Encrypted:	false
SSDEEP:	192:9VKMXxxVtKXVtKxdzebM2LuLGoGg/99N9bLpb/2kLHf2VtKuiUF4Vw9rAfjc9v+R:DKaVt8VtwzMM2aSMj1buC2Vt6w1Au+Nf
MD5:	739D71B2B4BE0CF7F0FFB1056EC06695
SHA1:	A7BC52FA9BEBEDA7354DF48F6DD7ECDF0D4563ED
SHA-256:	96DA52A9BF89D34FF87D468115322F3D6CC83A7430B6952A104F3210A57888FC
SHA-512:	72908B6F6C36E1969158A3A170A04F186F34266CB648F42A2A129D7A404C8F51EEDFD017EAA436CE147C37A43D9814280693EC9876CDF74F9B60A8360CCB2950
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/tr.pm".#------------------------------------------------------------------------------.# File: tr.pm.#.# Description: ExifTool Turkish language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::tr;..use strict;.use vars qw($VERSION);..$VERSION = '1.04';..%Image::ExifTool::Lang::tr::Translate = (. 'Album' => 'Alb.m',. 'Aperture' => 'A..kl.k',. 'ApertureValue' => 'A..kl.k',. 'Artist' => 'Sanat..',. 'Author' => 'Yazar',. 'AuthorsPosition' => 'Yazar.n Pozisyonu',. 'BitsPerSample' => 'Komponent ba..na bit say.s.',. 'Brightness' => 'Parlakl.k',. 'By-line' => 'Yazar',. 'CFAPattern' => 'CFA deseni',. 'CalibrationIlluminant1' => {. PrintConv => {. 'Cloudy' => 'Bulutlu Hava',. 'Cool White Fluorescent' => 'So.uk beyaz floresan (W 3800 - 4500K)',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\zh_cn.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	37107
Entropy (8bit):	5.248815946146681
Encrypted:	false
SSDEEP:	768:bFtKw4CusZsukLaz/RpaYH+jzPE9CMSusw0qugVyZyBOjv4hAK89QOG6TWp1gtyJ:G6QViVBJ
MD5:	B550A530604D2098BE8B262B80E2DDCB
SHA1:	E3318E0E0F3F032053750FB29F4A4BF74B64007B
SHA-256:	3129085457D0B7443D815038D3E39FEDA0000E105858E4091B688B7266504ADA
SHA-512:	D543CE10EDF7E9F949DE943BF36EE55BC6FF536DE0F1FCE962232865B9B63B2D1A5DFE40150EB65E4CCB3FEF72B7577AB6A36032B5D04AED91530CB033883DE0
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/zh_cn.pm".#------------------------------------------------------------------------------.# File: zh_cn.pm.#.# Description: ExifTool Simplified Chinese language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::zh_cn;..use strict;.use vars qw($VERSION);..$VERSION = '1.08';..%Image::ExifTool::Lang::zh_cn::Translate = (. 'AEProgramMode' => {. PrintConv => {. 'Landscape' => '..',. 'Portrait' => '..',. },. },. 'AFAreaIllumination' => {. PrintConv => {. 'Auto' => '..',. },. },. 'AFPointIllumination' => {. PrintConv => {. 'Auto' => '..',. },. },. 'AFPointMode' => {. PrintConv => {. 'Auto' => '..',. },. },. 'AFPointRegistration' => {. PrintConv => {. 'Automatic' => '..'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lang\zh_tw.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	26914
Entropy (8bit):	5.496155945579222
Encrypted:	false
SSDEEP:	768:cvy/j/2ax51/VRtgrPNre/GVNn2DWDh7OcdGD4:lLhX/VCreOjIcd3
MD5:	66935A4341B1EA4D1BE1028B86131A14
SHA1:	81B3E89037AD5A9F584CEA64184446BEEEB9255F
SHA-256:	104D0014F401BBAFA7B4E53B80B24F33573859DFB77703B7FDE0596E7F03D2C5
SHA-512:	7524DE671628D8BA0861B560373139AFEC9C6C039430FCEBE4C8C30117824785A08A93F242F8172F24562646ED75D8DDB72B06F9C3DB56567DED3005C80027F2
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lang/zh_tw.pm".#------------------------------------------------------------------------------.# File: zh_tw.pm.#.# Description: ExifTool Traditional Chinese language translations.#.# Notes: This file generated automatically by Image::ExifTool::TagInfoXML.#------------------------------------------------------------------------------..package Image::ExifTool::Lang::zh_tw;..use strict;.use vars qw($VERSION);..$VERSION = '1.06';..%Image::ExifTool::Lang::zh_tw::Translate = (. 'Album' => '..',. 'Aperture' => '..',. 'ApertureValue' => '..',. 'Artist' => '.....',. 'Author' => '..',. 'AuthorsPosition' => '..',. 'BatteryLevel' => '....',. 'BitsPerSample' => '.... bits .....',. 'Brightness' => '..',. 'BrightnessValue' => '..',. 'By-line' => '..',. 'CFAPattern' => '.......',. 'CFAPattern2' => 'CFA .. 2',. 'CFARepeatPatternDim' => 'CFA ...

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Leaf.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16154
Entropy (8bit):	4.734853285711714
Encrypted:	false
SSDEEP:	192:3OGdpvVvMh9hPzX1yLaOkujtK5UdUPNDGfnhw7/KP2UCqIAWCken/7tGyshdHmBK:3DdVBInXjsm87rwyshv
MD5:	C67FC11262EA44AA60625016248A5D41
SHA1:	AE775BDCC3E91A8651E4CD43B004A837C5BEAD26
SHA-256:	B09DA14E7120A13A540046A94710BF72A0E547C213F910A5B48158D9CFFF2415
SHA-512:	79AD805738BCD15975E0DBB4796620EBE081EA55B3AA750294EDE2B2CE6EC546A7E851ADA13C9AD6926A5340CBC0F4996C9221385F56ED0CF6E62E39BFDE0323
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Leaf.pm".#------------------------------------------------------------------------------.# File: Leaf.pm.#.# Description: Read Creo Leaf EXIF meta information.#.# Revisions: 09/28/2005 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Leaf;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.07';..sub ProcessLeaf($$$);..%Image::ExifTool::Leaf::Main = (. PROCESS_PROC => \&ProcessLeaf,. GROUPS => { 0 => 'Leaf', 2 => 'Camera' },. NOTES => q{. These tags are found in .MOS images from Leaf digital camera backs as. written by Creo Leaf Capture. They exist within the Leaf-specific directory. structure of EXIF tag 0x8606. The tables below list observed Leaf tags,. however ExifTool will extract any tags found in the Leaf directories even if. they don't appear in these t

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Lytro.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7096
Entropy (8bit):	4.970141325569797
Encrypted:	false
SSDEEP:	192:nzCRfky6vPvLBY7aESIftd3cSc1QI7V5vG97yNQW+:nzCRcTHLBYqCMlY95
MD5:	526F6A1710550FD1CA446F0B304F622A
SHA1:	7D025742BAF4695722D913AD427FD7F78D6BB344
SHA-256:	E6438472F1AC247AEEC8A74DD3D32B64A0872EFA405CF94411290B3B5434CBE7
SHA-512:	6BA44E05A2343464165C4BC886BFCF1C7E273E613ABC23A2D3C1909C2954A6CBE16D5CCD31626410C80E8CA8E3968AAF662C1410251228151FFE34F75A998D3D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Lytro.pm".#------------------------------------------------------------------------------.# File: Lytro.pm.#.# Description: Read Lytro LFP files.#.# Revisions: 2014-07-17 - P. Harvey Created.#.# References: 1) http://optics.miloush.net/lytro/TheFileFormat.aspx.#------------------------------------------------------------------------------..package Image::ExifTool::Lytro;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Import;..$VERSION = '1.03';..sub ExtractTags($$$);..# Lytro LFP tags (ref PH).%Image::ExifTool::Lytro::Main = (. GROUPS => { 2 => 'Camera' },. VARS => { NO_ID => 1 },. NOTES => q{. Tag definitions for Lytro Light Field Picture (LFP) files. ExifTool. extracts the full JSON metadata blocks, as well as breaking them down into. individual tags. All available tags are extracted from the JSON metadata,. even if they don't appear in the table below..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\M2TS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	28179
Entropy (8bit):	4.636178105841072
Encrypted:	false
SSDEEP:	384:QIjteBOKkngiRe0g0N2zyTymNrgvK8Z60mSUoaG:QIjtq6e0hNGyumN0nsM
MD5:	F077E5179377E842E820C8212DA8ADA9
SHA1:	DF7DD0A6E815CD28BC12EB53D74A245366FAB284
SHA-256:	F282272774D278D9F14CA93C818568A1E4CEA32F43DCF4BA0B27F2DF2DEFE377
SHA-512:	FAA902EFD79A9678A635ABB87FF14542EF0595A6B93C569D9E34852D59D349AF9A853480482A225EB01B932F98AC43113C3B710DD3A39B8F1D2E11B2B9B6EEED
Malicious:	false
Preview:	#line 1 "Image/ExifTool/M2TS.pm".#------------------------------------------------------------------------------.# File: M2TS.pm.#.# Description: Read M2TS (AVCHD) meta information.#.# Revisions: 2009/07/03 - P. Harvey Created.#.# References: 1) http://neuron2.net/library/mpeg2/iso13818-1.pdf.# 2) http://www.blu-raydisc.com/Assets/Downloadablefile/BD-RE_Part3_V2.1_WhitePaper_080406-15271.pdf.# 3) http://www.videohelp.com/forum/archive/reading-avchd-playlist-files-bdmv-playlist-mpl-t358888.html.# 4) http://en.wikipedia.org/wiki/MPEG_transport_stream.# 5) http://www.dunod.com/documents/9782100493463/49346_DVB.pdf.# 6) http://trac.handbrake.fr/browser/trunk/libhb/stream.c.# 7) http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=04560141.# 8) http://www.w6rz.net/xport.zip.#.# Notes: Variable names containing underlines are the same as in ref 1..#.# Glossary: PES = Pack

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MIE.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	73322
Entropy (8bit):	4.496391875283294
Encrypted:	false
SSDEEP:	1536:yMPbSiXEXmU6fRolnniS0wzZySlElQmJ61gqEh:yhyoBd0wNFElQmA1gqEh
MD5:	6BB1F1BDE10A2C24F0A0DBE46D52DFEB
SHA1:	0E68249CCAA91CA3F03B205B9C62B920D86E51EA
SHA-256:	7D32D1E77D47CCA0BBE8273ED9AB3FDEBBF4A0BB1FEF22126742B01345F63490
SHA-512:	2807C79B691C3DEF4C6B3E6A436BA2C0A93A082840BDA5C5555FABC2EA1F3485497828CB864B41CD77A52DC19395B220C5D5282D18008C1CA7BA1D5BB893A029
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MIE.pm".#------------------------------------------------------------------------------.# File: MIE.pm.#.# Description: Read/write MIE meta information.#.# Revisions: 11/18/2005 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::MIE;..use strict;.use vars qw($VERSION %tableDefaults);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::GPS;..$VERSION = '1.47';..sub ProcessMIE($$);.sub ProcessMIEGroup($$$);.sub WriteMIEGroup($$$);.sub CheckMIE($$$);.sub GetLangInfo($$);..# local variables.my $hasZlib; # 1=Zlib available, 0=no Zlib.my %mieCode; # reverse lookup for MIE format names.my $doneMieMap; # flag indicating we added user-defined groups to %mieMap..# MIE format codes.my %mieFormat = (. 0x00 => 'undef',. 0x10 => 'MIE',. 0x18 => 'MIE',. 0x20 => 'string', # ASCII (ISO 8859-1). 0x28 => 'utf8',. 0x29 =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MIEUnits.pod

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl POD document, ASCII text
Category:	dropped
Size (bytes):	14005
Entropy (8bit):	4.385894016129826
Encrypted:	false
SSDEEP:	384:URrzW0wlFlEM9e7uyrLL5ctcstoiGCn7kI:U5W0pMlyrX5BI
MD5:	2356975C337EA1E38C094AAADD616378
SHA1:	3BE89465C49277DAFAE27820F7C1DA7FEAE2EA7B
SHA-256:	905ED7B60D7723A26B76C5E3A6A4D7E873EE9188284E5D3E005786A91748B0A4
SHA-512:	F4A4829C1409ADF13196BC260721BD8536899FABA530BE414298A4105E8E4B552F71CF67ADA9D8DB9C521687C7B2F44B30C992B1F55BF1193FB6094B5F635967
Malicious:	false
Preview:	.=head1 NAME..Image::ExifTool::MIEUnits - MIE units documentation..=head1 DESCRIPTION..The MIE format allows units of measurement to be specified in brackets at.the end of a MIE tag name (eg. "Volume(m3)"). This document describes the.standard MIE units abbreviations...=head1 SYNTAX..The units string may contain any ASCII characters in the range 0x21 ('!') to.0x7d ('}'), excepting the bracket characters (0x28 and 0x29). An empty.string is allowed, and indicates a dimensionless value. L<Standard.units\|/STANDARD UNITS> should be used where possible. In the standard.units, an underline ('_') is used to indicate a subscript, and multiple.words may be separated with a hyphen ('-')...Exponents should be positive, and require no separator (eg. "m2" for square.meters). L<Prefixes\|/PREFIXES> may be added to the standard units (eg.."cm") except when the resulting name conflicts with another standard unit...Multiplication is indicated by '.', and division by '/'. Reciprocal units.(ie. the mu

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MIFF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8596
Entropy (8bit):	4.621424249639305
Encrypted:	false
SSDEEP:	192:JvsOXzMxzzFlC7NeNvQSSSFGbbXNSOGhFtjtDFyKbDBd28L2ACt4reEOy46H98ii:mkIJzFlC7NiTU/dGL3BWApg6He
MD5:	15697CCFF54B4ABA8E209939FE280663
SHA1:	835FEF488BAA75C3AA8E1BEC9DF740802D0D0B2A
SHA-256:	6A45D78B32DBBF8BADDB4C2D9DB6D43368405426008FA5024792B368F46326C0
SHA-512:	84D0E31050D1DAE37C2B027DB0ED207F82CBBDFE09B2EB4A659AC377436D39248B677A2C38E76296D35CBE249E28E629A03FF38C9D03F8353366EEFD8A974EC1
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MIFF.pm".#------------------------------------------------------------------------------.# File: MIFF.pm.#.# Description: Read Magick Image File Format meta information.#.# Revisions: 06/10/2005 - P. Harvey Created.#.# References: 1) http://www.imagemagick.org/script/miff.php.# 2) http://www.cs.uni.edu/Help/ImageMagick/www/miff.html.#------------------------------------------------------------------------------..package Image::ExifTool::MIFF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.07';..# MIFF chunks.%Image::ExifTool::MIFF::Main = (. GROUPS => { 2 => 'Image' },. NOTES => q{. The MIFF (Magick Image File Format) format allows aribrary tag names to be. used. Only the standard tag names are listed below, however ExifTool will. decode any tags found in the image.. },. 'background-color' => 'BackgroundColor',. 'blue-primary' => 'BluePrimary',. 'bord

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MNG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	15951
Entropy (8bit):	4.704686241722233
Encrypted:	false
SSDEEP:	96:Cspl4V68W6G0J6evXpf7vWznev93vhvJWvCWLeNmeTl2qO2KP1HOdBaG1e99mfg/:CGCJfTvXpTvWyv93vhv4vYBaVI6J
MD5:	80A633E86AD97B28CA2F61F93DEF2D79
SHA1:	4E740282E5F8847C6A04DC5BD7EFB519B48E6C57
SHA-256:	32ED5B18895D26CD9F408374F1EB064BC5AD672D31088CEB9454C61B2063D6F3
SHA-512:	7080C3C942CF2EB93DF638D97848E9AA83CCC749706970CDE211AFFB167515EAF2CDB7BAA4CAF8F16279CD3184912215C38055ECB85992502CA9F9088E1EEC3D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MNG.pm".#------------------------------------------------------------------------------.# File: MNG.pm.#.# Description: MNG and JNG meta information tags.#.# Revisions: 06/23/2005 - P. Harvey Created.#.# References: 1) http://www.libpng.org/pub/mng/.#------------------------------------------------------------------------------..package Image::ExifTool::MNG;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.00';..# MNG chunks.%Image::ExifTool::MNG::Main = (. GROUPS => { 2 => 'Image' },. NOTES => q{. This table contains definitions for tags found in MNG and JNG images. MNG. is a superset of PNG and JNG, so a MNG image may contain any of these tags. as well as any PNG tags. Conversely, only some of these tags are valid for. JNG images.. },. BACK => {. Name => 'Background',. SubDirectory => { TagTable => 'Image::ExifTool::MNG::Background' },. },.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MOI.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3613
Entropy (8bit):	4.796852409472848
Encrypted:	false
SSDEEP:	96:9pqV6UC0vOeFChOaTdtOA6mmXhBVES88eB:GdSOa54A6tMS88eB
MD5:	F8802E58264EE87C70ADBB039AA6BD2B
SHA1:	44AB3997018088C7CFC7C3F9DC7029337FC05A1E
SHA-256:	73B87BC679BD5140C52CBFAB876648619ED9CFFF325761EF1F023F566EC28F26
SHA-512:	3F27ACC3EA1B8378AD8C84B2C86040295195719B5F74C9B4F9993A0A70B8A655BE55A2B5FA886C80934CFFDC1D047DA36FB689725BA55768A655CEBC8AEAAB4C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MOI.pm".#------------------------------------------------------------------------------.# File: MOI.pm.#.# Description: Read MOI meta information.#.# Revisions: 2014/12/15 - P. Harvey Created.#.# References: 1) https://en.wikipedia.org/wiki/MOI_(file_format).#------------------------------------------------------------------------------..package Image::ExifTool::MOI;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..# MOI tags (ref 1).%Image::ExifTool::MOI::Main = (. GROUPS => { 2 => 'Video' },. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. NOTES => q{. MOI files store information about associated MOD or TOD files, and are. written by some JVC, Canon and Panasonic camcorders.. },. 0x00 => { Name => 'MOIVersion', Format => 'string[2]' },. # 0x02 => { Name => 'MOIFileSize', Format => 'int32u' },. 0x06 => {. Name => 'DateTimeOriginal',. Format =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MPC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3561
Entropy (8bit):	4.965555092689231
Encrypted:	false
SSDEEP:	96:i4PgnVfJJ1qgmHm0wVJf4g6TB5frMkmJlXBdsWk:8vXr76TL5mJlXBdsWk
MD5:	B356DCA55C3F521FA454F7F4682C7FAF
SHA1:	AA56398AB19A107625F0207DA8AA1C641D626FC7
SHA-256:	7E08D13B8D26556BF6FA50454ABC1DBEE8DAA4348F64D256EEFD04A8DD6FC0BB
SHA-512:	D41CF91F9E31F1C5AE55BF0C99BDD48FDB75F37CE2BACBC364947D43734023EE022002D451960FF2F600E65DBC078478FF41B7AB0051B1FB745FD7935A43B726
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MPC.pm".#------------------------------------------------------------------------------.# File: MPC.pm.#.# Description: Read Musepack audio meta information.#.# Revisions: 11/14/2006 - P. Harvey Created.#.# References: 1) http://www.musepack.net/.#------------------------------------------------------------------------------..package Image::ExifTool::MPC;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::FLAC;..$VERSION = '1.01';..# MPC metadata blocks.%Image::ExifTool::MPC::Main = (. PROCESS_PROC => \&Image::ExifTool::FLAC::ProcessBitStream,. GROUPS => { 2 => 'Audio' },. NOTES => q{. Tags used in Musepack (MPC) audio files. ExifTool also extracts ID3 and APE. information from these files.. },. 'Bit032-063' => 'TotalFrames',. 'Bit080-081' => {. Name => 'SampleRate',. PrintConv => {. 0 => 44100,. 1 => 48000,. 2 => 37800,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MPEG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21945
Entropy (8bit):	4.517724813668689
Encrypted:	false
SSDEEP:	384:wCDqsvqb2oJ8PV/XaCe3bp8HUdWsfknk/S:wCD6b2oWdaCe3bpBxYsS
MD5:	3B69ED5EA97EF2F5EF3FB1ABD319859D
SHA1:	D98C52BF28E5DA9C1CA4C34C1D667A8257E2D971
SHA-256:	302AC50E409DB27F7CD621F9B6B71626C02AC66E9F193F7D545828C6CF9909C1
SHA-512:	A75E7BDF7C24838F03B510B4B91F96F056F0954A77328058F998C81CF3C400056F74FE45CB2FD76E36E85826C227C8B3C661BF13464A47074A425D6055E3FAD1
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MPEG.pm".#------------------------------------------------------------------------------.# File: MPEG.pm.#.# Description: Read MPEG-1 and MPEG-2 meta information.#.# Revisions: 05/11/2006 - P. Harvey Created.#.# References: 1) http://www.mp3-tech.org/.# 2) http://www.getid3.org/.# 3) http://dvd.sourceforge.net/dvdinfo/dvdmpeg.html.# 4) http://ffmpeg.org/.# 5) http://sourceforge.net/projects/mediainfo/.#------------------------------------------------------------------------------..package Image::ExifTool::MPEG;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.15';..%Image::ExifTool::MPEG::Audio = (. GROUPS => { 2 => 'Audio' },. 'Bit11-12' => {. Name => 'MPEGAudioVersion',. RawConv => '$self->{MPEG_Vers} = $val',. PrintConv => {. 0 => 2.5,. 2 => 2,. 3 => 1,. },. },. 'Bit13-14'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MPF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8438
Entropy (8bit):	4.823749367057982
Encrypted:	false
SSDEEP:	96:IHHVbOoLj2Y+/voz2BBhNACKLFW2zKOdsBx7lVdqO2s+cwriUrbRyiQn930ApF:cav4erahxW2zXO7lVdaRiUrbRyiQ9LpF
MD5:	3247F81F1EA4B2FEB0691162B8E0C060
SHA1:	FE5C4743F5F1C2C2A0714760DD2E48F297C07782
SHA-256:	D86EE5058A076054B1DAAD2D3A39FA49B894DCD6A3712264CCB18437F9ECEA07
SHA-512:	757F2E7EEF92165B9DB520F2069A7F1228145037F3A7010C4EF9F4A5E31751CBDA4CEF13380DEBDC83750985A71A4D735EB0A0EA7DAEB31C35061B0F73884427
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MPF.pm".#------------------------------------------------------------------------------.# File: MPF.pm.#.# Description: Read Multi-Picture Format information.#.# Revisions: 06/12/2009 - P. Harvey Created.#.# References: 1) http://www.cipa.jp/std/documents/e/DC-007_E.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::MPF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.13';..sub ProcessMPImageList($$$);..# Tags found in APP2 MPF segment in JPEG images.%Image::ExifTool::MPF::Main = (. GROUPS => { 0 => 'MPF', 1 => 'MPF0', 2 => 'Image'},. NOTES => q{. These tags are part of the CIPA Multi-Picture Format specification, and are. found in the APP2 "MPF" segment of JPEG images. MPImage data referenced. from this segment is stored as a JPEG trailer. The MPF tags are not. writable, however th

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MWG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	29336
Entropy (8bit):	4.8528929916860095
Encrypted:	false
SSDEEP:	768:QWaozXRTkgoi3qUjhjzjojVs9CPVnHYZD8ym:laUXRTkgoZUjhjzjojVs9CPVnHYGym
MD5:	CE9C3FCD1CEA348FCA9905F56056F71E
SHA1:	75D7FCE7D2F5F4956E3F173350B6601EDC715906
SHA-256:	8B1224A6BD4FE0BDADEB74305F0E0C9B2789396EB8B1760D183DC0A756B0BEDD
SHA-512:	0052E8381C8911CD969CD3764B8CC4A01C7B1BD0B4774B0CB2B992135C0943349EB87E84E681FB090FD57B9314A393658DD04245D35349B994D083B7EA3F81F6
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MWG.pm".#------------------------------------------------------------------------------.# File: MWG.pm.#.# Description: Metadata Working Group support.#.# Revisions: 2009/10/21 - P. Harvey Created.#.# References: 1) http://www.metadataworkinggroup.org/.#------------------------------------------------------------------------------..package Image::ExifTool::MWG;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::XMP;..$VERSION = '1.22';..sub RecoverTruncatedIPTC($$$);.sub ListToString($);.sub StringToList($$);.sub OverwriteStringList($$$$);..my $mwgLoaded; # flag set if we alreaded Load()ed the MWG tags..# MWG Composite tags.%Image::ExifTool::MWG::Composite = (. GROUPS => { 0 => 'Composite', 1 => 'MWG', 2 => 'Image' },. VARS => { NO_ID => 1 },. NOTES => q{. The table below lists special Composite tags which are used to access other. tags based on the

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MXF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	257285
Entropy (8bit):	4.900914327244084
Encrypted:	false
SSDEEP:	6144:c3XlCe8XcgOxH1Ls0SE2/rn59/ilLxqKMubDzNuLDMETax:WUzax
MD5:	DE2166E9BC1B0B55BFDEC9FE31868B73
SHA1:	CD196B924EB771CB7049036DC46C872B88FEEE1F
SHA-256:	F13FBC0DA05A24426DAF0CCB5986CAE6AC216061BE7B9B48DABF220C90294509
SHA-512:	3A237C1CDF7F6CBF859D6985D397E261E7A7164C82E34FAE0D505B9F08DD804E64CB312B627ABD14B6E3EE2564C3B59205E99C96CD01B6E9979E153777C635FC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MXF.pm".#------------------------------------------------------------------------------.# File: MXF.pm.#.# Description: Read MXF meta information.#.# Revisions: 2010/12/15 - P. Harvey Created.#.# References: 1) http://sourceforge.net/projects/mxflib/.# 2) http://www.aafassociation.org/downloads/whitepapers/MXFPhysicalview.pdf.# 3) http://archive.nlm.nih.gov/pubs/pearson/MJ2_Metadata2005.pdf.# 4) http://www.aafassociation.org/downloads/specifications/AMWA-AS-03-Delivery-Spec-1_0.pdf.# 5) http://paul-sampson.ca/private/s385m.pdf.# 6) http://avwiki.nl/documents/eg41.pdf.# 7) http://avwiki.nl/documents/eg42.pdf.# 8) http://rhea.tele.ucl.ac.be:8081/Plone/Members/egoray/thesaurus-dictionnaire-metadata/.# a) S335M Dictionary structure.pdf.# b) S330M UMID.PDF.# 9) http://www.smpte-ra.org/mdd/RP210v12-publicati

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MacOS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	23414
Entropy (8bit):	4.678460501051012
Encrypted:	false
SSDEEP:	192:1TB7Ubm7MFpCR2gNKX7pry+TKQsAyldqLCTh5lqCSiQSppVC9JIl3ot5Z2AaAVhG:1TZUawLCR2d9WfTy2Jgw
MD5:	87B7F02DFAD39D4F208F92F639FCE8D9
SHA1:	A25003F93AACD5F67456D023066A086AD51AB640
SHA-256:	BF1F03BE5B68C493DEE23863C015346A967F65D604F6C770858BCD797E4AA1AE
SHA-512:	BE555A6B0FB904D9D75BBA34A1506DB63787D1830ED4EF8B6BE603B935F26352093D2878B66A1330D91A4F30A58A8108216423B9242686D4BA534186C54E4A9B
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MacOS.pm".#------------------------------------------------------------------------------.# File: MacOS.pm.#.# Description: Read/write MacOS system tags.#.# Revisions: 2017/03/01 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::MacOS;.use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.06';..sub MDItemLocalTime($);..my %mdDateInfo = (. ValueConv => \&MDItemLocalTime,. PrintConv => '$self->ConvertDateTime($val)',.);..# "mdls" tags (ref PH).%Image::ExifTool::MacOS::MDItem = (. WRITE_PROC => \&Image::ExifTool::DummyWriteProc,. VARS => { NO_ID => 1 },. GROUPS => { 0 => 'File', 1 => 'MacOS', 2 => 'Other' },. NOTES => q{. MDItem tags are extracted using the "mdls" utility. They are extracted if. any "MDItem*" tag or the MacOS group is specifically requested, or by. setting the L<MDItemTags API option

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MakerNotes.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	68185
Entropy (8bit):	4.811996088874151
Encrypted:	false
SSDEEP:	768:xcL+YiVryqil3KWpTDMf3HYTzDSnoQxbI221GBW:uLrityqa3KWpTDMfHgCTk1GBW
MD5:	E6786A1857375D02BA06E1AA35D9EBA6
SHA1:	85F3212DE436BA25D074F1BE49CFBF4A6DACCB79
SHA-256:	D12EFF928E4DF8C4AF2577023ABD539783708A1E40A6977E4905F0C67902E7C3
SHA-512:	538C51E67B657EFEF1D5313E53FC057ACD97F39E34B2D6B6E0060E0FBE7F38E83B6A5B226A50714C949B233DA7D1E0B367CC17DEAE7459CF7272386EECA533E7
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MakerNotes.pm".#------------------------------------------------------------------------------.# File: MakerNotes.pm.#.# Description: Read and write EXIF maker notes.#.# Revisions: 11/11/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::MakerNotes;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess);.use Image::ExifTool::Exif;..sub ProcessUnknown($$$);.sub ProcessUnknownOrPreview($$$);.sub ProcessCanon($$$);.sub ProcessGE2($$$);.sub ProcessKodakPatch($$$);.sub WriteUnknownOrPreview($$$);.sub FixLeicaBase($$;$);..$VERSION = '2.03';..my $debug; # set to 1 to enable debugging code..# conditional list of maker notes.# Notes:.# - This is NOT a normal tag table!.# - All byte orders are now specified because we can now.# write maker notes into a file with different byte ordering!.# - Put these in alphabetical order to make TagNames documentation n

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Matroska.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	34300
Entropy (8bit):	4.745503453143585
Encrypted:	false
SSDEEP:	768:a+mpuXE3MMMvCrG0nfgsfgtfgcfg0Jkxt8GODIrLu0fgwfgwZTlHmFyKaWDNQEv:tLgIspVKaaNH
MD5:	DCF781E8E1B3306327AEF824B63069F1
SHA1:	EAA876CDC2AFA3A63FFB0ADEB60152822F61BA06
SHA-256:	71769A44B1BE76B29DD8CBA00F33D34A5573103F535B1410DCB951E3C3C5D00C
SHA-512:	EDCEF6EAB8785C6D825FD5B958C39A2329563BBC0BABBAAE13186234E4B7ED0835473DE415AEDC8F3275F7C1A7CD0680DDEC3F95036EAD9F96B6507E6C76BA25
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Matroska.pm".#------------------------------------------------------------------------------.# File: Matroska.pm.#.# Description: Read meta information from Matroska multimedia files.#.# Revisions: 05/26/2010 - P. Harvey Created.#.# References: 1) http://www.matroska.org/technical/specs/index.html.#------------------------------------------------------------------------------..package Image::ExifTool::Matroska;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.09';..my %noYes = ( 0 => 'No', 1 => 'Yes' );..# Matroska tags.# Note: The tag ID's in the Matroska documentation include the length designation.# (the upper bits), which is not included in the tag ID's below.%Image::ExifTool::Matroska::Main = (. GROUPS => { 2 => 'Video' },. VARS => { NO_LOOKUP => 1 }, # omit tags from lookup. NOTES => q{. The following tags are extracted from Matroska multimedia container files. . This

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Microsoft.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	43484
Entropy (8bit):	5.053121559315653
Encrypted:	false
SSDEEP:	384:ON7WDXuSp07IA7zHsrjmuZ/rOwuUCazc/nW7dSAhiAlZRsO07D4HJYYuAD2bjN9h:OxCuS+7ZHsftSYRslcH1fIJ9h
MD5:	9CD4DD3716679D07FCEDB4570A9BB45A
SHA1:	FB626CF7FE3E1AA0C74931F28A0034AE8E91B057
SHA-256:	7F351F012891D2A406475548D6493102D928028219A904DFB7A9A691571C2EE7
SHA-512:	1E67A6761EE8A9EFDCD0065C3AC46C8CE23F5FAD2CB0C76AF89E429DC1B7B4CCF58E545283C27EF9936810069CB44DD41794E27A67454F9E136478810EE7508E
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Microsoft.pm".#------------------------------------------------------------------------------.# File: Microsoft.pm.#.# Description: Definitions for custom Microsoft tags.#.# Revisions: 2010/10/01 - P. Harvey Created.# 2011/10/05 - PH Added ProcessXtra().#.# References: 1) http://research.microsoft.com/en-us/um/redmond/groups/ivm/hdview/hdmetadataspec.htm.#------------------------------------------------------------------------------..package Image::ExifTool::Microsoft;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::XMP;..$VERSION = '1.20';..sub ProcessXtra($$$);..# tags written by Microsoft HDView (ref 1).%Image::ExifTool::Microsoft::Stitch = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. WRITE_PROC => \&Image::ExifTool::WriteBinaryData,. CHECK_PROC => \&Image::ExifTool::CheckBinaryData,. WRITABLE => 1,. FORMAT => 'float',. FIRST_ENTRY => 0,. GROUPS

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Minolta.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	106409
Entropy (8bit):	4.885296147850651
Encrypted:	false
SSDEEP:	1536:ABlQxEgshUsvlxf6nSlFNTnI3H0CsV2R2RAeeD+OcHb2RoHMK:ighVnTR3eeD+OcHbyoT
MD5:	C773AD3490B71272E7A38D2D4AC0E344
SHA1:	A884C611B63BD1204A3ABD615C935B6FF9CD8F07
SHA-256:	46BE1B416503E3882BB8C1E5401BD3DBF25C438A4DB9C1396EDE91CD0843CCF0
SHA-512:	9F897FEA93BF1F12C9FB83A7D9E28E9045D926F6E53C789D108581FEEE121676A35A688498089AF23A25849608666DB1C74139BF4FC2E9FC66FF79D81DED38EC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Minolta.pm".#------------------------------------------------------------------------------.# File: Minolta.pm.#.# Description: Minolta EXIF maker notes tags.#.# Revisions: 04/06/2004 - P. Harvey Created.# 09/09/2005 - P. Harvey Added ability to write MRW files.#.# References: 1) http://www.dalibor.cz/minolta/makernote.htm.# 2) Jay Al-Saadi private communication (testing with A2).# 3) Shingo Noguchi, PhotoXP (http://www.daifukuya.com/photoxp/).# 5) http://www.cybercom.net/~dcoffin/dcraw/.# 6) Pedro Corte-Real private communication.# 7) ExifTool forum post by bronek (http://www.cpanforum.com/posts/1118).# 8) http://www.chauveau-central.net/mrw-format/.# 9) CPAN Forum post by 'geve' (http://www.cpanforum.com/threads/2168).# 10) http://homepage3.nifty.com/kamisaka/makernote/makernote_km.htm.# 11) http://www.dyxum.co

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\MinoltaRaw.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	15852
Entropy (8bit):	4.821240255735234
Encrypted:	false
SSDEEP:	192:O32kQFgzwCtaLNKjSOCLUPwHa/c34YSYDlWFUy1i7JFPN6uKiR7Qp:OGn7b5q0IYSWlETEA
MD5:	89F49121C7B735BEAE95491C08540511
SHA1:	6ACD66DD4F35F689EF1C92F52BBB7A79BF3F45F3
SHA-256:	1EE29FF883D687F0D881018946EF89316342EA807B961BCCB7E9C916091D9449
SHA-512:	9FCE0C8373FAF08EE389EB2723F20820633799BBE698693BDA93A7749E7E8B86565BA398FF93A8F8E378FECAF729872F5BBB1FE7FE77036154642A7C1C64F091
Malicious:	false
Preview:	#line 1 "Image/ExifTool/MinoltaRaw.pm".#------------------------------------------------------------------------------.# File: MinoltaRaw.pm.#.# Description: Read/write Konica-Minolta RAW (MRW) meta information.#.# Revisions: 03/11/2006 - P. Harvey Split out from Minolta.pm.#.# References: 1) http://www.cybercom.net/~dcoffin/dcraw/.# 2) http://www.chauveau-central.net/mrw-format/.# 3) Igal Milchtaich private communication (A100).#------------------------------------------------------------------------------..package Image::ExifTool::MinoltaRaw;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Minolta;..$VERSION = '1.15';..sub ProcessMRW($$;$);.sub WriteMRW($$;$);..# Minolta MRW tags.%Image::ExifTool::MinoltaRaw::Main = (. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. PROCESS_PROC => \&Image::ExifTool::MinoltaRaw::ProcessMRW,. WRITE_PROC => \&Image::ExifTool::MinoltaRaw::WriteMRW,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Motorola.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	5.118797890313543
Encrypted:	false
SSDEEP:	24:TOydajQOaFoIgyur5wUfFk6vt5UYDlW+awTIRiQMXsFTaEbO2Fan:od9IEr5wUpvqii7Von
MD5:	63F67CB6BFA2DDF1543DCFE29CC90867
SHA1:	0730024F195789013E6FD4218D01A59C388A99FD
SHA-256:	9F6E59F7B4A525C8FBF38D94910F597F85112D7610FC864AE5263CC03B322FBC
SHA-512:	E1AEA61E3F7BBE1965C8C298C7BD2251A47D6CB2EC324CB5079B30E19EFB418B78580C481A7665C0837842140DCC568585280EDAD3D58A9673BFBBF8EE908D7C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Motorola.pm".#------------------------------------------------------------------------------.# File: Motorola.pm.#.# Description: Read Motorola meta information.#.# Revisions: 2015/10/29 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Motorola;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;..$VERSION = '1.00';..# Motorola makernotes tags (ref PH).%Image::ExifTool::Motorola::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. WRITABLE => 1,. # 0x5570 - some sort of picture mode (auto,hdr). # 0x6400 - HDR? (OFF,ON). # 0x6410 - HDR? (NO,YES). # 0x6420 - only exists in HDR images. 0x665e => { Name => 'Sensor', Writable => 'string' }, # (eg. "BACK,IMX230"). # 0x6700 - serial number?. 0x6705 => { Name => 'Manufactu

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Nikon.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	319747
Entropy (8bit):	4.8699326946189485
Encrypted:	false
SSDEEP:	6144:nDW3Vqa/u4aU2Sja1jAPCh6zUSzNpWJ8E6:Riu4xzNzCJ8E6
MD5:	EB95A6782D9FD80640ABB7C02E6AB73A
SHA1:	1FD019F35BD41D0536499CB210F09A96EEBF83E0
SHA-256:	B901F74F9CE79A864CE1ACC278036F9FF4C31AE1C409388BD7719ED8841C8106
SHA-512:	D086F818240109216E7ED661F1B500BF833E2C8BC3FBE082EFB0E09B3CCFD201F4BB0EA304F5F13ABA7784CB3C1ACAFA9F23933437D40BFD6FCDA62A0830238D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Nikon.pm".#------------------------------------------------------------------------------.# File: Nikon.pm.#.# Description: Nikon EXIF maker notes tags.#.# Revisions: 12/09/2003 - P. Harvey Created.# 05/17/2004 - P. Harvey Added information from Joseph Heled.# 09/21/2004 - P. Harvey Changed tag 2 to ISOUsed & added PrintConv.# 12/01/2004 - P. Harvey Added default PRINT_CONV.# 01/01/2005 - P. Harvey Decode preview image and preview IFD.# 03/35/2005 - T. Christiansen additions.# 05/10/2005 - P. Harvey Decode encrypted lens data.# [ongoing] - P. Harvey Constantly decoding new information.#.# References: 1) http://park2.wakwak.com/~tsuruzoh/Computer/Digicams/exif-e.html.# 2) Joseph Heled private communication (tests with D70).# 3) Thomas Walter private communication (tests with Coolpix 5400).# 4) http://www.cyberc

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\NikonCapture.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	28134
Entropy (8bit):	4.877585993659704
Encrypted:	false
SSDEEP:	384:T2AfBgnVdUZ0JZo1JhivYtnxrOVW+GRFZ4:iAfKVd2eo12GxrOVWVPZ4
MD5:	B89D62A72BC9E4C84B16D541B881208C
SHA1:	3354C1CE03261ABE679A4E3EBDE842874AD59C3D
SHA-256:	F74058EAA6D7A0884A6430974782A2386A6AA8FF05E27ABE748CE2F94668B4EE
SHA-512:	CE047A2A296B1DA0E0208D5AFC8612B0B41B0745871AF4671C62F5F00E5F3117E57CDD496858367D08B7634A2B8C193DD0E3912E531B6E14C095D0B83DECF747
Malicious:	false
Preview:	#line 1 "Image/ExifTool/NikonCapture.pm".#------------------------------------------------------------------------------.# File: NikonCapture.pm.#.# Description: Read/write Nikon Capture information.#.# Revisions: 11/08/2005 - P. Harvey Created.# 10/10/2008 - P. Harvey Updated for Capture NX 2.# 16/04/2011 - P. Harvey Decode NikonCaptureEditVersions.#.# References: 1) http://www.cybercom.net/~dcoffin/dcraw/.# IB) Iliah Borg private communication (LibRaw).#------------------------------------------------------------------------------..package Image::ExifTool::NikonCapture;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.14';..sub ProcessNikonCapture($$$);..# common print conversions.my %offOn = ( 0 => 'Off', 1 => 'On' );.my %noYes = ( 0 => 'No', 1 => 'Yes' );.my %unsharpColor = (. 0 => 'RGB',. 1 => 'Red',. 2 => 'Green',. 3 => 'Blue',. 4 => 'Yel

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\NikonCustom.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	284828
Entropy (8bit):	4.294831742648154
Encrypted:	false
SSDEEP:	3072:TvLtMekoxVIVzpdr7SrLsV1TU4Uizw1q7OL0gdR:DL9koxVIV3BUizIz
MD5:	46E5723E9DEBF10D3EDED789F7BC876F
SHA1:	BBD30C5D55FDA39F01C49D634AFEA0B837CC721C
SHA-256:	1AE37EA66FDF639785B843B2BE4FD4720C895FE27A71B82B15D03C5FDE9F0408
SHA-512:	208279B1C6D20145D2C73DA78824627BF1040ABC2D2F5F84C64C97FEC6AFE08CED240855FFFCFD173192E8FD965755D22C4644580F1EA7130E06F83145DD1EDB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/NikonCustom.pm".#------------------------------------------------------------------------------.# File: NikonCustom.pm.#.# Description: Read and write Nikon Custom settings.#.# Revisions: 2009/11/25 - P. Harvey Created.#.# References: 1) Warren Hatch private communication (D3 with SB-800 and SB-900).# 2) Anonymous contribution 2011/05/25 (D700, D7000).# JD) Jens Duttke private communication.#------------------------------------------------------------------------------..package Image::ExifTool::NikonCustom;..use strict;.use vars qw($VERSION);..$VERSION = '1.16';..# custom settings for the D80 (encrypted) - ref JD.%Image::ExifTool::NikonCustom::SettingsD80 = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. WRITE_PROC => \&Image::ExifTool::WriteBinaryData,. CHECK_PROC => \&Image::ExifTool::CheckBinaryData,. WRITABLE => 1,. FIRST_ENTRY => 0,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. NOTE

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Nintendo.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2703
Entropy (8bit):	5.042045984784638
Encrypted:	false
SSDEEP:	48:MjxYw4nZr5wUD1BRNFlOMoDZ6c1ehS77Sh4hpxlQQFMbgVsFde:SF4ZVwqHvsM8iUQe
MD5:	AB8003339E15CD10899BD616DF681079
SHA1:	3F438D65716541E8312D9661560CC1103F2AC4EE
SHA-256:	FFBF5548D2F8F9ED628EAA94FAB037536A27D2D9C16536D00186B772918237EA
SHA-512:	5098E7C1EA0A3304B3CF505BCB6CF91BB82CA7FED36BC265E38F48A60F52D8D443D3A3BF3F27F440224CE823FF7A9579F34E8C58DB26FD2474DD3CD85248DA81
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Nintendo.pm".#------------------------------------------------------------------------------.# File: Nintendo.pm.#.# Description: Nintendo EXIF maker notes tags.#.# Revisions: 2014/03/25 - P. Harvey Created.#.# References: 1) http://3dbrew.org/wiki/MPO.#------------------------------------------------------------------------------..package Image::ExifTool::Nintendo;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;..$VERSION = '1.00';..%Image::ExifTool::Nintendo::Main = (. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. WRITABLE => 1,. # 0x1000 - undef[28]. # 0x1001 - undef[8]. # 0x1100 - undef[80] (found in MPO files). 0x1101 => {. Name => 'CameraInfo',. SubDirectory => {. TagTable => 'Image::ExifTool::Nintendo::CameraInfo',. ByteOrder => 'Little-endian',. },. },.)

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\OOXML.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	13227
Entropy (8bit):	4.8450671374219185
Encrypted:	false
SSDEEP:	384:UflIs4lkR7fokYiOwvXHfXCoFXVs5ztSWTrIp:UdAkR7wkHfBFXV8z0uY
MD5:	8DB8196708AC269C3193C54E4A26F309
SHA1:	659D6EAB068BC0D532857418489F31D6DD23704F
SHA-256:	813174280043C9C01B8EEBBEA9588C487215860B6EB86CBD543C8F9B146EAC59
SHA-512:	D7DD1D23402CDDAB1D4DAB80F8E0B416591BF05207C2E3CB0276AC308247F357B83294569C5FFB91F3392213DFA7737876B69755097799D8D9FA920783E1A803
Malicious:	false
Preview:	#line 1 "Image/ExifTool/OOXML.pm".#------------------------------------------------------------------------------.# File: OOXML.pm.#.# Description: Read Office Open XML+ZIP files.#.# Revisions: 2009/10/31 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::OOXML;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::XMP;.use Image::ExifTool::ZIP;..$VERSION = '1.07';..# test for recognized OOXML document extensions.my %isOOXML = (. DOCX => 1, DOCM => 1,. DOTX => 1, DOTM => 1,. POTX => 1, POTM => 1,. PPSX => 1, PPSM => 1,. PPTX => 1, PPTM => 1, THMX => 1,. XLAM => 1,. XLSX => 1, XLSM => 1, XLSB => 1,. XLTX => 1, XLTM => 1,.);..# generate reverse lookup for file type based on MIME.my %fileType;.{. my $type;. foreach $type (keys %isOOXML) {. $fileType{$Image::ExifTool::mimeType{$type}} = $type;. }.}..# XML attr

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Ogg.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	4.705587916851953
Encrypted:	false
SSDEEP:	192:IKCwjQK+M3Qgc766JnGgARHFffFGaCj6FyXyNOmza7ytkiHz4QZ:njmjFGFVAfxmO8xh
MD5:	F7E46DD29F9EE4C5D25BC0EA31F340AE
SHA1:	0BE4F1363B0C035F191F5067276E4989B615D5F4
SHA-256:	565C3B7ACCD1674FE4FBF683F426210A91E1893C7FECB8186435E2B3607BE3B8
SHA-512:	069C4330FF8A5ED6D38452CF6277D0233BBA58E1F14CA8FBE77E0808AC74DA20FDD83D583731C3814C9BB4E35F18289C0C67C9C7041979DEEE10D3336D5F5B62
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Ogg.pm".#------------------------------------------------------------------------------.# File: Ogg.pm.#.# Description: Read Ogg meta information.#.# Revisions: 2011/07/13 - P. Harvey Created (split from Vorbis.pm).# 2016/07/14 - PH Added Ogg Opus support.#.# References: 1) http://www.xiph.org/vorbis/doc/.# 2) http://flac.sourceforge.net/ogg_mapping.html.# 3) http://www.theora.org/doc/Theora.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Ogg;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..my $MAX_PACKETS = 2; # maximum packets to scan from each stream at start of file..# Information types recognizedi in Ogg files.%Image::ExifTool::Ogg::Main = (. NOTES => q{. ExifTool extracts the following types of information from Ogg files. See. L<http://www.xiph.org/vorbis/doc/> for th

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Olympus.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Non-ISO extended-ASCII text
Category:	dropped
Size (bytes):	137909
Entropy (8bit):	4.769216866967637
Encrypted:	false
SSDEEP:	768:WSZJgyqRDT4xEKlq3eRPN13RSOAy7w5V5AbNIGRruYurZJxmpoNfDx/Wwe6N:fayqRDMDlqSr3EE7YbZXmODx/Le6N
MD5:	B9FFE0B4A1EB536BC6D7E5B16A2E8A9F
SHA1:	9864E08207D84D3D1D9A05672303D0EC58D28831
SHA-256:	870BA61E432B22B922E4BB0438DC7A7E827480712192B8137AA6EF9918A21102
SHA-512:	E64DFA30A64A7AEC2A7A08289FF8E60818A76303B366411340D826BAE33FC68FC23C3886EE04E675DB5676024DB1A0A0F65C5D776B9F534769F595486D2D1B03
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Olympus.pm".#------------------------------------------------------------------------------.# File: Olympus.pm.#.# Description: Olympus/Epson EXIF maker notes tags.#.# Revisions: 12/09/2003 - P. Harvey Created.# 11/11/2004 - P. Harvey Added Epson support.#.# References: 1) http://park2.wakwak.com/~tsuruzoh/Computer/Digicams/exif-e.html.# 2) http://www.cybercom.net/~dcoffin/dcraw/.# 3) http://www.ozhiker.com/electronics/pjmt/jpeg_info/olympus_mn.html.# 4) Markku H.nninen private communication (tests with E-1).# 5) R.mi Guyomarch from http://forums.dpreview.com/forums/read.asp?forum=1022&message=12790396.# 6) Frank Ledwon private communication (tests with E/C-series cameras).# 7) Michael Meissner private communication.# 8) Shingo Noguchi, PhotoXP (http://www.daifukuya.com/photoxp/).# 9) Mark Dapoz private communication.#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\OpenEXR.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9749
Entropy (8bit):	4.53780622046373
Encrypted:	false
SSDEEP:	192:dSv1DD9FLStUfckEZxSv9MjZm1ZWG1NWJCIMpb8r6gJtlqW9NiGgshJfNQWq:cl9FLSqfcR9jZm1dwskngshO
MD5:	1B8ABB7CF019C1B38F3F50D935E0D549
SHA1:	0AEB08B20171B30E4530862F110B44B4B59DCC88
SHA-256:	F087E1AD5F2CC7345E092D310E18BC5CD5D1FB9E67681BCFF74F8FC1123BE8F7
SHA-512:	83783CF2C39F121F7656104F8FBD500259EAE96F423B46CB66B58309CE878F7576BB72EA930D3FF11C28868B53D795C7432927482F0E8FDE9316D24B09052764
Malicious:	false
Preview:	#line 1 "Image/ExifTool/OpenEXR.pm".#------------------------------------------------------------------------------.# File: OpenEXR.pm.#.# Description: Read OpenEXR meta information.#.# Revisions: 2011/12/10 - P. Harvey Created.#.# References: 1) http://www.openexr.com/.#------------------------------------------------------------------------------..package Image::ExifTool::OpenEXR;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::GPS;..$VERSION = '1.02';..# supported EXR value format types (other types are extracted as undef binary data).my %formatType = (. box2f => 'float[4]',. box2i => 'int32s[4]',. chlist => 1,. chromaticities => 'float[8]',. compression => 'int8u',. double => 'double',. envmap => 'int8u',. float => 'float',. 'int' => 'int32s',. keycode => 'int32s[7]',. lineOrder => 'int8u',. m33f

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Opus.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	5.00321968886208
Encrypted:	false
SSDEEP:	24:TOyZEj31OY4F+QmYLDKIClPrr53UU/5ydK9vfddqvyFOlWosf/WpwH+bNYqyq0:G31OdF6YLDK5lPrr53UU/542OMoudYNk
MD5:	04C4790A945D0B3E4F033CA109DDEF0E
SHA1:	E75A7245869887286238FA677B30807E8CEE61D0
SHA-256:	6E1B17EBCDFA71844E47E9D87FAAAB5395A38D648EDDBEDD2BC502DD6EF8C95B
SHA-512:	E1B0B811A0A7B722150781565659F6120AC4CEADBD179CD25F8E4E1E27896A791ACB077F7E970163A7521AAF33CFB5D01354C544FD5917191157BEF9EB290876
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Opus.pm".#------------------------------------------------------------------------------.# File: Opus.pm.#.# Description: Read Ogg Opus audio meta information.#.# Revisions: 2016/07/14 - P. Harvey Created.#.# References: 1) https://www.opus-codec.org/docs/.# 2) https://wiki.xiph.org/OggOpus.# 3) https://tools.ietf.org/pdf/rfc7845.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Opus;..use strict;.use vars qw($VERSION);..$VERSION = '1.00';..# Opus metadata types.%Image::ExifTool::Opus::Main = (. NOTES => q{. Information extracted from Ogg Opus files. See. L<https://www.opus-codec.org/docs/> for the specification.. },. 'OpusHead' => {. Name => 'Header',. SubDirectory => { TagTable => 'Image::ExifTool::Opus::Header' },. },. 'OpusTags' => {. Name => 'Comments',. SubDirectory => { TagTable => 'Image::ExifTool

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PDF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	89572
Entropy (8bit):	4.653360225639407
Encrypted:	false
SSDEEP:	768:Y4S6JOTC/N+vF4venqFy3klxYOfjLMo7LrGsTcr1D9heryufvPPdIbaRYqS2bWyn:Kq7HyEY2jLMmXahDYF3PP1RYqpc5/xe
MD5:	C662792DDB64A4EEBCBE25615600AE32
SHA1:	FEACAB3B7B30DA9E7A544513CE2E0494E0367AE4
SHA-256:	9752BEFBB5999015D10807F98A1C644858972F42D3BE9B2CBA78BB1705B578D3
SHA-512:	9049CFCD1E3E92A835AA4D1E04923A4312937281BBC56EE329F7B0262C2388B682C3860A89B4E0D5E4734CEB707530270E3E8A5CFCACCE43B67CA7BADA2E4293
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PDF.pm".#------------------------------------------------------------------------------.# File: PDF.pm.#.# Description: Read PDF meta information.#.# Revisions: 07/11/2005 - P. Harvey Created.# 07/25/2005 - P. Harvey Add support for encrypted documents.#.# References: 1) http://www.adobe.com/devnet/pdf/pdf_reference.html.# 2) http://search.cpan.org/dist/Crypt-RC4/.# 3) http://www.adobe.com/devnet/acrobat/pdfs/PDF32000_2008.pdf.# 4) http://www.adobe.com/content/dam/Adobe/en/devnet/pdf/pdfs/adobe_supplement_iso32000.pdf.# 5) http://tools.ietf.org/search/rfc3454.# 6) http://www.armware.dk/RFC/rfc/rfc4013.html.#------------------------------------------------------------------------------..package Image::ExifTool::PDF;..use strict;.use vars qw($VERSION $AUTOLOAD $lastFetched);.use Image::ExifTool qw(:DataAccess :Utils);.require Exporter;..$VERSION = '1.46';..sub FetchOb

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PGF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	4.989633823947812
Encrypted:	false
SSDEEP:	96:CRYV6tfyY+se/yTrXZcSBv2O6zoIcG+ucGxBp5QW4:TiqL6OS0O6zoIc3uc475QW4
MD5:	1069BA8807151328B32AD08A62D323E5
SHA1:	8FA785788ADBDF2AA5E92EA14322D1FF13C243E7
SHA-256:	1CD7A904CF81298F235E0023BECF6F81456114374F3B6990344E42D434F070EB
SHA-512:	11EC9083A45F2678CC2A0EC006CBD191986ADA69106F342B65EB0B7B45F7777FD60A9183D7D36866C66647E64601380A7145C0D356FD162DE391B578398924C8
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PGF.pm".#------------------------------------------------------------------------------.# File: PGF.pm.#.# Description: Read Progressive Graphics File meta information.#.# Revisions: 2011/01/25 - P. Harvey Created.#.# References: 1) http://www.libpgf.org/.# 2) http://www.exiv2.org/.#------------------------------------------------------------------------------..package Image::ExifTool::PGF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..# PGF header information.%Image::ExifTool::PGF::Main = (. GROUPS => { 0 => 'File', 1 => 'File', 2 => 'Image' },. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. PRIORITY => 2, # (to take precedence over PNG tags from embedded image). NOTES => q{. The following table lists information extracted from the header of. Progressive Graphics File (PGF) images. As well, information is extracted. from the embedded PNG

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PICT.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	33187
Entropy (8bit):	4.5862110403604675
Encrypted:	false
SSDEEP:	768:2ieNLvyczvpfgwKjgKhFDQVHc8kHFnE8OjzNqmnCo7WMZwK3lzCgtSP9:+NLvycjpfgwKjgKhFDQVHc8kHFnE8OjM
MD5:	887EE6E0939213CD37FF3B57351777A2
SHA1:	5C1F82EABA8CEF0CCF26D01AC5F18359F6553718
SHA-256:	7AA51924ED792AF82C8A609E44DCBDAD5D791E1DE3C9069EF10F90F40FF288AD
SHA-512:	F66074539665645956A958FC941114CFF3ACE64203B7607479C5BC2CE9801CE2840181FDFA091DA15EAA1052FF6FA4D6564BB341C8D93C95730926C3C98DD572
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PICT.pm".#------------------------------------------------------------------------------.# File: PICT.pm.#.# Description: Read PICT meta information.#.# Revisions: 10/10/2005 - P. Harvey Created.#.# Notes: Extraction of PICT opcodes is still experimental.#.# - size difference in PixPat color table?? (imagemagick reads only 1 long per entry).# - other differences in the way imagemagick reads 16-bit images.#.# References: 1) http://developer.apple.com/documentation/mac/QuickDraw/QuickDraw-2.html.# 2) http://developer.apple.com/documentation/QuickTime/INMAC/QT/iqImageCompMgr.a.htm.#------------------------------------------------------------------------------..package Image::ExifTool::PICT;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.05';..sub ReadPictValue($$$;$);..my ($vers, $extended); # PICT version number, and extended flag.my ($verbose, $out, $indent); # used in verbose mod

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PLIST.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16480
Entropy (8bit):	4.791597060252251
Encrypted:	false
SSDEEP:	192:Hxe1Mpp++d70LDzmfnDHe3Zjv3it9D9WPhak7yyEDEQVA5pdchEV1iad0PptNP/7:R6Mg5NYnLaDADL1WY
MD5:	3A33BEF2F659000D08E460B505A3F9F2
SHA1:	ABDDCD855677EE1DAD29111F67C763F72AC28876
SHA-256:	86B86A93B2698E2749BFCC3D1944BD1D8C130E3E236955033B9EC1B813891F26
SHA-512:	8BFAF459E33DBFE88C366BB6B84A6B2B16E0BE9612A63F816720185673F8AD9A902E3D1A921715F3910071403D7C0C1B51E58A0F3C2C60EF045F649FCB4A284B
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PLIST.pm".#------------------------------------------------------------------------------.# File: PLIST.pm.#.# Description: Read Apple PLIST information.#.# Revisions: 2013-02-01 - P. Harvey Created.#.# References: 1) http://www.apple.com/DTDs/PropertyList-1.0.dtd.# 2) http://opensource.apple.com/source/CF/CF-550/CFBinaryPList.c.#.# Notes: - Sony MODD files also use XML PLIST format, but with a few quirks.#.# - Decodes both the binary and XML-based PLIST formats.#------------------------------------------------------------------------------..package Image::ExifTool::PLIST;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::XMP;.use Image::ExifTool::GPS;..$VERSION = '1.07';..sub ExtractObject($$;$);.sub Get24u($$);..# access routines to read various-sized integer/real values (add 0x100 to size for reals).my %readProc = (. 1 => \&Get8u,. 2 => \&Get16u,. 3 => \&G

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PLUS.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	150745
Entropy (8bit):	5.070303039716461
Encrypted:	false
SSDEEP:	1536:8gI8oBij2d2Lz7K56V5JwN9MxeHV0cj3JXpnMkRSMZUr2jF0VImPKNfYBqre/AhH:JI8oBij2d779NyzDW
MD5:	9A77B828C35AC04382B89C12B2082B81
SHA1:	C125CC0D337D12225C3FCD4DE98D0F547AC402CF
SHA-256:	6DD8D8218BE0B3B99FD462C005F3C4A77062590A696736462FC4AB688FBAC194
SHA-512:	B940C100A4059D6F7473A460C25469E7BD8DD4E73F376B10CC822C23F15D58730FF91E1258FD39A838F4C9F11D7D827DAACCBA9837EE588EAFD22EEE3E2069EB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PLUS.pm".#------------------------------------------------------------------------------.# File: PLUS.pm.#.# Description: PLUS (Picture Licensing Universal System) tags.#.# Revisions: 2016/05/18 - P. Harvey Created.#.# References: 1) http://www.useplus.com/useplus/standards.asp.#------------------------------------------------------------------------------..package Image::ExifTool::PLUS;..use strict;.use vars qw($VERSION);.use Image::ExifTool::XMP;..$VERSION = '1.00';..sub ValidateMediaSummary($);..#------------------------------------------------------------------------------.# PLUS (Picture Licensing Universal System)..# PLUS vocabulary conversions.my %plusVocab = (. ValueConv => '$val =~ s{http://ns.useplus.org/ldf/vocab/}{}; $val',. ValueConvInv => '"http://ns.useplus.org/ldf/vocab/$val"',.);..# PLUS License Data Format 1.2.1 structures.# (this seems crazy to me -- why did they define different ID/Name structures.# for each field rather

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PNG.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	54499
Entropy (8bit):	4.789256258305823
Encrypted:	false
SSDEEP:	768:MllUPyUyVKof+eKpHpXpI1OxzPBJf9geVb+TRXPBL08YtN15Q:MbUPGupaOxzj2Yb+TRXPBo7tN15Q
MD5:	6C651357D275B329CD62444BE74F0391
SHA1:	E33464C056BDCEA8F67ED22F5BA19F4C262093F6
SHA-256:	5DBD15ECA463555801CF0F3B6DA68ADC7098F665EE663B7EBD43F3628D5A0FBF
SHA-512:	92212241141865FCE4CF7B994DDE7A169E46A108F2543057EC02A1ADA09498D95C5018A1D09FF72735EA7CA1D9A0DCB521F807138E05786D83E40DA8CE7C8EA2
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PNG.pm".#------------------------------------------------------------------------------.# File: PNG.pm.#.# Description: Read and write PNG meta information.#.# Revisions: 06/10/2005 - P. Harvey Created.# 06/23/2005 - P. Harvey Added MNG and JNG support.# 09/16/2005 - P. Harvey Added write support.#.# References: 1) http://www.libpng.org/pub/png/spec/1.2/.# 2) http://www.faqs.org/docs/png/.# 3) http://www.libpng.org/pub/mng/.# 4) http://www.libpng.org/pub/png/spec/register/.# 5) ftp://ftp.simplesystems.org/pub/png/documents/pngext-1.4.0-pdg.html.#.# Notes: Writing meta information in PNG images is a pain in the butt.# for a number of reasons: One biggie is that you have to.# decompress then decode the ASCII/hex profile information before.# you can edit it, then you have to ASCII/hex-encode, recompress.#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PPM.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4311
Entropy (8bit):	4.776294663695082
Encrypted:	false
SSDEEP:	96:v0JDV6rXncOmBUBAisXkogcXynManwN/DqA+A6BY/8gglXf6QWW:qDadmiaisk3cynMawNbq1DG/TgAQWW
MD5:	46840BBE3110AB6DF9F6E708D271D6E1
SHA1:	7F8D5BCBDC304A4C68E652B3FE9CB281F4F552D9
SHA-256:	48FBDC9115359324F34DB41D546D929E6E9352F48B1B9F57FA42DC87F604F135
SHA-512:	FB25D818F652C9CA68412CD863001A87A81B16C6A613A617B3903F00B99A1FAABBA11DD0D1FE6F684D86EA095A724D98C4B355FABE451C26286AA419663A1960
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PPM.pm".#------------------------------------------------------------------------------.# File: PPM.pm.#.# Description: Read and write PPM meta information.#.# Revisions: 09/03/2005 - P. Harvey Created.#.# References: 1) http://netpbm.sourceforge.net/doc/ppm.html.# 2) http://netpbm.sourceforge.net/doc/pgm.html.# 3) http://netpbm.sourceforge.net/doc/pbm.html.#------------------------------------------------------------------------------..package Image::ExifTool::PPM;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.09';..#------------------------------------------------------------------------------.# Read or write information in a PPM/PGM/PBM image.# Inputs: 0) ExifTool object reference, 1) Directory information reference.# Returns: 1 on success, 0 if this wasn't a valid PPM file, -1 on write error.sub ProcessPPM($$).{. my ($et, $dirInfo) = @_;. my $raf = $$dirInfo{RAF}

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PSP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8630
Entropy (8bit):	4.787549153533155
Encrypted:	false
SSDEEP:	192:P0g6cfNPTK3tHAsUL7oB7ROtH1dQWLSgWFMnqFgQQ3QtWR:P0pcfNPT2OsUL7oH6dqq
MD5:	EE1EC2612D422C022826F8D8B4F30A3A
SHA1:	1479061CB69165F9C01B0495D4EF85CCD39D689F
SHA-256:	E3777353900DAAEBE83EE31544A8EF043431D78EBD52D32072117A0BE0049903
SHA-512:	AFBB5249CB0A3C95B338A99CAA3CE38C634BC43442003EEF1C075037BB94138F1EC92D1C05E6F361A0C67CEE88D775AB55E5610738437F0D76DFCAE90E0C530D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PSP.pm".#------------------------------------------------------------------------------.# File: PSP.pm.#.# Description: Read Paint Shop Pro meta information.#.# Revisions: 2010/01/23 - P. Harvey Created.#.# References: 1) http://www.jasc.com/support/kb/articles/pspspec.asp.#------------------------------------------------------------------------------..package Image::ExifTool::PSP;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.05';..sub ProcessExtData($$$);..# PSP info.%Image::ExifTool::PSP::Main = (. GROUPS => { 2 => 'Image' },. VARS => { ALPHA_FIRST => 1 },. NOTES => q{. Tags extracted from Paint Shop Pro images (PSP, PSPIMAGE, PSPFRAME,. PSPSHAPE, PSPTUBE and TUB extensions).. },. # FileVersions:. # 3.0 => PSP 5. # 4.0 => PSP 6. # 5.0 => PSP 7. # 6.0 => PSP 8. # 7.0 => PSP 9. # ? => PSP X. # ? => PSP X1 (is thi

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Palm.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11483
Entropy (8bit):	5.010408050974343
Encrypted:	false
SSDEEP:	192:OdXbE55cTWKp0PHcsz7ga79fwMy+1yH1LEQWES5dkqHIr6wo6Rm02O9fTyuq8JRo:OyqWW0PHc87ga79wMy+6Nq6mDyJm
MD5:	84005375A8B1A4456F05B9B369D9E443
SHA1:	D517D9FBB42CFD7EA9ADB64B359D52E9D6C1F0B7
SHA-256:	D4A59535459F6A7DD6B054A12DB0B584093CFDBBBD9CA12675E70F0DC4575B47
SHA-512:	57F22C0027126C7AA8D4F8E3245A3E7E1EA25E0C734641B0AA5D7EBA08EA91AD599BCA7003717F6D6419714B4A1766333A7E934C32B70513A5AF251E3EEC6E46
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Palm.pm".#------------------------------------------------------------------------------.# File: Palm.pm.#.# Description: Read Palm Database files.#.# Revisions: 2014/05/28 - P. Harvey Created.#.# References: 1) http://wiki.mobileread.com/wiki/PDB.# 2) http://wiki.mobileread.com/wiki/MOBI.#------------------------------------------------------------------------------..package Image::ExifTool::Palm;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.00';..sub ProcessEXTH($$$);..# type/creator ID's for Palm database files.my %palmTypes = (. '.pdfADBE' => 'Adobe Reader',. 'TEXtREAd' => 'PalmDOC',. 'BVokBDIC' => 'BDicty',. 'DB99DBOS' => 'DB (Database program)',. 'PNRdPPrs' => 'eReader',. 'DataPPrs' => 'eReader',. 'vIMGView' => 'FireViewer (ImageViewer)',. 'PmDBPmDB' => 'HanDBase',. 'InfoINDB' => 'InfoView',. 'ToGoToGo' => 'iSilo',. 'SDocSilX' => 'iSilo 3',. 'JbDbJ

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Panasonic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	85015
Entropy (8bit):	4.776604483516857
Encrypted:	false
SSDEEP:	1536:tt+YrgH1japL4y1yP/qm2P4TtSvCv/eCM8ZXb:NruFah4y1yPzuCv/eCBBb
MD5:	30458CE229798B9775FBBE6F8897612A
SHA1:	76B689ABBC850FB5411D8F1F615D2800AC14A23A
SHA-256:	9D8B824FF24AE61CD70B4A9905D8F2733A073567BA3E1AC49285DA482BAEC69F
SHA-512:	A54E95407ED224691CBEA9E12470CBB691612FFD8D2F955E42EBA6DE5C695E427609DDA182E86F2087626E9D8DE21EA2F28186B55218E6DE76FD2AF050A80685
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Panasonic.pm".#------------------------------------------------------------------------------.# File: Panasonic.pm.#.# Description: Panasonic/Leica maker notes tags.#.# Revisions: 11/10/2004 - P. Harvey Created.#.# References: 1) http://www.compton.nu/panasonic.html (based on FZ10).# 2) Derived from DMC-FZ3 samples from dpreview.com.# 3) http://johnst.org/sw/exiftags/.# 4) Tels (http://bloodgate.com/) private communication (tests with FZ5).# 7) http://homepage3.nifty.com/kamisaka/makernote/makernote_pana.htm (2007/10/02).# 8) Marcel Coenen private communication (DMC-FZ50).# 9) http://forums.dpreview.com/forums/read.asp?forum=1033&message=22756430.# 10) http://bretteville.com/pdfs/M8Metadata_v2.pdf.# 11) http://www.digital-leica.com/lens_codes/index.html.# (now https://www.l-camera-forum.com/leica-news/leica-lens-codes/).#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PanasonicRaw.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	24237
Entropy (8bit):	5.088316850431475
Encrypted:	false
SSDEEP:	384:5fVfRhpo3EHBwzo1ot9TxmDKaHFAtBNDfwdy+3CFc5:hVf/po30pHyC3Wc5
MD5:	74C335B133E36EA1129343363CEB6CBF
SHA1:	E8BBBC8B76A6149D7D2D10740DD674DCCF786D10
SHA-256:	5FA4C548C2E4B7833A97A967D3EFC1149B7B1018264E061551DD866CA154E9EA
SHA-512:	945EADA5D03B7E29621660982251D326F1817FA32F97299F9E7912C273764671BFCE632E0BE90237490C441937460BBCD7890B61BDC08AF863653EE158860A18
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PanasonicRaw.pm".#------------------------------------------------------------------------------.# File: PanasonicRaw.pm.#.# Description: Read/write Panasonic/Leica RAW/RW2/RWL meta information.#.# Revisions: 2009/03/24 - P. Harvey Created.# 2009/05/12 - PH Added RWL file type (same format as RW2).#.# References: 1) CPAN forum post by 'hardloaf' (http://www.cpanforum.com/threads/2183).# 2) http://www.cybercom.net/~dcoffin/dcraw/.# 3) http://syscall.eu/#pana.# 4) Klaus Homeister private communication.# IB) Iliah Borg private communication (LibRaw).# JD) Jens Duttke private communication (TZ3,FZ30,FZ50).#------------------------------------------------------------------------------..package Image::ExifTool::PanasonicRaw;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.15';..sub ProcessJpgFromRaw($

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Pentax.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	220941
Entropy (8bit):	4.788633595774112
Encrypted:	false
SSDEEP:	3072:mDCrJw5PvdWc6NPm0MQcQSeJ15UuYanF95VVKaK2lv3HTfYMkEpNBDRzrf7yMOA+:mDCtwxrQD8
MD5:	A38AC2FECC2D54041F1B022EAD1AA5C3
SHA1:	2EC970D8F731AA28D1EE02968BE1D5C024C789B2
SHA-256:	C4D5B2211344EF98E6728BB724CE8E2AEC11BAE840C2221CB65013D4E606C67F
SHA-512:	B2B89D41AF418BE6A0F1E78464FC59CD4FD6D7BC1ABFC009A3CE3420D6785D3928C935D0846CB45A52999B0F92A76423884C654F9AE78CBAA8E667D4941F0930
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Pentax.pm".#------------------------------------------------------------------------------.# File: Pentax.pm.#.# Description: Pentax/Asahi EXIF maker notes tags.#.# Revisions: 11/25/2003 - P. Harvey Created.# 02/10/2004 - P. Harvey Completely re-done.# 02/16/2004 - W. Smith Updated (see ref 3).# 11/10/2004 - P. Harvey Added support for Asahi cameras.# 01/10/2005 - P. Harvey Added LensType with values from ref 4.# 03/30/2005 - P. Harvey Added new tags from ref 5.# 10/04/2005 - P. Harvey Added MOV tags.# 10/22/2007 - P. Harvey Got my new K10D! (more new tags to decode).# 11/03/2010 - P. Harvey Got my new K-5! (a gold mine of new tags to discover!).#.# References: 1) Image::MakerNotes::Pentax.# 2) http://johnst.org/sw/exiftags/ (Asahi cameras).# 3) Wayne Smith private communication (Optio 550).# 4) h

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PhaseOne.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	25629
Entropy (8bit):	4.886318932124214
Encrypted:	false
SSDEEP:	384:Sk+njqNT4BG4x8Kpn+++RcuS8bnHwsFAnQllmlu7BfEiVDCuThNOxfa9NoixM:Sk8qNw/VXwcM7PinElm6EiVDCuN3nxM
MD5:	C50F704FDEBC4849F28894F952920647
SHA1:	1257414000498BABA3862520105EA8888FC0AD75
SHA-256:	55D9CAF22880FDB6AEC4A6190DC9F669945A9FE7380714CC530E41FD2FFCA099
SHA-512:	9AB632BB995579435A3861C30B8680429B9DF3D5F4FEC5DA31FC10FD34A061B10711E2CE4A18EA98C4E2040511F0BDE7CF2A11F2316B9354BAE49EA20E0B6795
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PhaseOne.pm".#------------------------------------------------------------------------------.# File: PhaseOne.pm.#.# Description: Phase One maker notes tags.#.# Revisions: 2013-02-17 - P. Harvey Created.#.# References: 1) http://www.cybercom.net/~dcoffin/dcraw/.#------------------------------------------------------------------------------..package Image::ExifTool::PhaseOne;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.04';..sub WritePhaseOne($$$);.sub ProcessPhaseOne($$$);..# default formats based on PhaseOne format size.my @formatName = ( undef, 'string', 'int16s', undef, 'int32s' );..# Phase One maker notes (ref PH).%Image::ExifTool::PhaseOne::Main = (. PROCESS_PROC => \&ProcessPhaseOne,. WRITE_PROC => \&WritePhaseOne,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. WRITABLE => '1',. FORMAT => 'int32s',. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PhotoCD.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	18155
Entropy (8bit):	4.626164422974357
Encrypted:	false
SSDEEP:	384:SmWo27HN7MJBwqq0oBKyXn+5kfGsnsKd7uYny:SmWo27tECLNy
MD5:	65247EDF3C4858ECE35B0EB86EF59490
SHA1:	FBDA33D7757555795F76114D8AB1C4A896F7124D
SHA-256:	1986BF878CA5048FD55A209AEED35F52DEEAB3D911AA2CAF40429E841A159E4F
SHA-512:	4249A74F2A236F1A10E2D65C65E4500F9F8257E39FAA5B50AA1FDD5F47598325CF696158DF3BAE4F7B4120EB67B53CA77A7F1C738096B2774EF15F95E9BCA565
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PhotoCD.pm".#------------------------------------------------------------------------------.# File: PhotoCD.pm.#.# Description: Read Kodak Photo CD Image Pac (PCD) metadata.#.# Revisions: 2012/05/07 - P. Harvey Created.#.# References: 1) http://pcdtojpeg.sourceforge.net/.#------------------------------------------------------------------------------..package Image::ExifTool::PhotoCD;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif; # (for Composite:ImageSize)..$VERSION = '1.01';..sub ProcessExtData($$$);..# PhotoCD info.%Image::ExifTool::PhotoCD::Main = (. PROCESS_PROC => \&Image::ExifTool::ProcessBinaryData,. GROUPS => { 2 => 'Image' },. NOTES => 'Tags extracted from Kodak Photo CD Image Pac (PCD) files.',. 7 => {. Name => 'SpecificationVersion',. Format => 'int8u[2]',. RawConv => '$val eq "255 255" ? "n/a" : $val',. ValueConv => '$val =~ tr/ /./; $v

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PhotoMechanic.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7468
Entropy (8bit):	4.94300165413707
Encrypted:	false
SSDEEP:	96:d+CV5i4awPUcPJ9jZx7uWin06S4EW+XuVefCBICRdB0Rn6l+GQ7vcVyx8zPxQyT:ddpPVh9b7zAEWFA6WodEa+GVy6zPxQyT
MD5:	079FE8E7D32A34E09D187ECBA41EA954
SHA1:	FDF88C864933312BAC353C9A929E7DFFA0BDADB1
SHA-256:	5250313B5BA4DDEA0E55082A7C165D6DF4CD45D527A8E5FCBA27007166A473AE
SHA-512:	66FEF7A25F8001ACCF0569A497B431E753D62C606F35A4DCC733DDD051811358ED0959EDED47A6EC996F49D1F287ED75248A08A7847C7EF1E6EC429CF8EC9874
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PhotoMechanic.pm".#------------------------------------------------------------------------------.# File: PhotoMechanic.pm.#.# Description: Read/write Camera Bits Photo Mechanic information.#.# Revisions: 10/28/2006 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::PhotoMechanic;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;.use Image::ExifTool::IPTC;.use Image::ExifTool::XMP;..$VERSION = '1.05';..sub ProcessPhotoMechanic($$);..# color class names.my %colorClasses = (. 0 => '0 (None)',. 1 => '1 (Winner)',. 2 => '2 (Winner alt)',. 3 => '3 (Superior)',. 4 => '4 (Superior alt)',. 5 => '5 (Typical)',. 6 => '6 (Typical alt)',. 7 => '7 (Extras)',. 8 => '8 (Trash)',.);..# main tag table IPTC-format records in PhotoMechanic trailer.%Image::ExifTool::PhotoMechanic::Main = (. GROUPS => { 2 => 'Im

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Photoshop.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	36067
Entropy (8bit):	4.855979140904276
Encrypted:	false
SSDEEP:	384:fs+hMzeujc6T61a+iKqxdk5NpqZC6KUqZOQlGVPxskkIOtENJLl58K2:fs1eSpsJI2EvLEK2
MD5:	59C4746186D1DB456C9356F511755E2B
SHA1:	3F7284A87F4C3D64F190D6DE5C4C3295C898B388
SHA-256:	4261E8BA024BB6901FCF48539F94C71FAD535A2D3686AB5D0A4EC1540301E1CF
SHA-512:	6404D557338871ECFCEDC4A55649569016A07314CF88B5DB258EEC0082C23EA6CFA6208EA7516C7D8002C6C74594607B9747C5F19D258B4CF76094B11CDE5C9C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Photoshop.pm".#------------------------------------------------------------------------------.# File: Photoshop.pm.#.# Description: Read/write Photoshop IRB meta information.#.# Revisions: 02/06/2004 - P. Harvey Created.# 02/25/2004 - P. Harvey Added hack for problem with old photoshops.# 10/04/2004 - P. Harvey Added a bunch of tags (ref Image::MetaData::JPEG).# but left most of them commented out until I have enough.# information to write PrintConv routines for them to.# display something useful.# 07/08/2005 - P. Harvey Added support for reading PSD files.# 01/07/2006 - P. Harvey Added PSD write support.# 11/04/2006 - P. Harvey Added handling of resource name.#.# References: 1) http://www.fine-view.com/jp/lab/doc/ps6ffspecsv2.pdf.# 2) http://www.ozhiker.com/electronics/pjmt/jpeg_info/i

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PostScript.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	26179
Entropy (8bit):	4.580461548774336
Encrypted:	false
SSDEEP:	384:IfQPyCMY0RxezO+bOK+JgEerYxTrKzZO93xFyjrb56r/PKTNWhOJ6rBMcVelJD8s:If/Laylj6W3LyjzQhOJSMcblkh9l
MD5:	41C62F32A6AF336F7395E6DDDADD33A8
SHA1:	C36453F25488D272AFA052A31F5F2367BF051B40
SHA-256:	E97C085F1404FDCB26EE6379A2BDB00470223F45611E0D3025480F22DBB4F731
SHA-512:	A7D16F6BB4DEC8225C0FBA209A123BCEB612C8E0B8C4D5EBBDB352D56C1B00CF3D2DE8BA09F2E2B01DFDF83C6210932B69846C771FD8A8DD0D2FC2C58B9646FA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PostScript.pm".#------------------------------------------------------------------------------.# File: PostScript.pm.#.# Description: Read PostScript meta information.#.# Revisions: 07/08/2005 - P. Harvey Created.#.# References: 1) http://partners.adobe.com/public/developer/en/ps/5002.EPSF_Spec.pdf.# 2) http://partners.adobe.com/public/developer/en/ps/5001.DSC_Spec.pdf.# 3) http://partners.adobe.com/public/developer/en/illustrator/sdk/AI7FileFormat.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::PostScript;..use strict;.use vars qw($VERSION $AUTOLOAD);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.43';..sub WritePS($$);.sub ProcessPS($$;$);..# PostScript tag table.%Image::ExifTool::PostScript::Main = (. PROCESS_PROC => \&ProcessPS,. WRITE_PROC => \&WritePS,. PREFERRED => 1, # always add these tags when writing. GROUPS => { 2 => 'Image'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\PrintIM.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	4.925272096986902
Encrypted:	false
SSDEEP:	48:cuWMBjj3Hr5JUbY2HYBoQJIcZEzeIiVm+J9Uf20WkhY5t6T0dQo/sFigVBvpeZWn:zBf3HVJ0zlm9KY5oorSiLQQWv
MD5:	CCD552EF26DA564AEC00E3BBD1109593
SHA1:	63B47749A4ADC90C9F0FB675249BC5A4E3063237
SHA-256:	F213538DEBB35B84CC8AAB932CC62C9C983FC28FF2FCE563861C7D1234CED3C0
SHA-512:	1467A1FD42411D937F41542AAF3652B5E55D0F9D2D6286B0E3FC64F2913184FA95A52D15FD9BA49B1340597CEC12EE2D7AD2007D90C8F7B5EC059DCB4F3ADC21
Malicious:	false
Preview:	#line 1 "Image/ExifTool/PrintIM.pm".#------------------------------------------------------------------------------.# File: PrintIM.pm.#.# Description: Read PrintIM meta information.#.# Revisions: 04/07/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::PrintIM;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess);..$VERSION = '1.07';..sub ProcessPrintIM($$$);..# PrintIM table (proprietary specification by Epson).%Image::ExifTool::PrintIM::Main = (. PROCESS_PROC => \&ProcessPrintIM,. GROUPS => { 0 => 'PrintIM', 1 => 'PrintIM', 2 => 'Printing' },. PRINT_CONV => 'sprintf("0x%.8x", $val)',. TAG_PREFIX => 'PrintIM',. PrintIMVersion => { # values: 0100, 0250, 0260, 0300. Description => 'PrintIM Version',. PrintConv => undef,. },. # the following names are from http://www.kanzaki.com/ns/exif. # but the decoding is unknown:. # 9 => { Name =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Qualcomm.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	43911
Entropy (8bit):	4.764483359108986
Encrypted:	false
SSDEEP:	384:jsHny5Yf3eFU7XTrm4Y46Wn9jLB7R37Vdf9n7z9Z3ZfG+zQbRvPB:jsHnt6WM+aRvJ
MD5:	731CC1FF4BFC5437AD1F6D22588A6B46
SHA1:	86524ED0789BD6A41F7394B4682EB03262484587
SHA-256:	D23BD7CC87A577A81CA38EB15D4881E12043F4DA07BAE687A19D457F39950888
SHA-512:	CBAD504445456AA7FD5A4A441234F6C0A980FEA13CE7432F226E3AEF2F3BDE8B4C24A8C0F7706DBDBD3E26077EBA2CDABC377637A8B6E1B5528A7E2F97C6B889
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Qualcomm.pm".#------------------------------------------------------------------------------.# File: Qualcomm.pm.#.# Description: Read Qualcomm APP7 meta information.#.# Revisions: 2012/02/14 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Qualcomm;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.01';..sub ProcessQualcomm($$$);.sub MakeNameAndDesc($$);..# Qualcomm format codes (ref PH (NC)).my @qualcommFormat = (. 'int8u', 'int8s', 'int16u', 'int16s',. 'int32u', 'int32s', 'float', 'double',.);..# information found in JPEG APP7 Qualcomm Camera Attributes segment.%Image::ExifTool::Qualcomm::Main = (. PROCESS_PROC => \&ProcessQualcomm,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. VARS => { NO_ID => 1, NO_LOOKUP => 1 }, # too long, too many, and too obscure. NOTES => q{. The tags below h

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\QuickTime.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	342073
Entropy (8bit):	4.9036189816570666
Encrypted:	false
SSDEEP:	3072:f73ax+xtbf7hcwq9U8RqcHphw9vMKu0iLadevbAijqos115m5PmeY8qgyEU8NOm2:Ox+rbfSPZ8gS8N/KOLh4p
MD5:	90EDF41B8DF83D55764F7251072B356C
SHA1:	ADDBCC84FCFFD6FE7C3CCB50561BF8FF5EF73DD9
SHA-256:	02A32E7DCFC50D34190DE46EDE76D214431DE8494D5D14AFB228673AFDA14667
SHA-512:	38BBB9853124BDF2699F4B01D58543A20009BCFF4BEB62C2C549D188BC9059847151D25A01B3AD67488498D7FFA730AB951CDF8EBFF26B21E5BD644CE845CFFB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/QuickTime.pm".#------------------------------------------------------------------------------.# File: QuickTime.pm.#.# Description: Read QuickTime and MP4 meta information.#.# Revisions: 10/04/2005 - P. Harvey Created.# 12/19/2005 - P. Harvey Added MP4 support.# 09/22/2006 - P. Harvey Added M4A support.# 07/27/2010 - P. Harvey Updated to 2010-05-03 QuickTime spec.#.# References:.#.# 1) http://developer.apple.com/mac/library/documentation/QuickTime/QTFF/QTFFChap1/qtff1.html.# 2) http://search.cpan.org/dist/MP4-Info-1.04/.# 3) http://www.geocities.com/xhelmboyx/quicktime/formats/mp4-layout.txt.# 4) http://wiki.multimedia.cx/index.php?title=Apple_QuickTime.# 5) ISO 14496-12 (http://read.pudn.com/downloads64/ebook/226547/ISO_base_media_file_format.pdf).# 6) ISO 14496-16 (http://www.iec-normen.de/previewpdf/info_isoiec14496-16%7Bed2.0%7Den.pdf).# 7) http://atomicparsley.sourceforge.net/mpeg-4files.ht

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\QuickTimeStream.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	40391
Entropy (8bit):	4.749772624883574
Encrypted:	false
SSDEEP:	768:LohyJVXemIF3sy62BVQJ1qYYLMj03qZiKTa5QBUaaRTD0xYgzKJgNxoM:CyzXemIF42BWJ1qYYLMjOqve5bRTDqN5
MD5:	E612A52799FBDB1D483776F59A98E0CB
SHA1:	7B13D2E0357E4809B496E3E195C6706D581808B1
SHA-256:	046D63F69159AECC26F9279AF07BEF7351DC3C3EF0B083A23194FB08E16469DC
SHA-512:	F26D709F18833F157D64136C7901CE783CA2548929D27E7AE1A5C00DA1F05EFAC193F551758C81ACC90587C89CAD3E29A407DCFB638D891A767E46007C1AEEF6
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: QuickTimeStream.pl.#.# Description: Extract embedded information from QuickTime movie data.#.# Revisions: 2018-01-03 - P. Harvey Created.#.# References: 1) https://developer.apple.com/library/content/documentation/QuickTime/QTFF/QTFFChap3/qtff3.html#//apple_ref/doc/uid/TP40000939-CH205-SW130.# 2) http://sergei.nz/files/nvtk_mp42gpx.py.# 3) https://forum.flitsservice.nl/dashcam-info/dod-ls460w-gps-data-uit-mov-bestand-lezen-t87926.html.#------------------------------------------------------------------------------.package Image::ExifTool::QuickTime;..use strict;..# QuickTime data types that have ExifTool equivalents.# (ref https://developer.apple.com/library/content/documentation/QuickTime/QTFF/Metadata/Metadata.html#//apple_ref/doc/uid/TP40000939-CH1-SW35).my %qtFmt = (. 0 => 'undef',. 1 => 'string', # (UTF-8). # 2 - UTF-16. # 3 - shift-JIS. #

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\README

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63268
Entropy (8bit):	4.228922263968103
Encrypted:	false
SSDEEP:	768:rEHIzRjtyCMPp4vw3v9nCdvxkhGH8Mm3U5v0Ewl2tUKeJLTfR:rEDtP2vw3v9EWVMZyG4bR
MD5:	2C0AF146452A461DF7D08F20AD5DF665
SHA1:	38F385707C936AE116148EBDBAD9CFF952CD4747
SHA-256:	F82070E5F75064AE384FDE7FA97D78A712E2D6C66DA72D20609665BABA52B7F3
SHA-512:	745EB3E54E8AAE4B351ECE9681B899382344EA78F69E05CD9FE79BCC8F3F03652929A106CC29CF5A7AEE52EFE7BAC220A4A9915583116C4C6EDDEC49E9064747
Malicious:	false
Preview:	--------------------------------------------------------------------------------.File: Image/ExifTool/README..Description: ExifTool support modules documentation..The ExifTool support modules are loaded by ExifTool to allow processing of.various meta information formats...The tables in these files are used as lookups based on the tag ID values. The.hash keys are the tag IDs (in decimal or hexadecimal if the ID is numerical as.with EXIF tables, or the tag name if the ID is ASCII as with XMP tables). In.the case of a BinaryData table, the IDs are numerical and specify offsets into.the binary data block (floating point IDs allow multiple tags for the same.offset, with the integer part being used for the offset). The corresponding.hash value provides information about the tag (explained later)...Twenty-six special keys (TABLE_NAME, SHORT_NAME, PROCESS_PROC, WRITE_PROC,.CHECK_PROC, GROUPS, FORMAT, FIRST_ENTRY, TAG_PREFIX, PRINT_CONV, WRITABLE,.TABLE_DESC, NOTES, IS_OFFSET, IS_SU

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\RIFF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	58027
Entropy (8bit):	5.046454997057566
Encrypted:	false
SSDEEP:	768:V+sgSz5MYwHX0EH5ioeSSfOVkrQMAXr9+sHbRzCRwDVgKLb1Adwhnt3reDYQ9:V+gLKnH5iouvq5HbRjNP1AdCFreDYI
MD5:	40159A9C825F9D8744597C24202A43DF
SHA1:	37266420ECF144DA39783877D1B14A5C191FD5DA
SHA-256:	5467B42636874B838F776B0C7DD45EFA093BF34B2513FC19D69301BD19F0291A
SHA-512:	A99BE3ACBBAADD7291925F83F06D78CFEE81289165D039A0B76F17458B3D94A3BC1E486965F5A00BD6069041250DF604DF2AF01F09108BE2A01BA809AA14AD87
Malicious:	false
Preview:	#line 1 "Image/ExifTool/RIFF.pm".#------------------------------------------------------------------------------.# File: RIFF.pm.#.# Description: Read RIFF/AVI/WAV meta information.#.# Revisions: 09/14/2005 - P. Harvey Created.# 06/28/2017 - PH Added MBWF/RF64 support.#.# References: 1) http://www.exif.org/Exif2-2.PDF.# 2) http://www.vlsi.fi/datasheets/vs1011.pdf.# 3) http://www.music-center.com.br/spec_rif.htm.# 4) http://www.codeproject.com/audio/wavefiles.asp.# 5) http://msdn.microsoft.com/archive/en-us/directx9_c/directx/htm/avirifffilereference.asp.# 6) http://research.microsoft.com/invisible/tests/riff.h.htm.# 7) http://www.onicos.com/staff/iz/formats/wav.html.# 8) http://graphics.cs.uni-sb.de/NMM/dist-0.9.1/Docs/Doxygen/html/mmreg_8h-source.html.# 9) http://developers.videolan.org/vlc/vlc/doc/doxygen/html/codecs_8h-source.html.#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\RSRC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8960
Entropy (8bit):	4.671242860054458
Encrypted:	false
SSDEEP:	192:hCq2JoQNbSIgfV5SlFr8HOTCqkCWIQ3RpKAjv5iN9T16diQWL:4q2+Qh80gdRokiN9TD
MD5:	EBAA1B6CD484CD067BE4AF51636EF9D5
SHA1:	B1ACB9483D3B49AEE33555106F8F91486C9D9B44
SHA-256:	8EE2B0EB5C8849B18E18FE876263AB62C14211589B71A5685DB705A16C2F5488
SHA-512:	DCAC37B01391CC6A95A400F75243C695E9E7A5C14A56A8F3A22430E1BBC62A9FC17A1746AC6AD1BBC1395B6C6BF17649A242AEDFF37A5552D44A5561E6A39CE4
Malicious:	false
Preview:	#line 1 "Image/ExifTool/RSRC.pm".#------------------------------------------------------------------------------.# File: RSRC.pm.#.# Description: Read Mac OS Resource information.#.# Revisions: 2010/03/17 - P. Harvey Created.#.# References: 1) http://developer.apple.com/legacy/mac/library/documentation/mac/MoreToolbox/MoreToolbox-99.html.#------------------------------------------------------------------------------..package Image::ExifTool::RSRC;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.08';..# Information decoded from Mac OS resources.%Image::ExifTool::RSRC::Main = (. GROUPS => { 2 => 'Document' },. NOTES => q{. Tags extracted from Mac OS resource files and DFONT files. These tags may. also be extracted from the resource fork of any file in OS X, either by. adding "/..namedfork/rsrc" to the filename to process the resource fork. alone, or by using the ExtractEmbedded (-ee) option to

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\RTF.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	12676
Entropy (8bit):	4.740066986367413
Encrypted:	false
SSDEEP:	384:tjW2BVmYdEo3M7dL3TWdhjx/HTc/uCx2L5G/H:tjW1o87dL3TWdhjx/HTc//x2FG/H
MD5:	32DD4EA72B4B77B7C1C8F4F19A0F82B6
SHA1:	D90F0B8CB979D3C122D4E5F443C958E9EE6D0BB7
SHA-256:	7E7C500BA96C2E62B0304F65E43AA1379D578AF76449EA746E2A1FB156BFAE32
SHA-512:	631B7F883E288E1F809AE73FE3A597BB1BCD344360CC087757A83E4539ACD2B273D3C9F2F870434ECAAE58CA8674D68E66BDD7D0E89DAEB6D8D20007FF3E872D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/RTF.pm".#------------------------------------------------------------------------------.# File: RTF.pm.#.# Description: Read Rich Text Format meta information.#.# Revisions: 2010/06/17 - P. Harvey Created.#.# References: 1) http://download.microsoft.com/download/2/f/5/2f599e18-07ee-4ec5-a1e7-f4e6a9423592/Word2007RTFSpec9.doc.# 2) http://search.cpan.org/dist/RTF-Writer/lib/RTF/Cookbook.pod.#------------------------------------------------------------------------------..package Image::ExifTool::RTF;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.02';..sub ProcessUserProps($$$);..# supported RTF character entities.my %rtfEntity = (. par => 0x0a,. tab => 0x09,. endash => 0x2013,. emdash => 0x2014,. lquote => 0x2018,. rquote => 0x2019,. ldblquote => 0x201c,. rdblquote => 0x201d,. bullet => 0x2022,.);..# RTF tags (ref 1).%Image::ExifTool::R

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Radiance.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3721
Entropy (8bit):	4.949332490185804
Encrypted:	false
SSDEEP:	96:5xlL0biqV6hGunL0b/QPB6XzkDVGyf31EN8etfh9tQWt:RopCocWiQyGN8etfdQWt
MD5:	CBA5919B196FA258A51E5B3866AA80A4
SHA1:	B34F86A6615EC1947A9E8584D99475F8C96F293C
SHA-256:	6FC5DC4B217D1D0D57755DD9A83C162E5AA487DAD13D585FE76319732B6310BE
SHA-512:	7DCCE591356FB5C7BDBB1B9788923AB71CCBD73B9724A30297F4E8D748D6CEFD34570696E988D6CF4999919C58993D0D1A0D6AD5F5072D2A3E3F05C6E89ADAE5
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Radiance.pm".#------------------------------------------------------------------------------.# File: Radiance.pm.#.# Description: Read Radiance RGBE HDR meta information.#.# Revisions: 2011/12/10 - P. Harvey Created.#.# References: 1) http://www.graphics.cornell.edu/online/formats/rgbe/.# 2) http://radsite.lbl.gov/radiance/refer/filefmts.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Radiance;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.01';..# Radiance tags.%Image::ExifTool::Radiance::Main = (. GROUPS => { 2 => 'Image' },. NOTES => q{. Information extracted from Radiance RGBE HDR images. Tag ID's are all. uppercase as stored in the file, but converted to lowercase by when. extracting to avoid conflicts with internal ExifTool variables. See. L<http://radsite.lbl.gov/radiance/refer/filefm

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Rawzor.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5677
Entropy (8bit):	4.964094494847251
Encrypted:	false
SSDEEP:	96:MtBKV6++doPXqvTPyBT+ovG+E6U16CSW62BPgP1PvPHNgBTv6WmHBO23KGCK4zSi:qKJbEqJvNE6w6CSW6m4tXCZ6BHM23KGC
MD5:	E7C56A1A3B3436108E9D6992A212FAA1
SHA1:	086CBF0DAD11C05674B545FE93DC569724E28560
SHA-256:	33CA66C5B8B5A5B3EEA287ECEDD95227397CEF359E5232569FA49232894DFB54
SHA-512:	5BB50536F3A2A21FC2523E8595BF6DF83C77AF448EA58FE771EDF99191F239F98193F44F982057FB0E35D74010B6AC765F04C0CAF05DE157CF516CD7F03051AB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Rawzor.pm".#------------------------------------------------------------------------------.# File: Rawzor.pm.#.# Description: Read meta information from Rawzor compressed images.#.# Revisions: 09/09/2008 - P. Harvey Created.#.# References: 1) http://www.rawzor.com/.#------------------------------------------------------------------------------..package Image::ExifTool::Rawzor;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.04';..# currently support this version Rawzor images.my $implementedRawzorVersion = 199; # (up to version 1.99)..# Rawzor-specific tags.%Image::ExifTool::Rawzor::Main = (. GROUPS => { 2 => 'Other' },. VARS => { NO_ID => 1 },. NOTES => q{. Rawzor files store compressed images of other formats. As well as the. information listed below, exiftool uncompresses and extracts the meta. information from the original image.. },. OriginalFileType => { },.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Real.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	26591
Entropy (8bit):	4.844792635535805
Encrypted:	false
SSDEEP:	384:stbwuIgpsp7Tw14yghXPZ+vYVR1HqbCRR+sDR8ZCG8Qs6o1CnG6U4vLxO:a0ngpspzl/Z7Vf8gR+sDR8cG8J1CrvdO
MD5:	2279D1B52733604766AD21EFA68AB0DD
SHA1:	E433A6CA0498DBAD806CEFBFF1713CEA039D9319
SHA-256:	F88A6B44AC899CA3C7DF13C59F329B0A80DC9941CC0D666D4F22C7C62C36669D
SHA-512:	2A459DD64FAB7CB8C2B53124C4D2D59582314E93DDD7918F56F317819AC57BC1B8EF1B89FB5CBCD3A0D749C6BE1AC72351F708E287CD5E9D988B6502E65EF135
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Real.pm".#------------------------------------------------------------------------------.# File: Real.pm.#.# Description: Read Real audio/video meta information.#.# Revisions: 05/16/2006 - P. Harvey Created.#.# References: 1) http://www.getid3.org/.# 2) https://common.helixcommunity.org/nonav/2003/HCS_SDK_r5/htmfiles/rmff.htm.#------------------------------------------------------------------------------..package Image::ExifTool::Real;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Canon;..$VERSION = '1.06';..sub ProcessRealMeta($$$);.sub ProcessRealProperties($$$);..# Real property types (ref PH).my %propertyType = (. 0 => 'int32u',. 2 => 'string',.);..# Real Metadata property types.my %metadataFormat = (. 1 => 'string', # text. 2 => 'string', # text list. 3 => 'flag', # 1 or 4 byte integer. 4 => 'int32u', # 4-byte integer. 5 => 'undef', # binary data.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Reconyx.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9153
Entropy (8bit):	4.81701803857474
Encrypted:	false
SSDEEP:	96:zGzLGfLGaV3djgovm7l+gf3hD784cDCOBFA51Oh0zg6578VYDxKCf:0m1dWJRqOvOh0V2n0
MD5:	8607B4F4076317B0E46110013E6DC9A9
SHA1:	54C0DF817858AFF493039768CFC39A5ED809EB88
SHA-256:	4B6503BE2504619A22B2188820F8DF6A1E8C7D9E3A13EE9320CABFE84A8EB0FF
SHA-512:	ED2DCE0ACED62D1858AC3217A6FDE8AE9F6A885932DAB5DB8AB40C538722F8E12E68EC98353265A825BFE7AD3D4151116EB32CD65E66934B3E3FCA5AA0F9F75C
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Reconyx.pm".#------------------------------------------------------------------------------.# File: Reconyx.pm.#.# Description: Reconyx maker notes tags.#.# Revisions: 2011-01-11 - P. Harvey Created.#.# References: 1) RCNX_MN10.pdf (courtesy of Reconyx Inc.).# 2) ultrafire_makernote.pdf (courtesy of Reconyx Inc.).#------------------------------------------------------------------------------..package Image::ExifTool::Reconyx;..use strict;.use vars qw($VERSION);..$VERSION = '1.05';..# info for Type2 version tags.my %versionInfo = (. Format => 'undef[7]',. ValueConv => 'sprintf("V%.2x.%.2x %.4x:%.2x:%.2x Rev.%s", unpack("CCvCCa", $val))',. ValueConvInv => q{. my @v = $val =~ /^V([0-9a-f]+)\.([0-9a-f]+) (\d{4}):(\d{2}):(\d{2})\s*Rev\.(\w)/i or return undef;. pack('CCvCCa', map(hex, @v[0..4]), $v[5]);. },.);..# maker notes for Reconyx Hyperfire cameras (ref PH).%Image::ExifTool::Reconyx::Main = (. GROUPS => {

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Red.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10492
Entropy (8bit):	5.064425807379703
Encrypted:	false
SSDEEP:	192:B5rM+YqQcjZsdLrW+PXYzSRA8E/54rYZp4SJ18kOYW8:B+cjZstL042f
MD5:	BA0F5C016EE37967BFBFB888148E879C
SHA1:	01CD31055F9C40C9B58228D19BDF5D09C5C0B2AB
SHA-256:	93AE2AE0A8C3B9B228616D8301EA1826E2D31C65C6FF8965727CA10DC2787D47
SHA-512:	9D931C1C544A53C3541E759239702FE829F516EB2EC71DAE8B64227AB956B3B24A4A27BB2D8411E8EB8A6839ECDD387BD8363AC05A3E71B732E6F72F2838D760
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Red.pm".#------------------------------------------------------------------------------.# File: Red.pm.#.# Description: Read Redcode R3D video files.#.# Revisions: 2018-01-25 - P. Harvey Created.#.# References: 1) http://www.wikiwand.com/en/REDCODE.#------------------------------------------------------------------------------..package Image::ExifTool::Red;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.01';..sub ProcessR3D($$);..# RED format codes (ref PH).my %redFormat = (. 0 => 'int8u',. 1 => 'string',. 2 => 'float',. 3 => 'int8u', # (how is this different than 0?). 4 => 'int16u',. 5 => 'int8s', # (not sure about this). 6 => 'int32s',. 7 => 'undef', # (mixed-format structure?). 8 => 'int32u', # (NC). 9 => 'undef', # ? (seen 256 bytes, all zero).);..# error strings.my $errTrunc = 'Truncated R3D file';..# RED directory tags (ref PH).%Image::ExifTool::Red::Main =

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Ricoh.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	36556
Entropy (8bit):	4.755471901321462
Encrypted:	false
SSDEEP:	384:LKc2HalAlQKzCyXIH8H8kKEI2QbIFq/fizfR6ZCcnMtR+mWsGZygh9CoSHxzDHI/:Gc2H5QSq/fiTR6ZXcVLWl9CoSH5cj
MD5:	ACF2BDB477A8E85D58F53759B14F8D94
SHA1:	7F5C5C9D89D44F3841BBEFBE7E07802F1A2F4192
SHA-256:	8A9AD95B5CD6BDCDB72BA36C666E0A11E7B80B052C26CF15C63614372C2A8533
SHA-512:	477339429E93B9A8F89BB59548AA35FBB2241DB30C271025898A6B5D844C82E2E1A26995D8A7D7F284C84FADCCEE75FF40DA73B3A983452E5DED2B8111B8C800
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Ricoh.pm".#------------------------------------------------------------------------------.# File: Ricoh.pm.#.# Description: Ricoh EXIF maker notes tags.#.# Revisions: 03/28/2005 - P. Harvey Created.#.# References: 1) http://www.ozhiker.com/electronics/pjmt/jpeg_info/ricoh_mn.html.# 2) http://homepage3.nifty.com/kamisaka/makernote/makernote_ricoh.htm.# 3) Tim Gray private communication (GR).# 4) https://github.com/atotto/ricoh-theta-tools/.# IB) Iliah Borg private communication (LibRaw).#------------------------------------------------------------------------------..package Image::ExifTool::Ricoh;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.33';..sub ProcessRicohText($$$);.sub ProcessRicohRMETA($$$);..# lens types for Ricoh GXR.my %ricohLensIDs = (. Notes => q{. Lens units available for the GXR, used by the

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Samsung.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	47940
Entropy (8bit):	4.981932055363422
Encrypted:	false
SSDEEP:	384:bq/CWV4z8t7ivEGIB2EViO3RK3KVKBUhYqw25oL1NkLcLvKZDrLWL78RJC7h:bqpq/EG42E/8qjSLPEcLCD/WL7g8
MD5:	07DE2D0F823C116C9728848901B2C027
SHA1:	C00109C63EE78C3BA99B819FDA504780BAC76341
SHA-256:	3059B554FDACC6038A709134F3C1BC4D9DBB3C82F70F5B9FDF134729655A1F7E
SHA-512:	3CBE1603C94FE726D4CEE53BF6162C62FFF1051BB3B425F6A8F53098FCB821B78D8019C69A318E4122972F72EE6EBC77174BCA2A4212EC11DCCB570057DF8288
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Samsung.pm".#------------------------------------------------------------------------------.# File: Samsung.pm.#.# Description: Samsung EXIF maker notes tags.#.# Revisions: 2010/03/01 - P. Harvey Created.#.# References: 1) Tae-Sun Park private communication.# 2) http://www.cybercom.net/~dcoffin/dcraw/.# 3) Pascal de Bruijn private communication (NX100).# 4) Jaroslav Stepanek via rt.cpan.org.# 5) Nick Livchits private communication.# 6) Sreerag Raghavan private communication (SM-C200).# IB) Iliah Borg private communcation (LibRaw).# NJ) Niels Kristian Bech Jensen private communication.#------------------------------------------------------------------------------..package Image::ExifTool::Samsung;..use strict;.use vars qw($VERSION %samsungLensTypes);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.41';..sub WriteSTM

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Sanyo.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	11484
Entropy (8bit):	4.703438221215791
Encrypted:	false
SSDEEP:	96:113TVw9O2oJbvdkknvpQs6/vNvY9JxdfzGZHP9z9RmM9Rm7x++sK68Yq:zTQOTJbFxv4Nv+xdkQ4ANx
MD5:	8FCA01EE031D5DAD6ABAECD7DCD23D7A
SHA1:	94721EC5D660FA86A9737ADC43139A3D5B5C51E1
SHA-256:	75CA3F0419324EB4316917391EF4E292C3C9CC7663A6A5539C4B75F488FA22C9
SHA-512:	8C09BAFDC1DEDDA39E11F66952D82A25D8CD7B86FE40ABFCA4A475849CAC75BC7FDA63F33AB03E8D58EEC409299E8AE6701DDDF11E0B27756F15FF08E8183FC3
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Sanyo.pm".#------------------------------------------------------------------------------.# File: Sanyo.pm.#.# Description: Sanyo EXIF maker notes tags.#.# Revisions: 04/06/2004 - P. Harvey Created.#.# Reference: http://www.exif.org/makernotes/SanyoMakerNote.html.#------------------------------------------------------------------------------..package Image::ExifTool::Sanyo;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;..$VERSION = '1.16';..my %offOn = (. 0 => 'Off',. 1 => 'On',.);..%Image::ExifTool::Sanyo::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. WRITABLE => 1,. GROUPS => { 0 => 'MakerNotes', 2 => 'Camera' },. 0x00ff => {. # this is an absolute offset in the JPG file... odd - PH. Name => 'MakerNoteOffset',. Writable => 'int32u',. },. 0x0100 => {. Name => 'SanyoThumbnail',. Groups => { 2 => 'Preview'

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Scalado.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3468
Entropy (8bit):	4.88018765822297
Encrypted:	false
SSDEEP:	96:8fVhR2P7W0Y+rl39ZRvy4afXlyD+QNyTmQW7:2Wy0YoHtql9QNyaQW7
MD5:	9B62D62292DAB99F916DEC1AA023C6EA
SHA1:	0EB7545C65DAF752D606DA828D4CB205FAC668CB
SHA-256:	F0A84B409FE1848A2AACCB9433DA918B6161A6EB6B317A7EF0E3F04E0B29D9B3
SHA-512:	B97900EB78269079F81FBB1D013D6C7C4DFEEE7C234D2FB6C4B7E71BB0F5DDB8422FC043D02F58289713949246578875A2FE8F63E946E663EBF8495CC8C74767
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Scalado.pm".#------------------------------------------------------------------------------.# File: Scalado.pm.#.# Description: Read APP4 SCALADO metadata.#.# Revisions: 2013-09-13 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Scalado;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::PLIST;..$VERSION = '1.01';..sub ProcessScalado($$$);..# JPEG APP4 SCALADO tags.%Image::ExifTool::Scalado::Main = (. GROUPS => { 0 => 'APP4', 1 => 'Scalado', 2 => 'Image' },. PROCESS_PROC => \&ProcessScalado,. TAG_PREFIX => 'Scalado',. FORMAT => 'int32s',. NOTES => q{. Tags extracted from the JPEG APP4 "SCALADO" segment found in images from. HTC, LG and Samsung phones. (Presumably written by Scalado mobile software,. L<http://www.scalado.com/>.). },. SPMO => {. Name => 'DataLength',. Un

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Shift.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	23380
Entropy (8bit):	4.63773130169161
Encrypted:	false
SSDEEP:	384:B6FJ+IuEPJyiuNt9rsnaKO7SawCDi5h+gJbnnF94ne0eV6QI0X77kXWGE:8iIuEPJyiuNt9rsaK+1wC23+g1nB0eV9
MD5:	A641896C8EFD4FD1039B7237F2C73282
SHA1:	8AE5F4BFAE7B53975D6E7805B0105015D84CABC0
SHA-256:	D1AA363BAC4A2F84AE1D8ED8C929B0715B5C9641678541D81EE9969558209873
SHA-512:	757CA7606B4BCEEB86D412D08CCD0CF9734763A8D03271C439E82DCE817247D3A2E67F00E74ED5F87B5830130A679DBB405F984C9FA0FF69AF8B489B527224C3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: Shift.pl.#.# Description: ExifTool time shifting routines.#.# Revisions: 10/28/2005 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool;..use strict;..sub ShiftTime($$;$$);..#------------------------------------------------------------------------------.# apply shift to value in new value hash.# Inputs: 0) ExifTool ref, 1) shift type, 2) shift string, 3) raw date/time value,.# 4) new value hash ref.# Returns: error string or undef on success and updates value in new value hash.sub ApplyShift($$$$;$).{. my ($self, $func, $shift, $val, $nvHash) = @_;.. # get shift direction from first character in shift string. my $pre = ($shift =~ s/^(\+\|-)//) ? $1 : '+';. my $dir = ($pre eq '+') ? 1 : -1;. my $tagInfo = $$nvHash{TagInfo};. my $tag = $$tagInfo{Name};. my $shiftOffset;. if ($$nvHash{Shi

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Shortcuts.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	4.65266824738686
Encrypted:	false
SSDEEP:	96:gXDIiV3rNfGJx3/3L10IQVr+kG77NzTgXo/14duD6GlwE3Ze30:8DHLfrr+kG77N3gvQuGlwE3Zek
MD5:	1C352960007D340305D57D8ED2A00E34
SHA1:	93FCF1F77C4C9ADD0BE4961E7DE2A51AF503E878
SHA-256:	A09C9C6641EBE7BA4AD9964E3F583E875441C6D8EA517FA8E1EE7D4848B0E04F
SHA-512:	EA8B8533CCD659374B9EF08CC8EB6215A3D3B64C7CF246D11AF6C484B77CEE458767F1C5625E292560788530ECAEE292A95516BBB61299578DC79E56CCE3A8CA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Shortcuts.pm".#------------------------------------------------------------------------------.# File: Shortcuts.pm.#.# Description: ExifTool shortcut tags.#.# Revisions: 02/07/2004 - PH Moved out of Exif.pm.# 09/15/2004 - PH Added D70Boring from Greg Troxel.# 01/11/2005 - PH Added Canon20D from Christian Koller.# 03/03/2005 - PH Added user defined shortcuts.# 03/26/2005 - PH Added Nikon from Tom Christiansen.# 02/28/2007 - PH Removed model-dependent shortcuts.# --> this is what UserDefined::Shortcuts is for.# 02/25/2009 - PH Added Unsafe.# 07/03/2010 - PH Added CommonIFD0.#------------------------------------------------------------------------------..package Image::ExifTool::Shortcuts;..use strict;.use vars qw($VERSION);..$VERSION = '1.59';..# this is a special table used to define command-line shortcuts.# (documentation Notes

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Sigma.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	30324
Entropy (8bit):	5.007693234120658
Encrypted:	false
SSDEEP:	768:jJgHrLhdFxqJeeWaqy30yGMdEkxzluCY637:FgHrLhdFxqJeeWaqy30NDC7
MD5:	2C2D2A091BD4BF2946EE0D013FFC769B
SHA1:	AA5D049F2A412A4FE7BCF2C9933232D9C113DE7A
SHA-256:	5A2AD910F92C53CDD095E1C42D4B70F146263E7B6AE48F24BE4925D1D44CBF75
SHA-512:	242F8F15F0A3F8A5EF30A1C34855615433EC591FADDDFB5FDE3E73E72C53D9B8B3F99B20E4785CA7DBA949446B80B536F98DED230ADC6A919424F90A9E8E42DC
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Sigma.pm".#------------------------------------------------------------------------------.# File: Sigma.pm.#.# Description: Sigma/Foveon EXIF maker notes tags.#.# Revisions: 04/06/2004 - P. Harvey Created.# 02/20/2007 - PH added SD14 tags.# 24/06/2010 - PH decode some SD15 tags.#.# References: 1) http://www.x3f.info/technotes/FileDocs/MakerNoteDoc.html.# IB) Iliah Borg private communication (LibRaw).# NJ) Niels Kristian Bech Jensen.# JR) Jos Roost.#------------------------------------------------------------------------------..package Image::ExifTool::Sigma;..use strict;.use vars qw($VERSION %sigmaLensTypes);.use Image::ExifTool::Exif;..$VERSION = '1.24';..# sigma LensType lookup (ref IB).%sigmaLensTypes = (. Notes => q{. Sigma LensType values are hexadecimal numbers stored as a string (without. the leading "0x"). Decimal values have been added to differentiate

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\SigmaRaw.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	22681
Entropy (8bit):	4.888529143940088
Encrypted:	false
SSDEEP:	384:JC5AwKixuLAW/OrbYtraY1Nx6BUN8lgCyZCQYWLtUPGxQz:JC5UixuM4trzNQUN8XihYC4GxQz
MD5:	C30BA3D3A2BFBDCCB29098E3814F1CDA
SHA1:	98E59B4968E001F89316AB435CC719DB1D81B02A
SHA-256:	45CA4A217DC2CCED281C0B341DD8E6DCC707CE9093E0E0DF1CED3B01ACB5F843
SHA-512:	B469A929CAE9565FDD3D64B90F65791FE7EAE0036214C712423EC73561B385EE2EDC46FC6036D59C539C37DD811C9879E2922916C7CD85F97992EBBDFAEB515B
Malicious:	false
Preview:	#line 1 "Image/ExifTool/SigmaRaw.pm".#------------------------------------------------------------------------------.# File: SigmaRaw.pm.#.# Description: Read Sigma/Foveon RAW (X3F) meta information.#.# Revisions: 2005/10/16 - P. Harvey Created.# 2009/11/30 - P. Harvey Support X3F v2.3 written by Sigma DP2.#.# References: 1) http://www.x3f.info/technotes/FileDocs/X3F_Format.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::SigmaRaw;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Sigma;..$VERSION = '1.26';..sub ProcessX3FHeader($$$);.sub ProcessX3FDirectory($$$);.sub ProcessX3FProperties($$$);..# main X3F sections (plus header stuff).%Image::ExifTool::SigmaRaw::Main = (. PROCESS_PROC => \&ProcessX3FDirectory,. NOTES => q{. These tags are used in Sigma and Foveon RAW (.X3F) images. Metadata is also. extracted from the JpgFromRa

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Sony.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	407393
Entropy (8bit):	4.974838218981179
Encrypted:	false
SSDEEP:	6144:ikTTJAwYR5cGRPMpCpqWa95tJ7tkprECDVkM6UtNSXeUBTGtxolC0XYuC:a4GRPMpCpqWa95P36tZnEIV
MD5:	CB9A308AE0895B07C7CCC68007ED9560
SHA1:	97BD2B42CDB5085E893CC50C27AC2D9406A5C30A
SHA-256:	42DEDC3EE9B7F3373FFE298A721A072D3ADBC4E6C2AE89530152EEF8803CE8C1
SHA-512:	9528DC08637D596812F21EF18589E330FB802F470FE3B0DEF83FE8ECAD0E09B4C09ADBE15CFF2B68390271610DABAD07126CDE4EE021783D78C24F2346F082C0
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Sony.pm".#------------------------------------------------------------------------------.# File: Sony.pm.#.# Description: Sony EXIF Maker Notes tags.#.# Revisions: 04/06/2004 - P. Harvey Created.#.# References: 1) http://www.cybercom.net/~dcoffin/dcraw/.# 2) http://homepage3.nifty.com/kamisaka/makernote/makernote_sony.htm (2006/08/06).# 3) Thomas Bodenmann private communication.# 4) Philippe Devaux private communication (A700).# 5) Marcus Holland-Moritz private communication (A700).# 6) Andrey Tverdokhleb private communication.# 7) Rudiger Lange private communication (A700).# 8) Igal Milchtaich private communication.# 9) Michael Reitinger private communication (DSC-TX7,RX100).# 10) http://www.klingebiel.com/tempest/hd/pmp.html.# 11) Mike Battilana private communication.# 13) http://www.mi-fo.de/f

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\SonyIDC.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	9838
Entropy (8bit):	4.69512043649634
Encrypted:	false
SSDEEP:	192:AN4+3YbS5etoOwp8RzOn+REs9FAslpHUHCQ3:EX3YWzp8RzOn+REsb1Y
MD5:	85502410AE5B233D87CC9C7A68FEA3BD
SHA1:	BCA5DEA43CB0805CE7A3B8F74AFE6397E818C1E2
SHA-256:	7878B846BE82BBCACAC861FACF6E3AE5382DA4BC0DA01366DFE1FBA1432C6062
SHA-512:	9C08641D38739FB7C9FF21B62E53710DA0A9443F61900EB82E4B153A2364B808D1818088A78D2E2D3F85BD62E8E110563EF9109C1ED2BBD21918050EA95055FE
Malicious:	false
Preview:	#line 1 "Image/ExifTool/SonyIDC.pm".#------------------------------------------------------------------------------.# File: SonyIDC.pm.#.# Description: Read/write Sony IDC information.#.# Revisions: 2010/01/05 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::SonyIDC;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::Exif;..$VERSION = '1.06';..# Sony IDC tags (ref PH).%Image::ExifTool::SonyIDC::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. GROUPS => { 0 => 'MakerNotes', 2 => 'Image' },. NOTES => 'Tags written by the Sony Image Data Converter utility in ARW images.',. SET_GROUP1 => 1,. 0x201 => {. Name => 'IDCPreviewStart',. IsOffset => 1,. OffsetPair => 0x202,. DataTag => 'IDCPreview',. Writable => 'int32u',. Protected => 2,.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Stim.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4014
Entropy (8bit):	4.654920689234091
Encrypted:	false
SSDEEP:	48:8a6CwHYBr53U/Ed5YRccm0vsgLVx8f0gI+TAMDBDjtB6EDQvCYCDVOMoG7soC1iQ:x0HwV3e1mcfv1xySPhn
MD5:	35B5BEA68977FC73DF8FE103A0053AF2
SHA1:	49C871C336D90B6F0C8116E512D4265E5CA075CD
SHA-256:	E5179A7AA184E7D99737DFE0D501964DFBB0DCA3126A40D14A41594E452476C4
SHA-512:	9BE0C42661AEB8401A9C51BFA93568389BCDBCCC090C65B816D0FE29555EEEB9E96866802E788A7232675D86D661AE2D233B88CEF6A0862537ADB93A0D4D8455
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Stim.pm".#------------------------------------------------------------------------------.# File: Stim.pm.#.# Description: Definitions for Stereo Still Image tags.#.# Revisions: 06/12/2009 - P. Harvey Created.#.# References: 1) http://www.cipa.jp/std/documents/e/DC-006_E.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Stim;..use strict;.use vars qw($VERSION);..$VERSION = '1.01';..# Tags found in APP3 Stim segment in JPEG images.%Image::ExifTool::Stim::Main = (. GROUPS => { 0 => 'Stim', 1 => 'Stim', 2 => 'Image'},. NOTES => q{. These tags are part of the CIPA Stereo Still Image specification, and are. found in the APP3 "Stim" segment of JPEG images. See. L<http://www.cipa.jp/std/documents/e/DC-006_E.pdf> for the. official specification.. },. 0 => 'StimVersion',. 1 => {. Name => 'ApplicationData',. Binary => 1,. },. 2 => {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\TagInfoXML.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	30583
Entropy (8bit):	4.438074980637726
Encrypted:	false
SSDEEP:	384:PitRAbDzIT+dd1Q73oKLK5LoF7IXLQj6w3wRY7wAxEvY:PitmnET+drKLKRoF7ee6w3wRY7wAxEvY
MD5:	AA7DCB9F35307166B33A011B8A877E22
SHA1:	2473639D38AAF86AE8B08CCF525EC49C084371C1
SHA-256:	C2E6F7E8F446D190024627E67EF005D62B96F0DE131165B7CDD904B0198E30DE
SHA-512:	02F588ACD94AE5E1CCE5BB430425CB3BE5D731551CE71DBFF02ED54AC3D5D978FFF3CC1CEFC10AD87EC3E471FFAA9B294EC03FE74C71F915F2A6D9FE569130DA
Malicious:	false
Preview:	#line 1 "Image/ExifTool/TagInfoXML.pm".#------------------------------------------------------------------------------.# File: TagInfoXML.pm.#.# Description: Read/write tag information XML database.#.# Revisions: 2009/01/28 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::TagInfoXML;..use strict;.require Exporter;..use vars qw($VERSION @ISA $makeMissing);.use Image::ExifTool qw(:Utils :Vars);.use Image::ExifTool::XMP;..$VERSION = '1.30';.@ISA = qw(Exporter);..# set this to a language code to generate Lang module with 'MISSING' entries.$makeMissing = '';..sub LoadLangModules($;$);.sub WriteLangModule($$;$);.sub NumbersFirst;..# names for acknowledgements in the POD documentation.my %credits = (. cs => 'Jens Duttke and Petr MichE<aacute>lek',. de => 'Jens Duttke and Herbert Kauer',. es => 'Jens Duttke, Santiago del BrE<iacute>o GonzE<aacute>lez and Emilio Sancha',. fi => 'Jens Dut

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\TagLookup.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with very long lines (465)
Category:	dropped
Size (bytes):	443752
Entropy (8bit):	5.207924443915198
Encrypted:	false
SSDEEP:	6144:meuAKKrwT1Di/dCM7BTdDhKN5PPhqBZ+jWXlNXQf9Oz:meuAKKrwT1Di/dMKlbz
MD5:	33A2698FFDF000636FF608986CB33D83
SHA1:	625875AE09ED9FC5E4D2D556D31813520B826614
SHA-256:	C70CF9C51A703161E8AF43A6955827B0847AF26AB0720F15897F012C51FEB1E4
SHA-512:	E074B85BE931DEDDA83EE189A4A2F8D2C624D85941F5CB2F5FF1722F61CA8507D920225EA882FA2612836483E05A2DF094E8493C17D14DDE9113CAA6F66B0377
Malicious:	false
Preview:	#line 1 "Image/ExifTool/TagLookup.pm".#------------------------------------------------------------------------------.# File: TagLookup.pm.#.# Description: Fast lookup for ExifTool tags.#.# Notes: This lookup is used to look up tag names for writing.#.# Revisions: 2004-12-31 - P. Harvey Created.# 2013-01-06 - PH Allow wildcards in FindTagInfo().#------------------------------------------------------------------------------..package Image::ExifTool::TagLookup;..use strict;.require Exporter;..use vars qw($VERSION @ISA @EXPORT_OK);.use Image::ExifTool qw(:Utils);..$VERSION = '1.16';.@ISA = qw(Exporter);.@EXPORT_OK = qw(FindTagInfo TagExists);..sub AddTags($$);.sub AddFields($$$$$$;$$);..#.# Note: the lists below were generated by Image::ExifTool::BuildTagLookup.#..#++++ Begin automatically generated code ++++..# list of tables containing writable tags.my @tableList = (..'Image::ExifTool::APP12::Ducky',..'Image::ExifTool::Apple::Main',..'Image::ExifTool::Ca

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\TagNames.pod

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl POD document, ASCII text
Category:	dropped
Size (bytes):	1548947
Entropy (8bit):	3.6221409426157054
Encrypted:	false
SSDEEP:	6144:ffvVmRGeDRBKrb0U8ev0MkiKjoLfvv1BjBsEA48Vm6EGloFXVx9HCT/RS3n+UlNf:fftJ0QwiKj+8Q6EtFlxtDOIM8
MD5:	ADEEF699D2A7DA3D6C3D54CC74DB2885
SHA1:	468D25E3A9A14B4D7C26321F9705FCF2662874F2
SHA-256:	0BB3CA2B7B21167F9AF9B795D5B120C52949D764DC4C49A717694F04F4D212A8
SHA-512:	8C0341F941C430D07FF616809A5E3DBA80C54EDC68A90862FD0157316BCDCEA6061D2C842BA3643146824BBDA2B6EF4DA3586D00785F7EEA4ABBA4ADEC064F6B
Malicious:	false
Preview:	.=head1 NAME..Image::ExifTool::TagNames - ExifTool tag name documentation..=head1 DESCRIPTION..This document contains a complete list of ExifTool tag names, organized into.tables based on information type. Tag names are used to reference specific.meta information extracted from or written to a file...=head1 TAG TABLES..The tables listed below give the names of all tags recognized by ExifTool...B<Tag ID>, B<Index#> or B<Sequence> is given in the first column of each.table. A B<Tag ID> is the computer-readable equivalent of a tag name, and.is the identifier that is actually stored in the file. B<Index#> refers to.the location of a value when found at a fixed position within a data block.(B<#> is the multiplier for calculating a byte offset: B<1>, B<2>, B<4> or.B<8>). B<Sequence> gives the order of values for a serial data stream...A B<Tag Name> is the handle by which the information is accessed in.ExifTool. In some instances, more than one name may correspond to a single.tag ID. In

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Theora.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2859
Entropy (8bit):	4.825515271810841
Encrypted:	false
SSDEEP:	48:wNdBXuX5r56UoN1rSB0mIBe9OMo2//iBRD1V+2+H9csVEg52VYmL2B1FZwC7J:+XupV6NN120mS/Rx25ALkFK0J
MD5:	3A1745FAA971CF1D3EA43F1CDB936BAB
SHA1:	6D39A2078C7A3B16BCD6C8E520381F7BF60947CD
SHA-256:	0401F8BB89076B7BC6DB48E2DF747E31025C3C3C44E3DA919DD90BCF4ABAD6B5
SHA-512:	25F7E4364B95EC1748DCF379CE45A61FDD5587D07CD2965A59E5F51688003CEDEC74720BC303D0837C1092362293BD0430E4B48A7F1EF071635DE0BF1A6875F1
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Theora.pm".#------------------------------------------------------------------------------.# File: Theora.pm.#.# Description: Read Theora video meta information.#.# Revisions: 2011/07/13 - P. Harvey Created.#.# References: 1) http://www.theora.org/doc/Theora.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Theora;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.00';..# Theora header types.%Image::ExifTool::Theora::Main = (. NOTES => q{. Information extracted from Ogg Theora video files. See. L<http://www.theora.org/doc/Theora.pdf> for the Theora specification.. },. 0x80 => {. Name => 'Identification',. SubDirectory => {. TagTable => 'Image::ExifTool::Theora::Identification',. ByteOrder => 'BigEndian',. },. },. 0x81 => {. Name => 'Comments',. SubDirectory =>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Torrent.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10602
Entropy (8bit):	4.615805088700664
Encrypted:	false
SSDEEP:	192:kDZCzTMFSATav+PBtHgFhQyfVMQfhluyTaQFAXlCY6P9NnAXPJAXoIo5yhQbgVsn:kNCmTwMU1P/QRl5lgVpG
MD5:	11836478AADDA9E7258FD485CC686966
SHA1:	E9A5B16001E7EDF5F16E36062D6B20B2D8F899AF
SHA-256:	FF87C42192F3576CCF2D2A3CD3360D2000D434DEAFFE11A4A2D114B6AA48AD04
SHA-512:	34F8B8F4DF0B9612E009EE34239CF087FA99E2B9BFFE00C26C0FC5AA9F7C10067027E1DCA29C15A963E50D0FFF21553CF108A87F843DE5D8F378A714338B9962
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Torrent.pm".#------------------------------------------------------------------------------.# File: Torrent.pm.#.# Description: Read information from BitTorrent file.#.# Revisions: 2013/08/27 - P. Harvey Created.#.# References: 1) https://wiki.theory.org/BitTorrentSpecification.#------------------------------------------------------------------------------..package Image::ExifTool::Torrent;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.03';..sub ReadBencode($$);.sub ExtractTags($$$;$$@);..# tags extracted from BitTorrent files.%Image::ExifTool::Torrent::Main = (. GROUPS => { 2 => 'Document' },. NOTES => q{. Below are tags commonly found in BitTorrent files. As well as these tags,. any other existing tags will be extracted. For convenience, list items are. expanded into individual tags with an index in the tag name, but only the. tags with index "1" are listed in th

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Unknown.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	985
Entropy (8bit):	4.926512987555784
Encrypted:	false
SSDEEP:	24:TOyrj3a5wB+53r5wUtA7vtf/TiRmI2mdvdgACn:B3a5wBo3r5wUAab+ACn
MD5:	6D162545C783FCE025ED92AAF0057128
SHA1:	6F85560EAD158EEC039B595438CD31E51618731A
SHA-256:	2B22352203973953F11329625B547B0ECCDB399E1CC33B4E85138B53B661B4FF
SHA-512:	7F8DD1C296D897C1CCBCEA8B5F9D1D8682A53DD2163CC112CCEA664EC5D441EAEA5479F3F4F5CED7B972ACEEC2822250CB9735BACE53F4903073C8282DF6A005
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Unknown.pm".#------------------------------------------------------------------------------.# File: Unknown.pm.#.# Description: Unknown EXIF maker notes tags.#.# Revisions: 04/07/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Unknown;..use strict;.use vars qw($VERSION);.use Image::ExifTool::Exif;..$VERSION = '1.13';..# Unknown maker notes.%Image::ExifTool::Unknown::Main = (. WRITE_PROC => \&Image::ExifTool::Exif::WriteExif,. CHECK_PROC => \&Image::ExifTool::Exif::CheckExif,. GROUPS => { 0 => 'MakerNotes', 1 => 'MakerUnknown', 2 => 'Camera' },.. # this seems to be a common fixture, so look for it in unknown maker notes. 0x0e00 => {. Name => 'PrintIM',. Description => 'Print Image Matching',. SubDirectory => {. TagTable => 'Image::ExifTool::PrintIM::Main',. },. },.);...1; # end..__END__..#line 67.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\VCard.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	15381
Entropy (8bit):	4.727189335005848
Encrypted:	false
SSDEEP:	192:qKeEYcsSZ0qDs+nbQYB504tj8e6vC20zPtvaOsyRdAiQ6S1dyw0nugmjxlCatpSm:hean0q1bQaBf6vFnOx6dHxYh0dFHKS
MD5:	82C5B2B7210B1CD22FA0B39AAAE43C89
SHA1:	93BB0F5372A7FA182CC3BA1588BB3ECF6923E4F7
SHA-256:	FFBF55FC9398CE8F5BAAAA9A00B52343559CDF03F2E84D08A6D68594A6272230
SHA-512:	7033F2F5304B7644B029846CB7CC804E1FE5466562CF66DC17CA030B104501C205BEF92D532754D0C0C0D903EEF3C12C674ED8687DC16F7669BF7DD2A753A35A
Malicious:	false
Preview:	#line 1 "Image/ExifTool/VCard.pm".#------------------------------------------------------------------------------.# File: VCard.pm.#.# Description: Read vCard and iCalendar meta information.#.# Revisions: 2015/04/05 - P. Harvey Created.# 2015/05/02 - PH Added iCalendar support.#.# References: 1) http://en.m.wikipedia.org/wiki/VCard.# 2) http://tools.ietf.org/html/rfc6350.# 3) http://tools.ietf.org/html/rfc5545.#------------------------------------------------------------------------------..package Image::ExifTool::VCard;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.04';..my %unescapeVCard = ( '\\'=>'\\', ','=>',', 'n'=>"\n", 'N'=>"\n" );..# lookup for iCalendar components (used to generate family 1 group names if top level).my %isComponent = ( Event=>1, Todo=>1, Journal=>1, Freebusy=>1, Timezone=>1, Alarm=>1 );..my %timeInfo = (. # convert common date/time formats to EXIF style.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Validate.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	19114
Entropy (8bit):	4.8887615895887935
Encrypted:	false
SSDEEP:	384:B4Lb4Y5Z0HhLOhAalQefFwgduAfAnPAOBnAcTnp2mcSGbRebD9:y4OJ6awuLE
MD5:	BE09DAD862539549CE4C70ABE5522C83
SHA1:	8D16F79C8B3DED40CDC75080BC865D891AF72A25
SHA-256:	83627360E0CF3785AD5A746CCE416B8EA355D1B32131007401CD8E51EB575E89
SHA-512:	202B7D9134646CEBEDA7EC8194A64EA2C097C87C5A44AA21CD9BF1419C1CFC9A67806C1365851F59492664EA8FD75E92DCE6CADCDDC36B597012D2A1B7DE27FB
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Validate.pm".#------------------------------------------------------------------------------.# File: Validate.pm.#.# Description: Additional metadata validation.#.# Created: 2017/01/18 - P. Harvey.#------------------------------------------------------------------------------..package Image::ExifTool::Validate;..use strict;.use vars qw($VERSION %exifSpec);..$VERSION = '1.07';..use Image::ExifTool qw(:Utils);.use Image::ExifTool::Exif;..# EXIF table tag ID's which are part of the EXIF 2.31 specification.# (also used by BuildTagLookup to add underlines in HTML version of EXIF Tag Table).%exifSpec = (. 0x1 => 1,. 0x100 => 1, 0x8298 => 1, 0x9207 => 1, 0xa217 => 1,. 0x101 => 1, 0x829a => 1, 0x9208 => 1, 0xa300 => 1,. 0x102 => 1, 0x829d => 1, 0x9209 => 1, 0xa301 => 1,. 0x103 => 1, 0x8769 => 1, 0x920a => 1, 0xa302 => 1,. 0x106 => 1, 0x8822 => 1, 0x9214 => 1, 0xa401 => 1,. 0x10e => 1, 0x8824 => 1, 0x927c => 1, 0xa402

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Vorbis.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7579
Entropy (8bit):	4.964292429376234
Encrypted:	false
SSDEEP:	192:ZKCgFKHjFUE11g14141IP5zavtKFcL8UoDKuWzTBgjZBE:MQjFUSw446K0vVE
MD5:	F1B3C92CDE37E003561D5B4A2827E281
SHA1:	51CD512A5587EE8200F3A4765D099722F93362CC
SHA-256:	0621484DD0C72ADA7B1E882C8ACAB5842723E0ED4993738E74D96ADCE48AEE4D
SHA-512:	4BC7A2C5B773AEA2AB4B48A237B95700AC3AB5612B5B19A2FF762607B9B08C0CED640ED106C28379BF47C684853B08A2B5B5489672B9FBE4A862D75486B5FD64
Malicious:	false
Preview:	#line 1 "Image/ExifTool/Vorbis.pm".#------------------------------------------------------------------------------.# File: Vorbis.pm.#.# Description: Read Ogg Vorbis audio meta information.#.# Revisions: 2006/11/10 - P. Harvey Created.# 2011/07/12 - PH Moved Ogg to a separate module and added Theora.#.# References: 1) http://www.xiph.org/vorbis/doc/.# 2) http://flac.sourceforge.net/ogg_mapping.html.# 3) http://www.theora.org/doc/Theora.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::Vorbis;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.08';..sub ProcessComments($$$);..# Vorbis header types.%Image::ExifTool::Vorbis::Main = (. NOTES => q{. Information extracted from Ogg Vorbis files. See. L<http://www.xiph.org/vorbis/doc/> for the Vorbis specification.. },. 1 => {. Name => 'Identification',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WriteCanonRaw.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	24893
Entropy (8bit):	4.68252930206594
Encrypted:	false
SSDEEP:	384:H6KpAzWvOy0BL+FmObMG2B5Ap9s9pd0zeQmk1:H65RF7OYJ55pd06Ql1
MD5:	5676D140873D837BE0FECFFA6688B0D2
SHA1:	6F07A9893D44FAD3B4CC47F140D8979C39B5BBDA
SHA-256:	C44F45B6AF3FD63EA036350294D9B5D7580A85CC63CA749C2D4D848BAD85C311
SHA-512:	44D1D19E99B6FFDE89B272AFD4F6C6FE4BA43C3F1FFC50A3AF36A1E9A16C37CD36E30C481073022477BAB3920109DCF82153E169D7D9C2FE400758132EF248AF
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteCanonRaw.pl.#.# Description: Write Canon RAW (CRW and CR2) meta information.#.# Revisions: 01/25/2005 - P. Harvey Created.# 09/16/2010 - PH Added ability to write XMP in CRW images.#------------------------------------------------------------------------------.package Image::ExifTool::CanonRaw;..use strict;.use vars qw($VERSION $AUTOLOAD %crwTagFormat);.use Image::ExifTool::Fixup;..# map for adding directories to CRW.my %crwMap = (. XMP => 'CanonVRD',. CanonVRD => 'Trailer',.);..# mappings to from RAW tagID to MakerNotes tagID.# (Note: upper two bits of RawTagID are zero).my %mapRawTag = (. # RawTagID => Canon TagID. 0x080b => 0x07, # CanonFirmwareVersion. 0x0810 => 0x09, # OwnerName. 0x0815 => 0x06, # CanonImageType. 0x1028 => 0x03, # (unknown if no tag name specified). 0x1029 => 0x02, # FocalLength. 0x102a => 0x04, # CanonShotInfo. 0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WriteExif.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	129664
Entropy (8bit):	4.06504774918612
Encrypted:	false
SSDEEP:	768:8acUEgLnS8nvnI0YoAmIyjBN0JPLo9EGfNUf6EY7vMi4HDX/PybQHB5t41DNKSiR:xLS8vLjvzB74rybQF4rKSIbUWSAr
MD5:	7824502209808A1C545EDFA87032AF8B
SHA1:	1E0ACB7D60238497765758BD6BFAE26D623982AF
SHA-256:	E24A6CF29159B685A46E0C27192B522B75FDF17DAAAABA40EA4205E7702DB642
SHA-512:	0A84612D18ED4333455128700A909A3629857B1F7712819480BA54292E7613414ACB2C3B59363E53C51D73729D44EC97EAB5D6BEC117FBF4100EC2A1337934A3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteExif.pl.#.# Description: Write EXIF meta information.#.# Revisions: 12/13/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Exif;..use strict;.use vars qw($VERSION $AUTOLOAD @formatSize @formatName %formatNumber. %compression %photometricInterpretation %orientation);..use Image::ExifTool::Fixup;..# some information may be stored in different IFD's with the same meaning..# Use this lookup to decide when we should delete information that is stored.# in another IFD when we write it to the preferred IFD..my %crossDelete = (. ExifIFD => 'IFD0',. IFD0 => 'ExifIFD',.);..# mandatory tag default values.my %mandatory = (. IFD0 => {. 0x011a => 72, # XResolution. 0x011b => 72, # YResolution. 0x0128 => 2, # ResolutionUnit (inches). 0x0213 => 1,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WriteID3.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	4.883763958485199
Encrypted:	false
SSDEEP:	12:7jM32dqzy4lp+3ArkmMJ0VHYQygR2xQeKsaphdqzSnXqZEgxeqFWAd3x9B5R7MkX:7jTdF73zx/zehdLarjd3V5hM2
MD5:	EC3E319CA7D656EADBB9E7D14986B3F6
SHA1:	D6B9D450F9261AA6A2225E4EE3EA7D1E71556B38
SHA-256:	5A81C732EAAF2F866ED1FAF71A97B131A2268EF612A489825747FFCB4B812668
SHA-512:	6A7697D1978FCCD0B7AAD44BA346F6FF93C2EB9B12D0E90CFBE886440BC5E79181313DB20FB7FD7932EBCA1D9263091EB94D6C0CBF021681A0C93EB7EB60DE96
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteID3.pl.#.# Description: Write ID3 meta information.#.# Revisions: 07/10/2006 - P. Harvey Created.#------------------------------------------------------------------------------.package Image::ExifTool::ID3;..use strict;.use Image::ExifTool qw(:DataAccess :Utils);..#------------------------------------------------------------------------------.# Write information to MP3 file.# Inputs: 0) ExifTool object reference, 1) source dirInfo reference.# Returns: 1 on success, 0 if not valid MP3 file, -1 on write error.sub WriteMP3($$).{. my ($et, $dirInfo) = @_;.}...1; # end..__END__..=head1 NAME..Image::ExifTool::WriteID3.pl - Write ID3 meta information..=head1 SYNOPSIS..These routines are autoloaded by Image::ExifTool::ID3...=head1 DESCRIPTION..This file contains routines to write ID3 metadata...=head1 AUTHOR..Copyright 2003-2018, Phil Harvey (phil at owl.phy.queensu.ca)..This library is

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WriteIPTC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	30300
Entropy (8bit):	4.535854239361293
Encrypted:	false
SSDEEP:	768:5nPVwAOAieKns13VcTP7OujTZjHIWLwFn:5niRAlyqawp
MD5:	4E416AEE5CD807EF22BA76B4969D0F43
SHA1:	127679DCB5C70EC4D6238880E5ED650E6CEA9DC6
SHA-256:	08761DBB7A066868AA95F5C0629CC3845C8CB31A3D1EF16B74115135A9A39CA5
SHA-512:	8EE94B6994D4B297F4F2A938AD427D5CB0EB259D39A76D7433E501969524199008E0D906A9D05DB139048D69AB6560B665EA959CE7442C8EE765817B794A205B
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteIPTC.pl.#.# Description: Write IPTC meta information.#.# Revisions: 12/15/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::IPTC;..use strict;..# mandatory IPTC tags for each record.my %mandatory = (. 1 => {. 0 => 4, # EnvelopeRecordVersion. },. 2 => {. 0 => 4, # ApplicationRecordVersion. },. 3 => {. 0 => 4, # NewsPhotoVersion. },.);..# manufacturer strings for IPTCPictureNumber.my %manufacturer = (. 1 => 'Associated Press, USA',. 2 => 'Eastman Kodak Co, USA',. 3 => 'Hasselblad Electronic Imaging, Sweden',. 4 => 'Tecnavia SA, Switzerland',. 5 => 'Nikon Corporation, Japan',. 6 => 'Coatsworth Communications Inc, Canada',. 7 => 'Agence France Presse, France',. 8 => 'T/One Inc, USA',. 9 => 'Associated Newspapers, UK',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WritePDF.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	29651
Entropy (8bit):	4.697961211446811
Encrypted:	false
SSDEEP:	384:5yA6lXw6eDlxan/hdhc+zT5Lrr1M0vYdTN07Bt2Kz2XU7zx5sVUkMBHihSCp:5clXw6evan/h7tLrr1v7tlz2O5ahSCp
MD5:	A2CDE7638FAD57DC86D283DDFAEC4EB3
SHA1:	735806D99418DCF27BDA6D85504070321532F4C6
SHA-256:	A19E64844C8790E6DE9021115546F6D4BC41C84EE2B9AC0E29E6F40161CA56CA
SHA-512:	F57ABB6E764EA7A95146A66BF649E2459288B7CB91C387C37B32E3DEFE6C1990C15A46F16FA0B8D5F5A12492AFCEC55142FD7E0C8D83BBF5216B7CF47D41945B
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePDF.pl.#.# Description: Write PDF meta information.#.# Revisions: 12/08/2007 - P. Harvey Created.#.# References: 1) http://partners.adobe.com/public/developer/pdf/index_reference.html.#.# Notes: The special "PDF-update" group can be deleted to revert exiftool updates.#------------------------------------------------------------------------------.package Image::ExifTool::PDF;..use strict;.use vars qw($lastFetched);..sub WriteObject($$);.sub EncodeString($);.sub CryptObject($);..# comments to mark beginning and end of ExifTool incremental update.my $beginComment = '%BeginExifToolUpdate';.my $endComment = '%EndExifToolUpdate ';..my $keyExt; # crypt key extension.my $pdfVer; # version of PDF file we are currently writing..# internal tags used in dictionary objects.my %myDictTags = (. _tags => 1, _stream => 1, _decrypted => 1, _needCrypt => 1,. _filtered => 1, _e

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WritePNG.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16240
Entropy (8bit):	4.779799144898221
Encrypted:	false
SSDEEP:	384:/mbD1W86enOtS6teLekw/benLnt1vOL4VPXCt/sjmS4TEoTsbf:/mV6eNCeKPTenLzratk74TEcsbf
MD5:	383E2626BB554F510400EB1866A38E9F
SHA1:	049F60BF9D9AFE0B0B96E9F048007A0C5C3C4622
SHA-256:	C66FDEB5FD55D383B42BF5C66BB0CB10512235858D394D8F83E49E285BC86D10
SHA-512:	FC9826028F897F5F84252602FAE65362A90E7CF1B8E5846CEF01D5295DAB3D114733A259DC7C9CF445E6236B03DBDCB282FCAEB6CA73E450F71BB4A19BC700FC
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePNG.pl.#.# Description: Write PNG meta information.#.# Revisions: 09/16/2005 - P. Harvey Created.#.# References: 1) http://www.libpng.org/pub/png/spec/1.2/.#------------------------------------------------------------------------------.package Image::ExifTool::PNG;..use strict;..#------------------------------------------------------------------------------.# Calculate CRC or update running CRC (ref 1).# Inputs: 0) data reference, 1) running crc to update (undef intially).# 2) data position (undef for 0), 3) data length (undef for all data),.# Returns: updated CRC.my @crcTable;.sub CalculateCRC($;$$$).{. my ($dataPt, $crc, $pos, $len) = @_;. $crc = 0 unless defined $crc;. $pos = 0 unless defined $pos;. $len = length($$dataPt) - $pos unless defined $len;. $crc ^= 0xffffffff; # undo 1's complement. # build lookup table unless done already. unless

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WritePhotoshop.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10799
Entropy (8bit):	4.608737519370114
Encrypted:	false
SSDEEP:	192:Fs/SyA4rYJYDZRzaB+km3Eo8Ck0BUd4l/SC38FyHl98xPoQfv0ThdB9:Fs6h4oYDZpO0Thdn
MD5:	9E49D031DE6E905ADE1451ACD4B50AB4
SHA1:	F89648664AF111F3B9C83B094772CF8BF45419F8
SHA-256:	BB0FF666046FCC8FCE9C17DD5678199973E31C437CF08E0665B0E94DD17E1254
SHA-512:	7EBF1A14E8851A324C0B5938F9193DF5148871E6BB31D744B82369F9737D38A725C19009248B59ABC31A5B9DFC7D6A34297B8CBF8395C37A3A2D2DAC6F9D7247
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePhotoshop.pl.#.# Description: Write Photoshop IRB meta information.#.# Revisions: 12/17/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Photoshop;..use strict;..#------------------------------------------------------------------------------.# Strip resource name from value prepare resource name for writing into IRB.# Inputs: 0) tagInfo ref, 1) resource name (padded pascal string), 2) new value ref.# Returns: none (updates name and value if necessary).sub SetResourceName($$$).{. my ($tagInfo, $name, $valPt) = @_;. my $setName = $$tagInfo{SetResourceName};. if (defined $setName) {. # extract resource name from value. if ($$valPt =~ m{.*/#(.{0,255})#/$}s) {. $name = $1;. # strip name from value. $$valPt = substr($$valPt, 0, -4 - length($name));.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WritePostScript.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	29975
Entropy (8bit):	4.6884993259440115
Encrypted:	false
SSDEEP:	384:ozPEx7oDuaS2hzCEu2AxvRvt+kO/51coEC5QCe3zLXTayjwqaR0r5eqn4DQJ3AQk:oz0QgrpKcohCzn9yWew4DQ1MXAl4t
MD5:	204356E19C56EBC8EE03B5BC647A4625
SHA1:	26754A49418AB906EA0B83FE3E08D792538C6445
SHA-256:	005A6349E564EEDC65D3DA5C0DF4265C14A3F477C36FA91E9C96D31A33166030
SHA-512:	35645211BB02502EE9FF97DE3DE8662A0395C129E5411955DF5E8C6B4DCF93C6BB4C39CD30D5CC63E28051194AFE63BB4B6B8282EACB32895E6C4DBF2A3165E5
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePostScript.pl.#.# Description: Write PostScript meta information.#.# Revisions: 03/03/2006 - P. Harvey Created.#.# References: (see references in PostScript.pm, plus:).# 1) http://www.adobe.com/products/postscript/pdfs/PLRM.pdf.# 2) http://www-cdf.fnal.gov/offline/PostScript/PLRM2.pdf.# 3) http://partners.adobe.com/public/developer/en/acrobat/sdk/pdf/pdf_creation_apis_and_specs/pdfmarkReference.pdf.# 4) http://www.npes.org/standards/Tools/DCS20Spec.pdf.#.# Notes: (see NOTES in POD doc below).#------------------------------------------------------------------------------..package Image::ExifTool::PostScript;..use strict;..# Structure of a DSC PS/EPS document:.#.# %!PS-Adobe-3.0 [plus " EPSF-3.0" for EPS].# <comments>.# %%EndComments [optional].# %%BeginXxxx.# <stuff to ignore>.# %%EndXxxx.# %%

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WriteQuickTime.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	14856
Entropy (8bit):	4.519110756228935
Encrypted:	false
SSDEEP:	192:Hv4VKz0gn0fGhSd5tBtE27jvU5mH4EW0yCEGLcLZmefiEyBDXUgD90C6i9p+0/uo:wS0b5t5i7k2u1stuXq4E574TP
MD5:	E595FFEE2DF66A25EC78816B82B37779
SHA1:	5D9F32771B6D8A5DCFFE9EAC6C99A23D9D3C534F
SHA-256:	B7BC24B2A2E83650D67D1D03D81290B9AF937013866A61D789D4CDC9B0497E0E
SHA-512:	1CC45656241437A45CB96F22FED2BBB6FAF790B46BA541370DEC388E7FF25463D5389FC9F5B33B0E6F449BEBAD9B52235F6B8C2B7E7CDFF0EE36C5041A3AFEC3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteQuickTime.pl.#.# Description: Write XMP to QuickTime (MOV and MP4) files.#.# Revisions: 2013-10-29 - P. Harvey Created.#------------------------------------------------------------------------------.package Image::ExifTool::QuickTime;..use strict;..# map for adding directories to QuickTime-format files.my %movMap = (. # MOV (no 'ftyp', or 'ftyp'='qt ') -> 'moov'-'udta'-'XMP_'. XMP => 'UserData',. UserData => 'Movie',. Movie => 'MOV',.);.my %mp4Map = (. # MP4 ('ftyp' compatible brand 'mp41', 'mp42' or 'f4v ') -> top level 'uuid'. XMP => 'MOV',.);.my %dirMap = (. MOV => \%movMap,. MP4 => \%mp4Map,. HEIC => { }, # can't currently write XMP to HEIC files.);..#------------------------------------------------------------------------------.# Check to see if path is current.# Inputs: 0) ExifTool object ref, 1) directory name.# Returns: true if current

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\WriteXMP.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	63676
Entropy (8bit):	4.598173756017062
Encrypted:	false
SSDEEP:	768:Nn99jOk01gyaNVP0Qu6yHCTNQ32vjJjsG+0Ge+PkDHlS9QVkUX:t9tOV1gyaNVcRVHyoSljs9efVk4
MD5:	9AB19A54B96030195D01B036AE2DB522
SHA1:	42B48F458629A6B71698E07757D414117133AF1C
SHA-256:	2DE2AC9D1CDA3B9DCCDC404077990713BD7A895CE16F716270F41B476F273DFC
SHA-512:	B6C37864139D847A797F5E7C33B715BAB7481FAF943AD12327CE5DCE18A082408D1124CD1654C659C68593F8AC495ECAD4BAE15DE1A4B13ECEAF0C876119F20A
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteXMP.pl.#.# Description: Write XMP meta information.#.# Revisions: 12/19/2004 - P. Harvey Created.#------------------------------------------------------------------------------.package Image::ExifTool::XMP;..use strict;.use vars qw(%specialStruct %dateTimeInfo %stdXlatNS);..use Image::ExifTool qw(:DataAccess :Utils);..sub CheckXMP($$$);.sub CaptureXMP($$$;$);.sub SetPropertyPath($$;$$$$);..my $debug = 0;.my $numPadLines = 24; # number of blank padding lines..# when writing extended XMP, resources bigger than this get placed in their own.# rdf:Description so they can be moved to the extended segments if necessary.my $newDescThresh = 10240; # 10 kB..# individual resources and namespaces to place last in separate rdf:Description's.# so they can be moved to extended XMP segments if required (see Oct. 2008 XMP spec).my %extendedRes = (. 'photoshop:History' => 1,. 'xap:Thumbn

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\Writer.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	288324
Entropy (8bit):	4.517373218068747
Encrypted:	false
SSDEEP:	3072:UUxj51AYPZFjHIQoat8+ESVKIr6mABVTyzYW6OsOKHH01+m09tAC8nH2p:J5lFWz+5K6yBVTKcmm82p
MD5:	3A2FDCA28E1D037B44C0DA45A61DCD3E
SHA1:	727BCD78BDBD7525BB31DA6E96A61E422E4478B1
SHA-256:	9067B01F4490FB7DBEB4DAF8205C019A70D912899164A28EB13E38D6FD3801C3
SHA-512:	9FF8F547ED07019AD9A7999652E999D244F2277D8080CF91ECFAD0F78F2768D6BC959CE5D989CC4880B784AD0278776EDD5AEA9436C64A5AA7A02516BE353BE6
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: Writer.pl.#.# Description: ExifTool write routines.#.# Notes: Also contains some less used ExifTool functions.#.# URL: http://owl.phy.queensu.ca/~phil/exiftool/.#.# Revisions: 12/16/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool;..use strict;..use Image::ExifTool::TagLookup qw(FindTagInfo TagExists);.use Image::ExifTool::Fixup;..sub AssembleRational($$@);.sub LastInList($);.sub CreateDirectory($$);.sub NextFreeTagKey($$);.sub RemoveNewValueHash($$$);.sub RemoveNewValuesForGroup($$);.sub GetWriteGroup1($$);.sub Sanitize($$);.sub ConvInv($$$$$;$$);..my $loadedAllTables; # flag indicating we loaded all tables.my $advFmtSelf; # ExifTool during evaluation of advanced formatting expr..# the following is a road map of where we write each directory.# in the different types of files..my %

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\XMP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	160431
Entropy (8bit):	4.722568431109767
Encrypted:	false
SSDEEP:	3072:yBRK8e68Dc4/LmrUL1pVXroV4vutHNwxtiUuhAMiWHvKZV8TAuo4FBj93pMj+EGh:y28e68Dc4/LmrUL1pVXroV4vutHNwxt0
MD5:	3B73E1964AA2696BBB21F9E4163C2DAF
SHA1:	5535C34CD6B5BE94CCFD4FB0E8ECC81DA8FA31DD
SHA-256:	C35E8FBFF52243B34B190C58CB64327AE06FDCED74EC42B93E7BF9032DFA5AD8
SHA-512:	7A74610244AB376A3576721C2CD39B0EE857C0AEF74AEF524D9D7015D29E17BA16353B8B0CEACAF130C1558496B35EE09F1ECB18958F78C9BC3C4A3A17F92626
Malicious:	false
Preview:	#line 1 "Image/ExifTool/XMP.pm".#------------------------------------------------------------------------------.# File: XMP.pm.#.# Description: Read XMP meta information.#.# Revisions: 11/25/2003 - P. Harvey Created.# 10/28/2004 - P. Harvey Major overhaul to conform with XMP spec.# 02/27/2005 - P. Harvey Also read UTF-16 and UTF-32 XMP.# 08/30/2005 - P. Harvey Split tag tables into separate namespaces.# 10/24/2005 - P. Harvey Added ability to parse .XMP files.# 08/25/2006 - P. Harvey Added ability to handle blank nodes.# 08/22/2007 - P. Harvey Added ability to handle alternate language tags.# 09/26/2008 - P. Harvey Added Iptc4xmpExt tags (version 1.0 rev 2).#.# References: 1) http://www.adobe.com/products/xmp/pdfs/xmpspec.pdf.# 2) http://www.w3.org/TR/rdf-syntax-grammar/ (20040210).# 3) http://www.portfoliofaq.com/pfaq/v7mappings.htm.#

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\XMP2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	67804
Entropy (8bit):	4.717564120037501
Encrypted:	false
SSDEEP:	1536:d8s7ZzhINKJ6mDHtpYAOmcCU5gal+T/+ECNVh9PHbg0Wc/5y1XnDfo+Mb5mxm87j:d8eZzhI8J6mDHtpYAOmcCU5gal+7+EuS
MD5:	CF91C26DDEF693887D3A8BC7FC38F962
SHA1:	D7350BE1BCDEA3B957C80010AE1194F75FCBE52D
SHA-256:	073E2C9EA1FA4DA5794CA9FE77DA276D551F17C22230CBE2C888B09B7DFA1748
SHA-512:	28FCD062E3CB43470014FDCEFE1E94A51AC3EF9CB87E62202A83A88C2C325E8E35FDC83CB4E3F52552E5F83839C85D7AFFDA6744BBA3FEF4A6C641B46341E500
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: XMP2.pl.#.# Description: Additional XMP namespace definitions.#.# Revisions: 10/12/2008 - P. Harvey Created.#.# References: 1) PLUS - http://ns.useplus.org/.# 2) PRISM - http://www.prismstandard.org/.# 3) http://www.portfoliofaq.com/pfaq/v7mappings.htm.# 4) http://www.iptc.org/IPTC4XMP/.# 5) http://creativecommons.org/technology/xmp.# --> changed to http://wiki.creativecommons.org/Companion_File_metadata_specification (2007/12/21).# 6) http://www.optimasc.com/products/fileid/xmp-extensions.pdf.# 9) http://www.w3.org/TR/SVG11/.# 11) http://www.extensis.com/en/support/kb_article.jsp?articleNumber=6102211.# 12) XMPSpecificationPart3_May2013, page 58.#------------------------------------------------------------------------------..package Image::ExifTool::XMP;..us

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\XMPStruct.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	36039
Entropy (8bit):	4.473206188151363
Encrypted:	false
SSDEEP:	768:wgtEvRH0awGOdSUAJNRI1dsJn23D6Ketlh7z/X0LqjCVi:PtakSUAJNRI1c777Xmqjqi
MD5:	70289ADE47DAB540149088D7A9CE5A72
SHA1:	856CCC2A8AC47B88AAB16C924314AD01DB6E1ECC
SHA-256:	AD0CD30BFFC4F1654625FE7514A56B5F58E51EEA178597862BB66B954021AD97
SHA-512:	8B71A67FEB07149D6F5FE891C11A4210BB76F7AD3A2B38D3136724CA4E8879767AAB8778B64ACFD7256435512A90CB8ADBD2DC3257E5E0808ABA3DE766A3D77F
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: XMPStruct.pl.#.# Description: XMP structure support.#.# Revisions: 01/01/2011 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::XMP;..use strict;.use vars qw(%specialStruct %stdXlatNS);..use Image::ExifTool qw(:Utils);.use Image::ExifTool::XMP;..sub SerializeStruct($;$);.sub InflateStruct($;$);.sub DumpStruct($;$);.sub CheckStruct($$$);.sub AddNewStruct($$$$$$);.sub ConvertStruct($$$$;$);..#------------------------------------------------------------------------------.# Serialize a structure (or other object) into a simple string.# Inputs: 0) HASH ref, ARRAY ref, or SCALAR, 1) closing bracket (or undef).# Returns: serialized structure string.# eg) "{field=text with {braces\|}\|, and a comma, field2=val2,field3={field4=[a,b]}}".sub SerializeStruct($;$).{. my ($obj, $ket) = @_;. my ($key, $val, @vals, $rtnVal);

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\ZIP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	25563
Entropy (8bit):	4.73423174079388
Encrypted:	false
SSDEEP:	384:AGsC4y1bgLQ8Imz3h9UElIYK+29v7JhXisTlH2o:AGb9gs8Tz3h9UqpK+2V7JhSsp2o
MD5:	1F358D4EC5A7D341A7B02F4B64FCBF2F
SHA1:	A769647BB7945166E0169DF3CDD90A59D4D21C3A
SHA-256:	B9D7E7AFC07D85EDA6887F46984583C803100778814BD09EEB7A1CD22CE2D3B0
SHA-512:	FE14BCDB1492A81F633E7106ABB653BF722D0FAE19041E84FA4A2BB873E3D567E830DFD7EB4B8565988FA4C671FD81D1320527D504E80078A167AA883FAB4823
Malicious:	false
Preview:	#line 1 "Image/ExifTool/ZIP.pm".#------------------------------------------------------------------------------.# File: ZIP.pm.#.# Description: Read ZIP archive meta information.#.# Revisions: 10/28/2007 - P. Harvey Created.#.# References: 1) http://www.pkware.com/documents/casestudies/APPNOTE.TXT.# 2) http://www.cpanforum.com/threads/9046.# 3) http://www.gzip.org/zlib/rfc-gzip.html.# 4) http://DataCompression.info/ArchiveFormats/RAR202.txt.# 5) https://jira.atlassian.com/browse/CONF-21706.# 6) http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/indesign/cs55-docs/IDML/idml-specification.pdf.#------------------------------------------------------------------------------..package Image::ExifTool::ZIP;..use strict;.use vars qw($VERSION $warnString);.use Image::ExifTool qw(:DataAccess :Utils);..$VERSION = '1.21';..sub WarnProc($) { $warnString = $_[0]; }..# file types for recognized Open D

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Image\ExifTool\iWork.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	6994
Entropy (8bit):	5.027774987532687
Encrypted:	false
SSDEEP:	192:uIW071DP7QwcYsopuWKgqb5+CyrO6UhaDHJYBaEW7:uIWwR7EgSU9GBu
MD5:	033EF108194104B64AC4CF8AC2D3BFF3
SHA1:	F4A9B273F90E793155E065CD07B0B4ED4CF9343D
SHA-256:	39FAE842BA26A28646962B181EC2254E13A8C29750819F36800DE09A04C7C80D
SHA-512:	5C92632F648EC1CA22B510CDA82F486B6D3D690E27E1E862FE95B2E22395CF65A4886D158BA138233740CA316FF092ECC7B15F024B04D7BD8BFBCE06AD77801D
Malicious:	false
Preview:	#line 1 "Image/ExifTool/iWork.pm".#------------------------------------------------------------------------------.# File: iWork.pm.#.# Description: Read Apple iWork '09 XML+ZIP files.#.# Revisions: 2009/11/11 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::iWork;..use strict;.use vars qw($VERSION);.use Image::ExifTool qw(:DataAccess :Utils);.use Image::ExifTool::XMP;.use Image::ExifTool::ZIP;..$VERSION = '1.04';..# test for recognized iWork document extensions and outer XML elements.my %iWorkType = (. # file extensions. NUMBERS => 'NUMBERS',. PAGES => 'PAGES',. KEY => 'KEY',. KTH => 'KTH',. NMBTEMPLATE => 'NMBTEMPLATE',. # we don't support double extensions --. # "PAGES.TEMPLATE" => 'Apple Pages Template',. # outer XML elements. 'ls:document' => 'NUMBERS',. 'sl:document' => 'PAGES',. 'key:presentation' => 'KEY',.);..# MIME types for iWork files (Apple

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\List\Util.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	5.284838664605705
Encrypted:	false
SSDEEP:	24:Tt/f8DM0GSALUJ+kX4f1fQxBQ0tZQS0bQFOIIEGMbLzjN2mcRBdH:J/kDFqUJ+kIFQxBQ0tZQS0cFqEGMnXNo
MD5:	8596B5309ECA8D967FFBB93F93B8D0E0
SHA1:	101AD76C3A0FD8DFAE15259F8EF63338C2B98F78
SHA-256:	DDFEEE2E83BC9356279BFA71A6A6DFA620D4B27B1887D52CF0F046FB9CBD8AAC
SHA-512:	03F1009B8100911FA25BE0F822044D9ECFDEF183D3F48BC81FF56EF0610C2B4870DCFDCEF9B6B6945B6CB05F39943B22A311EDC23764D4346F9727B414CBAF17
Malicious:	false
Preview:	#line 1 "List/Util.pm".# Copyright (c) 1997-2009 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself..#.# Maintained since 2013 by Paul Evans <leonerd@leonerd.org.uk>..package List::Util;..use strict;.use warnings;.require Exporter;..our @ISA = qw(Exporter);.our @EXPORT_OK = qw(. all any first min max minstr maxstr none notall product reduce sum sum0 shuffle uniq uniqnum uniqstr. pairs unpairs pairkeys pairvalues pairmap pairgrep pairfirst.);.our $VERSION = "1.45";.our $XS_VERSION = $VERSION;.$VERSION = eval $VERSION;..require XSLoader;.XSLoader::load('List::Util', $XS_VERSION);..sub import.{. my $pkg = caller;.. # (RT88848) Touch the caller's $a and $b, to avoid the warning of. # Name "main::a" used only once: possible typo" warning. no strict 'refs';. ${"${pkg}::a"} = ${"${pkg}::a"};. ${"${pkg}::b"} = ${"${pkg}::b"};.. goto &Exporter::import;.}..# F

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\MIME\Base64.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.34674433089525
Encrypted:	false
SSDEEP:	12:TF1C3cKIDQGQ2mzSN+3KIqNcpcKQTNuT8YQbnJ2UpMOe4FqXhwOlATpLvHaCw:TG31GQCU3KIq+CtxyQDNGn4UX2l9vHaz
MD5:	20EF33303EBF6E397AF3B84E5F782F48
SHA1:	E9048140655FAF98B8EAA50D943365747163B9A2
SHA-256:	A9AEF99115A611B7415DD04EDDF9072D08A334E621248E03929E971F695E94CC
SHA-512:	BE251D9E7A329C5118535EC02D27D2F1A915CC89D5757A597677F27663C9B1E1D4BD387F20A08E4B49BC910B9D36C2444B97F7DF1FE8E134295BEC6AEC81CA58
Malicious:	false
Preview:	#line 1 "MIME/Base64.pm".package MIME::Base64;..use strict;.use vars qw(@ISA @EXPORT @EXPORT_OK $VERSION);..require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(encode_base64 decode_base64);.@EXPORT_OK = qw(encode_base64url decode_base64url encoded_base64_length decoded_base64_length);..$VERSION = '3.15';..require XSLoader;.XSLoader::load('MIME::Base64', $VERSION);..encode = \&encode_base64;.decode = \&decode_base64;..sub encode_base64url {. my $e = encode_base64(shift, "");. $e =~ s/=+\z//;. $e =~ tr[+/][-_];. return $e;.}..sub decode_base64url {. my $s = shift;. $s =~ tr[-_][+/];. $s .= '=' while length($s) % 4;. return decode_base64($s);.}..1;..__END__..#line 189.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigFloat.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	142906
Entropy (8bit):	4.852440619780176
Encrypted:	false
SSDEEP:	3072:1WDQIhCksuHpT44o9gNSDeEfPfmLnC1vOuaa7DKKV3RVwCVzqqw616GnW3HSjLCG:lIrDpT44o9gNSDeEfPfmLC1Wuaa7DDh/
MD5:	7295518A40263D92576103B22456D2F7
SHA1:	A4D3E83AB8BDC7A1578355E197D40D77606C79EC
SHA-256:	66D00DB4E9551648A441FFEB32256823408134B22EE03BBEB12E938BBEEDFED5
SHA-512:	AD431FA98D114861771DDB1AA271FD57DC2E742019F9AABDCC01148CC85E12E36F5F091E2ACC6FDAA7F7DFBAEA7CD05BF043B7F9824BA2862474DA11930A20B0
Malicious:	false
Preview:	#line 1 "Math/BigFloat.pm".package Math::BigFloat;..# .# Mike grinned. 'Two down, infinity to go' - Mike Nostrus in 'Before and After'.#..# The following hash values are internally used:.# _e.: exponent (ref to $CALC object).# _m.: mantissa (ref to $CALC object).# _es.: sign of _e.# sign.: +,-,+inf,-inf, or "NaN" if not a number.# _a.: accuracy.# _p.: precision..use 5.006001;.use strict;.use warnings;..use Carp ();..our $VERSION = '1.999722';.$VERSION = eval $VERSION;..require Exporter;.our @ISA.= qw/Math::BigInt/;.our @EXPORT_OK.= qw/bpi/;..# $_trap_inf/$_trap_nan are internal and should never be accessed from outside.our ($AUTOLOAD, $accuracy, $precision, $div_scale, $round_mode, $rnd_mode,. $upgrade, $downgrade, $_trap_nan, $_trap_inf);..my $class = "Math::BigFloat";..use overload.. # overload key: with_assign.. '+' => sub { $_[0] -> copy() -> badd($_[1]); },.. '-' => sub { my $c = $_[0] -> copy;. $_[2] ? $c -> bneg() -> badd

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigFloat\Trace.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	4.9532613119560525
Encrypted:	false
SSDEEP:	24:RhrEHBWpQmDcGQSAZhJ103f321aXbdPrqGjyPkCR5PVvcNNin2U09J:j4HBiQmDcGQSihJg21KdPrqGG8CrNvNS
MD5:	015776E77C13070DCCF45BE1029E8033
SHA1:	98E4377A0626D34D720D1A7ED194D71A4E30E0AE
SHA-256:	405034CA665A4095F10ACB1F3D75B4662AF9F8F4F6D207CB72A47065576363C1
SHA-512:	545AA47B18E5FA1258FC5B1133D9023C884729C0FEF35E81F1B4702813B6CC51AE0C590C037EB0C703B75E00B3FF7A56F0A7D7334E01D8FDD0ABF5A1B8FAF7AD
Malicious:	false
Preview:	#!perl.#line 2 "Math/BigFloat/Trace.pm"..package Math::BigFloat::Trace;..require 5.006;.use strict;.use warnings;..use Exporter;.use Math::BigFloat;..our ($PACKAGE, @EXPORT_OK, $accuracy, $precision, $round_mode, $div_scale);..our @ISA = qw(Exporter Math::BigFloat);..our $VERSION = '0.42';..use overload; # inherit overload from BigFloat..# Globals.$accuracy = $precision = undef;.$round_mode = 'even';.$div_scale = 40;..sub new {. my $proto = shift;. my $class = ref($proto) \|\| $proto;.. my $value = shift;. my $a = $accuracy;. $a = $_[0] if defined $_[0];. my $p = $precision;. $p = $_[1] if defined $_[1];. my $self = Math::BigFloat->new($value, $a, $p, $round_mode);.. # remember, downgrading may return a BigInt, so don't meddle with class. # bless $self, $class;.. print "MBF new '$value' => '$self' (", ref($self), ")";. return $self;.}..sub import {. print "MBF import ", join(' ', @_);. my $self = shift;.. # we catch the const

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigInt.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	116596
Entropy (8bit):	4.742963039798697
Encrypted:	false
SSDEEP:	768:WYvDF4Cae2mpVksBII8p14gUIaF58WPYxUiuyIHIIsy8+ZO2EuH33DdJz5LzpaBa:dDF4CarIVHBCQ8oYn4yYdJNpaBJxgGAH
MD5:	B2B42EB3BF3E2F447CC13ADE6DCC099B
SHA1:	B06A78AEA5D8DA7951D0A2CBD603917FD61CCC58
SHA-256:	F812161F7EFF3FD4DF1C67C26189C914490FAE047189C5EE46B13E8A9C9D2D4C
SHA-512:	27E003637FA1F2FE2A85B63D57A4A0A06CE48F16F0ACAC7C3971412172E0ECACC77D8A99B992F324F8EA9B30A4A271A325788977BCEFF7B73FCE1E35C5DA2169
Malicious:	false
Preview:	#line 1 "Math/BigInt.pm".package Math::BigInt;..#.# "Mike had an infinite amount to do and a negative amount of time in which.# to do it." - Before and After.#..# The following hash values are used:.# value: unsigned int with actual value (as a Math::BigInt::Calc or similar).# sign : +,-,NaN,+inf,-inf.# _a : accuracy.# _p : precision.# _f : flags, used by MBF to flag parts of a float as untouchable..# Remember not to take shortcuts ala $xs = $x->{value}; $CALC->foo($xs); since.# underlying lib might change the reference!..use 5.006001;.use strict;.use warnings;..use Carp ();..our $VERSION = '1.999722';.$VERSION = eval $VERSION;..our @ISA = qw(Exporter);.our @EXPORT_OK = qw(objectify bgcd blcm);..# _trap_inf and _trap_nan are internal and should never be accessed from the.# outside.our ($round_mode, $accuracy, $precision, $div_scale, $rnd_mode,. $upgrade, $downgrade, $_trap_nan, $_trap_inf);..my $class = "Math::BigInt";..# Inside overload, the first arg is always an

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigInt\Calc.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	68795
Entropy (8bit):	4.793939419041722
Encrypted:	false
SSDEEP:	1536:iDjn7irzsdxRFuOncDoUQ1cb8V1cb8acM78FDhOgV+yVenZjYOtJLsRIjpAf:iDjnkOnXx1j1A+VMOf
MD5:	5AA83F1D710EF9B6477C08E30F3F58C1
SHA1:	E295E824176A4E2C83E72F344AFD4BBC46494562
SHA-256:	7C059A31CCFB8E530BAD15AFA7A0F360CB13087DD649551849106DD75E14E015
SHA-512:	824562B7EEBAC66DB6F8E079313F9F091A9777AD5AC409E12378EFD6F0437C70A21E10BED3510206D07A3F97719900CA66E80302705C268B71CC174E61A4C8AF
Malicious:	false
Preview:	#line 1 "Math/BigInt/Calc.pm".package Math::BigInt::Calc;..use 5.006001;.use strict;.use warnings;..our $VERSION = '1.999722';.$VERSION = eval $VERSION;..# Package to store unsigned big integers in decimal and do math with them..# Internally the numbers are stored in an array with at least 1 element, no.# leading zero parts (except the first) and in base 1eX where X is determined.# automatically at loading time to be the maximum possible value..# todo:.# - fully remove funky $# stuff in div() (maybe - that code scares me...)..# USE_MUL: due to problems on certain os (os390, posix-bc) "* 1e-5" is used.# instead of "/ 1e5" at some places, (marked with USE_MUL). Other platforms.# BS2000, some Crays need USE_DIV instead..# The BEGIN block is used to determine which of the two variants gives the.# correct result...# Beware of things like:.# $i = $i * $y + $car; $car = int($i / $BASE); $i = $i % $BASE;.# This works on x86, but fails on ARM (SA1100, iPAQ) due to who knows what.# reasons. So,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigInt\CalcEmu.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	7914
Entropy (8bit):	5.12942040861184
Encrypted:	false
SSDEEP:	192:Ht6D9w1einp5CjEJvJkbfP63GqJ5CjEJvJktqqW3Gfyh5CjEJvJkHnW3Gm:N6DQsfPmYqq3bn+
MD5:	FB0292C2206D0615AB52A9EA6D89E134
SHA1:	CE0B0AB2663A228FD0E36C23D940CD7E3C3E8F9B
SHA-256:	890E7B76A0FA4125F0BCC13D4D0CFEA7F289D332E4B4F244B775D0CF8A526705
SHA-512:	0C10F55BE6973B7DA268EC11CB3D113CC4ECDD1CDA7779743BC1C526E775BFC9E79A39CCEC00BC7FBE29CA29E1391FDDE1BB064FF91AF6FB9BA46D893A46704E
Malicious:	false
Preview:	#line 1 "Math/BigInt/CalcEmu.pm".package Math::BigInt::CalcEmu;..use 5.006001;.use strict;.use warnings;..our $VERSION = '1.999722';.$VERSION = eval $VERSION;..package Math::BigInt;..# See SYNOPSIS below...my $CALC_EMU;..BEGIN. {. $CALC_EMU = Math::BigInt->config()->{'lib'};. # register us with MBI to get notified of future lib changes. Math::BigInt::_register_callback( __PACKAGE__, sub { $CALC_EMU = $_[0]; } );. }..sub __emu_band. {. my ($self,$x,$y,$sx,$sy,@r) = @_;.. return $x->bzero(@r) if $y->is_zero() \|\| $x->is_zero();. . my $sign = 0;.....# sign of result. $sign = 1 if $sx == -1 && $sy == -1;.. my ($bx,$by);.. if ($sx == -1)....# if x is negative. {. # two's complement: inc and flip all "bits" in $bx. $bx = $x->binc()->as_hex();...# -1 => 0, -2 => 1, -3 => 2 etc. $bx =~ s/-?0x//;. $bx =~ tr/0123456789abcdef/\x0f\x0e\x0d\x0c\x0b\x0a\x09\x08\x07\x06\x05\x04\x03\x02\x01\x00/;. }. else. {. $bx = $x->as_hex();....# get binary representation. $

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigInt\FastCalc.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	4.699004291468873
Encrypted:	false
SSDEEP:	24:TIrYKHylCQ+YK89sBEAT3OIHhFlESvzLQZ0g6:8rZHycQ+rnP+Kh7EwzLQZp6
MD5:	07463A939E3E5BA808209300B8CADAF4
SHA1:	BFDDA89078A4F3809C5A12A6F9C87D077D66F67B
SHA-256:	FC9FA52A90EE0B49CD83A3D971514A1A552B30856F67988406D8E9919D4D72D1
SHA-512:	7FEE7A2CC88082D484794533E2B2E9EE8AFA664C8093EEA4ED8153D45D99A6B5634BF1BB504952FB86C00B9A230CA0A2486F147FA18E60A15B7F4C2A1F833C67
Malicious:	false
Preview:	#line 1 "Math/BigInt/FastCalc.pm".package Math::BigInt::FastCalc;..use 5.006;.use strict;.use warnings;..use Math::BigInt::Calc 1.999706;..our $VERSION = '0.42';..##############################################################################.# global constants, flags and accessory..# announce that we are compatible with MBI v1.83 and up.sub api_version () { 2; }..# use Calc to override the methods that we do not provide in XS..for my $method (qw/. str num. add sub mul div. rsft lsft. mod modpow modinv. gcd. pow root sqrt log_int fac nok. digit check. from_hex from_bin from_oct as_hex as_bin as_oct. zeros base_len. xor or and. alen 1ex. /). {. no strict 'refs';. *{'Math::BigInt::FastCalc::_' . $method} = \&{'Math::BigInt::Calc::_' . $method};. }..require XSLoader;.XSLoader::load(__PACKAGE__, $VERSION, Math::BigInt::Calc::_base_len());..##############################################################################.##########################

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigInt\GMP.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4530
Entropy (8bit):	4.800990008082324
Encrypted:	false
SSDEEP:	96:CXY6QzgQZv/URAmUoLikmJnxkayJaoCe8yQ2DBuXVsjlrj+IBxSxuONxR4uPJYKy:CXY6P2URA6GBO2gTDB2Vsjlrj+M6uONy
MD5:	AB51FA6B1D821344154D8002141D0DDD
SHA1:	0E0F9722057BD8BCC835A2CC9A76371BC7C9651A
SHA-256:	CA4DD540A808A44494AB8D87D66712B0A906E8B616AD638A7B1469F2B9E95F9D
SHA-512:	DD32C3DC1721C2D24F6E490EA1423F38BCF3AAF40A4A91F80B7A79929A24537AA36357FBF635FA0E09C6BE0837C313F69867D270C2CCBD75D8E84F6569B27461
Malicious:	false
Preview:	#line 1 "Math/BigInt/GMP.pm".###############################################################################.# core math lib for BigInt, representing big numbers by the GMP library..package Math::BigInt::GMP;..use 5.006002;.use strict;.use warnings;..our $VERSION = '1.51';..use XSLoader;.XSLoader::load "Math::BigInt::GMP", $VERSION;..sub import { } # catch and throw away.sub api_version() { 2; }..###############################################################################.# Routines not present here are in GMP.xs..##############################################################################.# Return the nth digit, negative values count backward...sub _digit {. my ($c, $x, $n) = @_;.. my $str = _str($c, $x);. $n ++;. substr($str , -$n, 1);.}..# Return a Perl numerical scalar...sub _num {. my ($c, $x) = @_;. return 0 + _str($c, $x);.}..# Return binomial coefficient (n over k). The code is based on _nok() in.# Math::BigInt::Calc...sub _nok {. # Re

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\BigInt\Trace.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.0159543242867
Encrypted:	false
SSDEEP:	24:RerSEHB1pQmDcjQSAZw0yJ103f321aXbdPr3GkkCn9hUcmw:Er7HB3QmDcjQSinyJg21KdPr3GJCn9h1
MD5:	8B4CDF0B2A97FA738BAF468C5EA4A128
SHA1:	E59204DDCA5D584C5674B0624BC17D6BFA93254E
SHA-256:	2617B5ECF7E7FBDDDE21DCFD2B9F8D76B603A328E48B674F4AB7A33865C2BBD7
SHA-512:	7B56DD91A7C191529CA5CF4F95419819C4F0E5F6CDB620929D6C518418D5B072CB5B7D7754986BB51B744B1BED6EBC8826F1EB193FC6001C6A9424D99AAB3C92
Malicious:	false
Preview:	#!perl.#line 2 "Math/BigInt/Trace.pm"..package Math::BigInt::Trace;..require 5.006;.use strict;.use warnings;..use Exporter;.use Math::BigInt;..our ($PACKAGE, @EXPORT_OK, $accuracy, $precision, $round_mode, $div_scale);..our @ISA = qw(Exporter Math::BigInt);..our $VERSION = '0.42';..use overload; # inherit overload from BigInt..# Globals.$accuracy = $precision = undef;.$round_mode = 'even';.$div_scale = 40;..sub new {. my $proto = shift;. my $class = ref($proto) \|\| $proto;.. my $value = shift;. my $a = $accuracy;. $a = $_[0] if defined $_[0];. my $p = $precision;. $p = $_[1] if defined $_[1];. my $self = Math::BigInt->new($value, $a, $p, $round_mode);. bless $self, $class;. print "MBI new '$value' => '$self' (", ref($self), ")";. return $self;.}..sub import {. print "MBI import ", join(' ', @_);. my $self = shift;. Math::BigInt::import($self, @_); # need it for subclasses.# $self->export_to_level(1, $self, @_);

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Math\Complex.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	32327
Entropy (8bit):	5.280985031072386
Encrypted:	false
SSDEEP:	384:S57njESTMpnb3chWG+MOX7qtydxhfl7zhQXLkqQFyuMzwNIBdBd1eEj9O4pzp8Sn:SdnjEegnbMH+Ms7MydxBpzG6e1TOSooh
MD5:	7FF8359A56FA4D52FF1A38B29E7AFA45
SHA1:	6994E773929C9066D33E90E318F44F3803A2985B
SHA-256:	87D2FB71D77E15F07F4F40EBFAB131129BA292D80E6EC36E8F0A6C74A9339672
SHA-512:	73E26C3958521232D9994C8951B9E7BDB5B7A0A496FA709B005C897F7F895E12FC2212F9A95A6F58E5E8FEFB08C6CEB1D802A8B82E35C7B17C90780509685F3E
Malicious:	false
Preview:	#line 1 "Math/Complex.pm".#.# Complex numbers and associated mathematical functions.# -- Raphael Manfredi.Since Sep 1996.# -- Jarkko Hietaniemi.Since Mar 1997.# -- Daniel S. Lewart.Since Sep 1997.#..package Math::Complex;..{ use 5.006; }.use strict;..our $VERSION = 1.59;..use Config;..our($Inf, $ExpInf);.BEGIN {. my %DBL_MAX =..(.. 4 => '1.70141183460469229e+38',.. 8 => '1.7976931348623157e+308',.. # AFAICT the 10, 12, and 16-byte long doubles.. # all have the same maximum... 10 => '1.1897314953572317650857593266280070162E+4932',.. 12 => '1.1897314953572317650857593266280070162E+4932',.. 16 => '1.1897314953572317650857593266280070162E+4932',..);. my $nvsize = $Config{nvsize} \|\|.. ($Config{uselongdouble} && $Config{longdblsize}) \|\|. $Config{doublesize};. die "Math::Complex: Could not figure out nvsize\n"..unless defined $nvsize;. die "Math::Complex: Cannot not figure out max nv (nvsize = $nvsize)\n"..unless defined $DBL_MAX{$nvsize};. my $DBL_MA

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\POSIX.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	19898
Entropy (8bit):	5.438567841293984
Encrypted:	false
SSDEEP:	384:Pj/BcTuIsYpkKn3d1HzDlBo/EmAau6p6EgYyzqyX7ySGLeiSh7tjw8y+6:Pj/BbfgDaX67LqoNweiSh7Pyt
MD5:	3226E1269650BC2F4262FE42D5A89491
SHA1:	91D37A6633DF79185BED19C87348ADA1CE118C50
SHA-256:	7A701B027C04D7F79F6F799516EA4F0CFED82283B75FC74EC8D33DC2E8527AD6
SHA-512:	73CE583C2133D7D85992DF39CBCA778E25EF8234A09C0760558D33703E2F0AA1E1326E3BC91E0CA0455EBD5334E038DD15F1BFB2A76C509F5C63F9542ACECEAF
Malicious:	false
Preview:	#line 1 "POSIX.pm".package POSIX;.use strict;.use warnings;..our ($AUTOLOAD, %SIGRT);..our $VERSION = '1.65';..require XSLoader;..use Fcntl qw(FD_CLOEXEC F_DUPFD F_GETFD F_GETFL F_GETLK F_RDLCK F_SETFD.. F_SETFL F_SETLK F_SETLKW F_UNLCK F_WRLCK O_ACCMODE O_APPEND.. O_CREAT O_EXCL O_NOCTTY O_NONBLOCK O_RDONLY O_RDWR O_TRUNC.. O_WRONLY SEEK_CUR SEEK_END SEEK_SET.. S_ISBLK S_ISCHR S_ISDIR S_ISFIFO S_ISREG.. S_IRGRP S_IROTH S_IRUSR S_IRWXG S_IRWXO S_IRWXU S_ISGID S_ISUID.. S_IWGRP S_IWOTH S_IWUSR S_IXGRP S_IXOTH S_IXUSR);..my $loaded;..sub import {. my $pkg = shift;.. load_imports() unless $loaded++;.. # Grandfather old foo_h form to new :foo_h form. s/^(?=\w+_h$)/:/ for my @list = @_;.. local $Exporter::ExportLevel = 1;. Exporter::import($pkg,@list);.}..sub croak { require Carp; goto &Carp::croak }.sub usage { croak "Usage: POSIX::$_[0]" }..XSLoader::load();..my %replacement = (. atexit => 'END {}',. atof => undef,. atoi

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\QuickTimeStream.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	40391
Entropy (8bit):	4.749772624883574
Encrypted:	false
SSDEEP:	768:LohyJVXemIF3sy62BVQJ1qYYLMj03qZiKTa5QBUaaRTD0xYgzKJgNxoM:CyzXemIF42BWJ1qYYLMjOqve5bRTDqN5
MD5:	E612A52799FBDB1D483776F59A98E0CB
SHA1:	7B13D2E0357E4809B496E3E195C6706D581808B1
SHA-256:	046D63F69159AECC26F9279AF07BEF7351DC3C3EF0B083A23194FB08E16469DC
SHA-512:	F26D709F18833F157D64136C7901CE783CA2548929D27E7AE1A5C00DA1F05EFAC193F551758C81ACC90587C89CAD3E29A407DCFB638D891A767E46007C1AEEF6
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: QuickTimeStream.pl.#.# Description: Extract embedded information from QuickTime movie data.#.# Revisions: 2018-01-03 - P. Harvey Created.#.# References: 1) https://developer.apple.com/library/content/documentation/QuickTime/QTFF/QTFFChap3/qtff3.html#//apple_ref/doc/uid/TP40000939-CH205-SW130.# 2) http://sergei.nz/files/nvtk_mp42gpx.py.# 3) https://forum.flitsservice.nl/dashcam-info/dod-ls460w-gps-data-uit-mov-bestand-lezen-t87926.html.#------------------------------------------------------------------------------.package Image::ExifTool::QuickTime;..use strict;..# QuickTime data types that have ExifTool equivalents.# (ref https://developer.apple.com/library/content/documentation/QuickTime/QTFF/Metadata/Metadata.html#//apple_ref/doc/uid/TP40000939-CH1-SW35).my %qtFmt = (. 0 => 'undef',. 1 => 'string', # (UTF-8). # 2 - UTF-16. # 3 - shift-JIS. #

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Scalar\Util.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1466
Entropy (8bit):	5.214738700065349
Encrypted:	false
SSDEEP:	24:T7f8DM0GSALEzJ+k5MXV1UeQ3fLQSulMQ8QOBRZBWOfxWg2MHgPxW1q2MHpAK6Dj:XkDFq4J+k5MbTQ3DQSu98QkRZEOfxb4u
MD5:	E3376E88312F1C03C4E9B93DEF7140A7
SHA1:	CC6CDABB38125A6B58F175437E713A48349FBE1C
SHA-256:	808EED8B0A1FEF02E87B79326AD54E068E7FA004F3D552E66F838A5AC6C7EDD9
SHA-512:	4FE0E3FBC4FB950C1696F1BD2E3440864F9D9E18086AF046602D4F8507B201A98441A1C0946262CD3CC131D7276B815742371FE6D5491CDD7D298491791B3E90
Malicious:	false
Preview:	#line 1 "Scalar/Util.pm".# Copyright (c) 1997-2007 Graham Barr <gbarr@pobox.com>. All rights reserved..# This program is free software; you can redistribute it and/or.# modify it under the same terms as Perl itself..#.# Maintained since 2013 by Paul Evans <leonerd@leonerd.org.uk>..package Scalar::Util;..use strict;.use warnings;.require Exporter;..our @ISA = qw(Exporter);.our @EXPORT_OK = qw(. blessed refaddr reftype weaken unweaken isweak.. dualvar isdual isvstring looks_like_number openhandle readonly set_prototype. tainted.);.our $VERSION = "1.45";.$VERSION = eval $VERSION;..require List::Util; # List::Util loads the XS.List::Util->VERSION( $VERSION ); # Ensure we got the right XS version (RT#100863)..our @EXPORT_FAIL;..unless (defined &weaken) {. push @EXPORT_FAIL, qw(weaken);.}.unless (defined &isweak) {. push @EXPORT_FAIL, qw(isweak isvstring);.}.unless (defined &isvstring) {. push @EXPORT_FAIL, qw(isvstring);.}..sub export_fail {. if (grep { /^(?:weaken\|isweak)

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\SelectSaver.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	379
Entropy (8bit):	5.066028081177459
Encrypted:	false
SSDEEP:	6:TFzQ62hGQEsQFabDpeF39U9EFKOe+ImPI4RFYhoI4aXs6osODUPFN8EQjsJDB:TFUdhhEsQUZe5S9rOe+IONQiaXwsfFN1
MD5:	F36D8B5D4F20FA2537511A13DFBA14D1
SHA1:	3352C9FDC3A8E471F637E936D390276E9C6AB2D6
SHA-256:	403613756E4680B043C3D9F92E4A63057322081D5D60D8E029F42FA453127C1A
SHA-512:	2D096FBADF75832BD6D9E99D1226C180CD1F07892E251EF908C018F43FF93142F7074B515C9C56962CAE56A9697D446D2562DCC6CBF3843E29390DA2072D731C
Malicious:	false
Preview:	#line 1 "SelectSaver.pm".package SelectSaver;..our $VERSION = '1.02';..#line 36..require 5.000;.use Carp;.use Symbol;..sub new {. @_ >= 1 && @_ <= 2 or croak 'usage: SelectSaver->new( [FILEHANDLE] )';. my $fh = select;. my $self = bless \$fh, $_[0];. select qualify($_[1], caller) if @_ > 1;. $self;.}..sub DESTROY {. my $self = $_[0];. select $$self;.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Shift.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	23380
Entropy (8bit):	4.63773130169161
Encrypted:	false
SSDEEP:	384:B6FJ+IuEPJyiuNt9rsnaKO7SawCDi5h+gJbnnF94ne0eV6QI0X77kXWGE:8iIuEPJyiuNt9rsaK+1wC23+g1nB0eV9
MD5:	A641896C8EFD4FD1039B7237F2C73282
SHA1:	8AE5F4BFAE7B53975D6E7805B0105015D84CABC0
SHA-256:	D1AA363BAC4A2F84AE1D8ED8C929B0715B5C9641678541D81EE9969558209873
SHA-512:	757CA7606B4BCEEB86D412D08CCD0CF9734763A8D03271C439E82DCE817247D3A2E67F00E74ED5F87B5830130A679DBB405F984C9FA0FF69AF8B489B527224C3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: Shift.pl.#.# Description: ExifTool time shifting routines.#.# Revisions: 10/28/2005 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool;..use strict;..sub ShiftTime($$;$$);..#------------------------------------------------------------------------------.# apply shift to value in new value hash.# Inputs: 0) ExifTool ref, 1) shift type, 2) shift string, 3) raw date/time value,.# 4) new value hash ref.# Returns: error string or undef on success and updates value in new value hash.sub ApplyShift($$$$;$).{. my ($self, $func, $shift, $val, $nvHash) = @_;.. # get shift direction from first character in shift string. my $pre = ($shift =~ s/^(\+\|-)//) ? $1 : '+';. my $dir = ($pre eq '+') ? 1 : -1;. my $tagInfo = $$nvHash{TagInfo};. my $tag = $$tagInfo{Name};. my $shiftOffset;. if ($$nvHash{Shi

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Socket.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	13671
Entropy (8bit):	5.5164435020942095
Encrypted:	false
SSDEEP:	192:r3LL1tSeFNTlHqMeFqwx1+S7CcpWg2Tqmpbk3zNlV3CZWhZDghamX2sZ0KUZKpyA:rPqeFZJqMeFbx19p92TRw8ZW/gTXH
MD5:	F11CCD3435B5ACE43609BB57F103DF65
SHA1:	F82B22E0A105AE03232EDAC3A95A464414D0F2C2
SHA-256:	237C14357A6222AD5823E1450613D85EE68F57572882E25D3036589CA2367498
SHA-512:	8F1B9BC0851608EB082D364A46E03DCE1CC01D758133E9F0EBE4F128D0E79A7D9D0F8070AAD220BFF7D7E19F73BECE89D09EEB7F129448CC7601C1B73A90B765
Malicious:	false
Preview:	#line 1 "Socket.pm".package Socket;..use strict;.{ use 5.006001; }..our $VERSION = '2.021';..#line 64..#line 73..#line 156..# Still undocumented: SCM_*, SOMAXCONN, IOV_MAX, UIO_MAXIOV..#line 165..#line 295..#line 299..#line 548..#line 677..#line 686..use Carp;.use warnings::register;..require Exporter;.require XSLoader;.our @ISA = qw(Exporter);..# <@Nicholas> you can't change @EXPORT without breaking the implicit API.# Please put any new constants in @EXPORT_OK!..# List re-ordered to match documentation above. Try to keep the ordering.# consistent so it's easier to see which ones are or aren't documented..our @EXPORT = qw(..PF_802 PF_AAL PF_APPLETALK PF_CCITT PF_CHAOS PF_CTF PF_DATAKIT..PF_DECnet PF_DLI PF_ECMA PF_GOSIP PF_HYLINK PF_IMPLINK PF_INET PF_INET6..PF_ISO PF_KEY PF_LAST PF_LAT PF_LINK PF_MAX PF_NBS PF_NIT PF_NS PF_OSI..PF_OSINET PF_PUP PF_ROUTE PF_SNA PF_UNIX PF_UNSPEC PF_USER PF_WAN..PF_X25...AF_802 AF_AAL AF_APPLETALK AF_CCITT AF_CHAOS AF_CTF AF_DATAKIT..AF_DECnet AF_DLI AF

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Symbol.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2130
Entropy (8bit):	5.223526267994293
Encrypted:	false
SSDEEP:	48:kUxL/8rd4J8QJCAA8fMyhlt29XalxPF9IacSFH1nGo/FBOw:kq/4WJ8w3tCsFfIacS5tN/vOw
MD5:	7ADA0E77A960741A58DF4DC1AD10AFE9
SHA1:	85B92EA2CD4B35E8EFC8CA814211EA2ABF97EC52
SHA-256:	34C1B7A2C600AECAB2D36CD2F93B1832D7A530C8985C86190F13C8DB3804DF92
SHA-512:	F99749E55675DBF581A192850A5E495991728FF28AAD13D89FA44FFD65AED141527F6E07EA45BF4A194916D390A45F266B72225DA629F47EA19136CB4500ECA3
Malicious:	false
Preview:	#line 1 "Symbol.pm".package Symbol;..#line 80..BEGIN { require 5.005; }..require Exporter;.@ISA = qw(Exporter);.@EXPORT = qw(gensym ungensym qualify qualify_to_ref);.@EXPORT_OK = qw(delete_package geniosym);..$VERSION = '1.07';..my $genpkg = "Symbol::";.my $genseq = 0;..my %global = map {$_ => 1} qw(ARGV ARGVOUT ENV INC SIG STDERR STDIN STDOUT);..#.# Note that we never _copy_ the glob; we just make a ref to it..# If we did copy it, then SVf_FAKE would be set on the copy, and.# glob-specific behaviors (e.g. C<$ref = \&func>) wouldn't work..#.sub gensym () {. my $name = "GEN" . $genseq++;. my $ref = \{$genpkg . $name};. delete $$genpkg{$name};. $ref;.}..sub geniosym () {. my $sym = gensym();. # force the IO slot to be filled. select(select $sym);. *$sym{IO};.}..sub ungensym ($) {}..sub qualify ($;$) {. my ($name) = @_;. if (!ref($name) && index($name, '::') == -1 && index($name, "'") == -1) {..my $pkg;..# Global names: special character, "^xyz", or other.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Term\Cap.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	13067
Entropy (8bit):	4.609778686913896
Encrypted:	false
SSDEEP:	192:podS2IbnWoHjHoa9HysmvOyUTa4xpMfy/0zQHY0KsS6xCy7yTTKKOh9Id2/KNMTj:pT2IibObxshd2hhOkOGbxBx
MD5:	2A7AD7CF4E60A7831C9D8B70BAA90EC2
SHA1:	6F03159ED8FB0E17E25E3C6F5CD771C73C295B41
SHA-256:	C75CB5AE89165C3D296367D070D2862B5F4ACC53E241B44EA9585313BF39FAC6
SHA-512:	6E6F8846C7DE237C46C491B03D9A9A4338BA8D5CBE02F30FE47D5B98341617C2F1E602E3270C7ACF67D934E20A52FA059CA26700E6AC011D89017C2674DC4FE1
Malicious:	false
Preview:	#line 1 "Term/Cap.pm".package Term::Cap;..# Since the debugger uses Term::ReadLine which uses Term::Cap, we want.# to load as few modules as possible. This includes Carp.pm..sub carp.{. require Carp;. goto &Carp::carp;.}..sub croak.{. require Carp;. goto &Carp::croak;.}..use strict;..use vars qw($VERSION $VMS_TERMCAP);.use vars qw($termpat $state $first $entry);..$VERSION = '1.17';..# TODO:.# support Berkeley DB termcaps.# force $FH into callers package?.# keep $FH in object at Tgetent time?..#line 63..# Preload the default VMS termcap..# If a different termcap is required then the text of one can be supplied.# in $Term::Cap::VMS_TERMCAP before Tgetent is called...if ( $^O eq 'VMS' ).{. chomp( my @entry = <DATA> );. $VMS_TERMCAP = join '', @entry;.}..# Returns a list of termcap files to check...sub termcap_path.{ ## private. my @termcap_path;.. # $TERMCAP, if it's a filespec. push( @termcap_path, $ENV{TERMCAP} ). if (. ( exists $ENV{TERMCAP} )

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Tie\Handle.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1681
Entropy (8bit):	5.2268419352626685
Encrypted:	false
SSDEEP:	48:6QYUJOXw6s4rEmQrghdhn4zrghdW8rY7rghde8v8Zn8Q:6QYwywH4wDEhd2zEhdVM7Ehdt0Z8Q
MD5:	79D0F8E1BB714C5AB29D2F970FFD695A
SHA1:	3D149DECA62085B76139D7292C6F4CCD94A61BA5
SHA-256:	0D788CB546E5D79BD28B7425A426F40BA902EE44637D99A38AFDFF7A8FFCAD1A
SHA-512:	934940A35008FF82E802C586378BE8FD292B626D2915E6206F95EA77C8F164B1AE25077E329183CD87B1646C67C8166E00B3DFF574D031295F01B9AECEFA366C
Malicious:	false
Preview:	#line 1 "Tie/Handle.pm".package Tie::Handle;..use 5.006_001;.our $VERSION = '4.2';..# Tie::StdHandle used to be inside Tie::Handle. For backwards compatibility.# loading Tie::Handle has to make Tie::StdHandle available..use Tie::StdHandle;..#line 122..use Carp;.use warnings::register;..sub new {. my $pkg = shift;. $pkg->TIEHANDLE(@_);.}..# "Grandfather" the new, a la Tie::Hash..sub TIEHANDLE {. my $pkg = shift;. if (defined &{"{$pkg}::new"}) {..warnings::warnif("WARNING: calling ${pkg}->new since ${pkg}->TIEHANDLE is missing");..$pkg->new(@_);. }. else {..croak "$pkg doesn't define a TIEHANDLE method";. }.}..sub PRINT {. my $self = shift;. if($self->can('WRITE') != \&WRITE) {..my $buf = join(defined $, ? $, : "",@_);..$buf .= $\ if defined $\;..$self->WRITE($buf,length($buf),0);. }. else {..croak ref($self)," doesn't define a PRINT method";. }.}..sub PRINTF {. my $self = shift;. . if($self->can('WRITE') != \&WRITE) {..my $buf = sprintf(shif

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Tie\Hash.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	5.15061065822828
Encrypted:	false
SSDEEP:	48:FQUiiwh5denscTrELV93Ri/kl3z/SN+ErXadl6X+EeFN8fn:FQ0wsscTwfRi/c3z/Q+tsX+LIn
MD5:	DE6F23802FE4007C3135E3936FE7B2A9
SHA1:	F98E1F95B5D32D754AE7FB9819766F2A9F772F32
SHA-256:	44F5912FC3070F7076940DA3D77683AD8A371325940383B97821848FB77F89FA
SHA-512:	F90592CF1C3BA4880D30C03F8593BA5C62ACD2F601286440AFAB1012FBBC485881C9F2B7330AE15AA1DCB185F1278041554E170E24FE73625B2E632CF5D7CB3C
Malicious:	false
Preview:	#line 1 "Tie/Hash.pm".package Tie::Hash;..our $VERSION = '1.05';..#line 189..use Carp;.use warnings::register;..sub new {. my $pkg = shift;. $pkg->TIEHASH(@_);.}..# Grandfather "new"..sub TIEHASH {. my $pkg = shift;. my $pkg_new = $pkg -> can ('new');.. if ($pkg_new and $pkg ne __PACKAGE__) {. my $my_new = __PACKAGE__ -> can ('new');. if ($pkg_new == $my_new) { . #. # Prevent recursion. #. croak "$pkg must define either a TIEHASH() or a new() method";. }...warnings::warnif ("WARNING: calling ${pkg}->new since " .. "${pkg}->TIEHASH is missing");..$pkg -> new (@_);. }. else {..croak "$pkg doesn't define a TIEHASH method";. }.}..sub EXISTS {. my $pkg = ref $_[0];. croak "$pkg doesn't define an EXISTS method";.}..sub CLEAR {. my $self = shift;. my $key = $self->FIRSTKEY(@_);. my @keys;.. while (defined $key) {..push @keys, $key;..$key = $self->NEXTKEY(@_, $ke

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Tie\StdHandle.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	831
Entropy (8bit):	5.373342926684022
Encrypted:	false
SSDEEP:	12:TFIZqbDVsQiS0KQN74nyY0Vz9G2rsNgn2QQ+l1EAZt93KRFhM7/znVP6vy4XskvP:TZsQiPtRTYKG2g6jERg7LVh4XBvX/
MD5:	5A951D4166396788FC62FBBE5F3EC745
SHA1:	5A568244266EB427C1934D7737533C5CA8DA9678
SHA-256:	6E156297C3A26478A74B9766FCF8F036DE55BC4A4DE17512D67FB62C39281A9F
SHA-512:	F1F22E111DAD8C2ED53CA326BCA32F795BA8711A244215229C571CFC75622674620EFB2804602771DF290C2E3540AB6312F590C81117FF57E943EA5FEE77E01D
Malicious:	false
Preview:	#line 1 "Tie/StdHandle.pm".package Tie::StdHandle; ..use strict;..use Tie::Handle;.use vars qw(@ISA $VERSION);.@ISA = 'Tie::Handle';.$VERSION = '4.4';..#line 37..sub TIEHANDLE .{. my $class = shift;. my $fh = \do { local *HANDLE};. bless $fh,$class;. $fh->OPEN(@_) if (@_);. return $fh;.}..sub EOF { eof($_[0]) }.sub TELL { tell($_[0]) }.sub FILENO { fileno($_[0]) }.sub SEEK { seek($_[0],$_[1],$_[2]) }.sub CLOSE { close($_[0]) }.sub BINMODE { binmode($_[0]) }..sub OPEN.{. $_[0]->CLOSE if defined($_[0]->FILENO);. @_ == 2 ? open($_[0], $_[1]) : open($_[0], $_[1], $_[2]);.}..sub READ { &CORE::read(shift, \shift, @_) }.sub READLINE { my $fh = $_[0]; <$fh> }.sub GETC { getc($_[0]) }..sub WRITE.{. my $fh = $_[0];. local $\; # don't print any line terminator. print $fh substr($_[1], $_[3], $_[2]);.}...1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Time\HiRes.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.353637000139589
Encrypted:	false
SSDEEP:	48:cdpiOrHsILmg6gegBgTZ0o79yBsRzYRQUVBQ0tbQKmWNkRWtKdeiSh0PXTcsPTsM:cBOg6gegBgTZ0xMYRQWBQQbQPGKSh0OQ
MD5:	F7A3B90BFA7DC35F69929D957B0364CD
SHA1:	6CEE5569B558CF953A35AB55BDF54AC1A3FB4BB4
SHA-256:	792BE9C9F88DA1D949065AA893E4EC73BC54B3F8500A19281E1DE21DB2057F02
SHA-512:	8DBE73BE0E9D2639F4EC8DEFAFB40B9946097F55DF19C440DE09539C61AC3A74844238D5F2901B65EE35A9D185C7F70F13D12566D7B28F31C36CE3DF224A272F
Malicious:	false
Preview:	#line 1 "Time/HiRes.pm".package Time::HiRes;..{ use 5.006; }.use strict;..require Exporter;.require DynaLoader;..our @ISA = qw(Exporter DynaLoader);..our @EXPORT = qw( );.our @EXPORT_OK = qw (usleep sleep ualarm alarm gettimeofday time tv_interval... getitimer setitimer nanosleep clock_gettime clock_getres... clock clock_nanosleep... CLOCK_BOOTTIME CLOCK_HIGHRES... CLOCK_MONOTONIC CLOCK_MONOTONIC_COARSE... CLOCK_MONOTONIC_PRECISE CLOCK_MONOTONIC_RAW... CLOCK_PROCESS_CPUTIME_ID... CLOCK_REALTIME CLOCK_REALTIME_COARSE... CLOCK_REALTIME_FAST CLOCK_REALTIME_PRECISE... CLOCK_SECOND CLOCK_SOFTTIME CLOCK_THREAD_CPUTIME_ID... CLOCK_TIMEOFDAY CLOCKS_PER_SEC... ITIMER_REAL ITIMER_VIRTUAL ITIMER_PROF ITIMER_REALPROF... TIMER_ABSTIME... d_usleep d_ualarm d_gettimeofday d_getitimer d_setitimer... d_nanosleep d_clock_gettime d_clock_getres... d_clock d_clock_nanosleep... stat lstat...);..our $VERSION = '1.9733';.our $XS_VERSION = $VERSION;.$VERSION = eval $VERSION;..our $AUTOLOAD;.sub AUTOLOAD {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Time\Local.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5234
Entropy (8bit):	4.925331747979437
Encrypted:	false
SSDEEP:	96:glQhNAtP7KoK1YBG3+YYFNPK6gyeHVLxayEj7b/JJdR36K+dZDPWpPrB47zGOk:gl+sTlK1YBG3rYFNPK6e1LsyEjBJz6K1
MD5:	DE16D91BA9ACDAC733D6E1DAFD0E54B8
SHA1:	56A02480FC97256E8E14A91DD119699F41F06E53
SHA-256:	C18F3B79B135472E80353C4B3BC1110BF6238619B7AE7DB44AB4B7E162347E7D
SHA-512:	49182F9B31E1C1727773BCE316D37626937D6AD58C36C5C86F701F54D76C2B894AC104DD41B22D1E9B0831C0D4E447F5A2231748BE9E54AFD84BBC62F154EE65
Malicious:	false
Preview:	#line 1 "Time/Local.pm".package Time::Local;..require Exporter;.use Carp;.use Config;.use strict;..use vars qw( $VERSION @ISA @EXPORT @EXPORT_OK );.$VERSION = '1.2300';..@ISA = qw( Exporter );.@EXPORT = qw( timegm timelocal );.@EXPORT_OK = qw( timegm_nocheck timelocal_nocheck );..my @MonthDays = ( 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 );..# Determine breakpoint for rolling century.my $ThisYear = ( localtime() )[5];.my $Breakpoint = ( $ThisYear + 50 ) % 100;.my $NextCentury = $ThisYear - $ThisYear % 100;.$NextCentury += 100 if $Breakpoint < 50;.my $Century = $NextCentury - 100;.my $SecOff = 0;..my ( %Options, %Cheat );..use constant SECS_PER_MINUTE => 60;.use constant SECS_PER_HOUR => 3600;.use constant SECS_PER_DAY => 86400;..my $MaxDay;.if ($] < 5.012000) {. my $MaxInt;. if ( $^O eq 'MacOS' ) {. # time_t is unsigned.... $MaxInt = ( 1 << ( 8 * $Config{ivsize} ) ) - 1;. }. else {. $MaxInt = ( ( 1 << ( 8 * $Config{ivsize} - 2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Time\Piece.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	14722
Entropy (8bit):	5.030114612364101
Encrypted:	false
SSDEEP:	384:CRgsRa/lGq1KLZbOE815vBUuzCm/zeqlPfQDvWD20:CRk/lGq1KLZbOESUuzpzeqlPfeWD20
MD5:	F5E3E40811E39D0B0A43C4C6A2634AB6
SHA1:	9D197F660C0E623838F224F1A051489511F18208
SHA-256:	5D36C221FA3D937352F0DB94F6313D178E9118CA0FA6D17741830BE0A200F1E6
SHA-512:	FEB27A86E10F4403787369C1962F787EB7C5B248FC38214E043C82F03FBCE7318224AAC5B3E57C6A25BAE367C635D4C068D712192D6015C54274162A8BBC2B15
Malicious:	false
Preview:	#line 1 "Time/Piece.pm".package Time::Piece;..use strict;..require DynaLoader;.use Time::Seconds;.use Carp;.use Time::Local;..our @ISA = qw(DynaLoader);. .use Exporter ();..our @EXPORT = qw(. localtime. gmtime.);..our %EXPORT_TAGS = (. ':override' => 'internal',. );..our $VERSION = '1.31';..bootstrap Time::Piece $VERSION;..my $DATE_SEP = '-';.my $TIME_SEP = ':';.my @MON_LIST = qw(Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec);.my @FULLMON_LIST = qw(January February March April May June July. August September October November December);.my @DAY_LIST = qw(Sun Mon Tue Wed Thu Fri Sat);.my @FULLDAY_LIST = qw(Sunday Monday Tuesday Wednesday Thursday Friday Saturday);..use constant {. 'c_sec' => 0,. 'c_min' => 1,. 'c_hour' => 2,. 'c_mday' => 3,. 'c_mon' => 4,. 'c_year' => 5,. 'c_wday' => 6,. 'c_yday' => 7,. 'c_isdst' => 8,. 'c_epoch' => 9,. 'c_islocal' => 10,.};..sub localtime {. unshift @_, __PACKAGE__ unless eval { $_[0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Time\Seconds.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3254
Entropy (8bit):	4.959323081535998
Encrypted:	false
SSDEEP:	96:6hQbHQniPPZmMDJ0gJx3Eg3gdqegdkhpnrqJxLTpMpKOW0A:6h2HQiPPlD31fQdq5dkhprqJlTiEOW0A
MD5:	EA8424E23CDBE65BBDDBE31012EA808B
SHA1:	2DD20EB929D1D1FC050EAEE328FA2917B8FCC87A
SHA-256:	7ED22D0265F8F86CF0DF1CB49649B494B903EEB10C891E749F1384E6AF30FFA8
SHA-512:	591D7CFC20CF7F640F92378B4F132918F8FFE0328D2B2D755ECBBB619D51C8C63A2E0FAC58BA392B76E4EE4AB14CD3E81AE332A7ECA3E087D71EEDAB81EFFD3C
Malicious:	false
Preview:	#line 1 "Time/Seconds.pm".package Time::Seconds;.use strict;..our $VERSION = '1.31';..use Exporter 5.57 'import';..our @EXPORT = qw(. ONE_MINUTE. ONE_HOUR. ONE_DAY. ONE_WEEK. ONE_MONTH. ONE_YEAR. ONE_FINANCIAL_MONTH. LEAP_YEAR. NON_LEAP_YEAR.);..our @EXPORT_OK = qw(cs_sec cs_mon);..use constant {. ONE_MINUTE => 60,. ONE_HOUR => 3_600,. ONE_DAY => 86_400,. ONE_WEEK => 604_800,. ONE_MONTH => 2_629_744, # ONE_YEAR / 12. ONE_YEAR => 31_556_930, # 365.24225 days. ONE_FINANCIAL_MONTH => 2_592_000, # 30 days. LEAP_YEAR => 31_622_400, # 366 * ONE_DAY. NON_LEAP_YEAR => 31_536_000, # 365 * ONE_DAY. # hacks to make Time::Piece compile once again. cs_sec => 0,. cs_mon => 1,.};..use overload. 'fallback' => 'undef',. '0+' => \&seconds,. '""' => \&seconds,. '<=>' => \&compare,. '+' => \&add,. '-' => \&subtract,. '-=' => \&subtract_from,. '+=' => \&add_to,. '=' => \©..sub new {. my $class = shift;. my

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	28019
Entropy (8bit):	5.083526378858572
Encrypted:	false
SSDEEP:	768:uMn5YUzdMyTP3IU9dUH2yosTBF4/vNYPgC3sdb4LCfPCpE12/GQytYbxg/a7FRJ+:H5YUzd5TP3IU9dUH2yosTBF4/vNYPgCI
MD5:	81DD347655C3A5B6C267D4D2E10A582B
SHA1:	90193AEB971547986D675D242197180359B95588
SHA-256:	E450C7AE8D780D49EDCE0159BB2B5991DD531CDADCF8C7F840E2FB8F2F12EEFE
SHA-512:	4EA215974DEE39126C81B2C01A4F73683F2F700B629C46FAB451CBF1F19E64737551172A69AC72E8881CEE85D97290233788B78C944AB6014D3BE90C9182917C
Malicious:	false
Preview:	#line 1 "Win32.pm".package Win32;..# BEGIN {. use strict;. use vars qw\|$VERSION $XS_VERSION @ISA @EXPORT @EXPORT_OK\|;.. require Exporter;. require DynaLoader;.. @ISA = qw\|Exporter DynaLoader\|;. $VERSION = '0.52';. $XS_VERSION = $VERSION;. $VERSION = eval $VERSION;.. @EXPORT = qw(..NULL..WIN31_CLASS..OWNER_SECURITY_INFORMATION..GROUP_SECURITY_INFORMATION..DACL_SECURITY_INFORMATION..SACL_SECURITY_INFORMATION..MB_ICONHAND..MB_ICONQUESTION..MB_ICONEXCLAMATION..MB_ICONASTERISK..MB_ICONWARNING..MB_ICONERROR..MB_ICONINFORMATION..MB_ICONSTOP. );. @EXPORT_OK = qw(. GetOSName. SW_HIDE. SW_SHOWNORMAL. SW_SHOWMINIMIZED. SW_SHOWMAXIMIZED. SW_SHOWNOACTIVATE.. CSIDL_DESKTOP. CSIDL_PROGRAMS. CSIDL_PERSONAL. CSIDL_FAVORITES. CSIDL_STARTUP. CSIDL_RECENT. CSIDL_SENDTO. CSIDL_STARTMENU. CSIDL_MYMUSIC. CSIDL_MYVIDEO. CSIDL_DESKTOPDIRECTORY. CSIDL_NET

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32API\File.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	22389
Entropy (8bit):	5.564784819984065
Encrypted:	false
SSDEEP:	384:RaNY0uJLnEZIyN8RYNJdHkeYX0mVhpHXdRAZ7fdodGGoC8B0CkV1LmzLohXQTog5:RaNY0uJLA1N8aNJZkYWjHI1dodGTdVz1
MD5:	ACE3E08A3028263137289C59CF38CEB9
SHA1:	1F80A9596395C099E212ED6EDBA973C2627D2359
SHA-256:	EEE869F0E51C0C250272C17600032A89A7C75E86E7E8281E871A786B1C8BC6B1
SHA-512:	2C80B3FD430498E749E021BC4217E636E66033CF5FC53503525769A5FF851D387008A359D69E59FD11327D5C6474C1F768D871CA45B5ED636E2C53C0698FF82D
Malicious:	false
Preview:	#line 1 "Win32API/File.pm".# File.pm -- Low-level access to Win32 file/dir functions/constants...package Win32API::File;..use strict;.use integer;.use Carp;.use Config qw( %Config );.use Fcntl qw( O_RDONLY O_RDWR O_WRONLY O_APPEND O_BINARY O_TEXT );.use vars qw( $VERSION @ISA );.use vars qw( @EXPORT @EXPORT_OK @EXPORT_FAIL %EXPORT_TAGS );..$VERSION= '0.1203';..use base qw( Exporter DynaLoader Tie::Handle IO::File );..# Math::BigInt optimizations courtesy of Tels.my $_64BITINT;.BEGIN {. $_64BITINT = defined($Config{use64bitint}) &&. ($Config{use64bitint} eq 'define');.. require Math::BigInt unless $_64BITINT;.}..my $THIRTY_TWO = $_64BITINT ? 32 : Math::BigInt->new(32);..my $FFFFFFFF = $_64BITINT ? 0xFFFFFFFF : Math::BigInt->new(0xFFFFFFFF);..@EXPORT= qw();.%EXPORT_TAGS= (. Func =>.[qw(..attrLetsToBits..createFile. .fileConstant..fileLastError..getLogicalDrives..CloseHandle..CopyFile..CreateFile..DefineDosDevice..DeleteFile..DeviceIoControl..FdGetOsFHandle..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32API\File\cFile.pc

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6272
Entropy (8bit):	5.225238110544523
Encrypted:	false
SSDEEP:	192:UrzBaynyHkag8WiTuxZEYxz4RAaxXiVpcTk1CdwQtNBMZO:GCRAT4dwQrBMZO
MD5:	E5C8C5495DC6DDFF4AB733CA9515CAA3
SHA1:	7BDF1F5BE4EF28055DCDE13583B2E9A01475CEF8
SHA-256:	E13CA08E0FEB6EB65ADB072A8482AE894FFE636E6177F5FF768E5F585D142BD9
SHA-512:	0E32D18A7E94A135102528617BDE4B2976AADE1BC8CABE12DAAA99939508C5937ED2AC6C9CE26953A78549DBE55C04B06D93FB691BE67194296CD6648A271BB2
Malicious:	false
Preview:	# Generated by cFile_pc.cxx...# Package Win32API::File with options:..# CPLUSPLUS => q[1]..# IFDEF => q[!/[a-z\d]/]..# IMPORT_LIST => [q[/._/], q[!/[a-z]/], q[:MEDIA_TYPE]]..# WRITE_PERL => q[1]..# Perl files eval'd:..# File.pm => last if /^\s(bootstrap\|XSLoader::load)\b/..# C files included:..# File.xs => last if m#/[/]\sCONSTS_DEFINED\b\|^\sMODULE\b#..sub CREATE_ALWAYS () { 2 }..sub CREATE_NEW () { 1 }..sub DDD_EXACT_MATCH_ON_REMOVE () { 4 }..sub DDD_RAW_TARGET_PATH () { 1 }..sub DDD_REMOVE_DEFINITION () { 2 }..sub DRIVE_CDROM () { 5 }..sub DRIVE_FIXED () { 3 }..sub DRIVE_NO_ROOT_DIR () { 1 }..sub DRIVE_RAMDISK () { 6 }..sub DRIVE_REMOTE () { 4 }..sub DRIVE_REMOVABLE () { 2 }..sub DRIVE_UNKNOWN () { 0 }..sub F3_120M_512 () { 13 }..sub F3_1Pt44_512 () { 2 }..sub F3_20Pt8_512 () { 4 }..sub F3_2Pt88_512 () { 3 }..sub F3_720_512 () { 5 }..sub F5_160_512 () { 10 }..sub F5_180_512 () { 9 }..sub F5_1Pt2_512 () { 1 }..sub F5_320_1024 () { 8 }..sub F5_320_512 () { 7 }..su

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32\API.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21896
Entropy (8bit):	4.896490458681483
Encrypted:	false
SSDEEP:	384:1YvUMlhD0EKM+jx3s6TsOIuzqAf/Ihp8vbwzjz8WnbGQUkWY1hRyj:1YsMmMix3RsOIEzfwhp2Kz8mbGy1ryj
MD5:	B549EE70EDE95046DFEAAF29FEC36324
SHA1:	B2A744A590D13C351A6B8EF566D558E03607174F
SHA-256:	76CD253A8E72594E80B0B3693DEB5DD6358676589512AFB3987D5A21B5E3B97C
SHA-512:	43505B31BD3AD1BC3B3E339D6E8820A7B32A0D9D8E6C30EE0C3422874EBD8B15EB43A62E2169F2AF39EA55A61CFE68C849734323A8BA85CB568C4D712C2425A1
Malicious:	false
Preview:	#line 1 "Win32/API.pm".# See the bottom of this file for the POD documentation. Search for the.# string '=head'...#######################################################################.#.# Win32::API - Perl Win32 API Import Facility.#.# Author: Aldo Calpini <dada@perl.it>.# Maintainer: Cosimo Streppone <cosimo@cpan.org>.#.# Changes for gcc/cygwin: Daniel Risacher <magnus@alum.mit.edu>.# ported from 0.41 based on Daniel's patch by Reini Urban <rurban@x-ray.at>.#.#######################################################################..package Win32::API;. use strict;. use warnings;.BEGIN {. require Exporter; # to export the constants to the main:: space.. sub ISCYG ();. if($^O eq 'cygwin') {. BEGIN{warnings->unimport('uninitialized')}. die "Win32::API on Cygwin requires the cygpath tool on PATH". if index(`cygpath --help`,'Usage: cygpath') == -1;. require File::Basename;. eval "sub ISCYG () { 1 }";. } else {. eval "s

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32\API\Struct.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	18261
Entropy (8bit):	4.80603155349101
Encrypted:	false
SSDEEP:	192:XzSbEVHM3es56/yLWukyJNaIVm1CHdi2D3yiQwsuI9qNw5yBQ33GLnCy+k2KVLxI:XzEEVq53uxpMBjo+Oa0l4qnRlBF
MD5:	EA247A901F7C48920F734A57EB9AF60E
SHA1:	8CCA374DDB8483614123C2F6FF811749D5A836E7
SHA-256:	44C8FD47133FF0B2123B8C82D510BE5A9638280946A9B2488674C47C247D4754
SHA-512:	9D3FDAA5F1DADAA1D8FE5D064B5FDC550CD8E8B9D5063046E9EAB31D6790BCA75863CACECA5AE5E2C56EF8EE6526840F4A63E14743F643F040111501F4AA0F49
Malicious:	false
Preview:	#line 1 "Win32/API/Struct.pm".#.# Win32::API::Struct - Perl Win32 API struct Facility.#.# Author: Aldo Calpini <dada@perl.it>.# Maintainer: Cosimo Streppone <cosimo@cpan.org>.#..package Win32::API::Struct;.use strict;.use warnings;.use vars qw( $VERSION );.$VERSION = '0.67';..my %Known = ();..#import DEBUG sub.sub DEBUG;.DEBUG = Win32::API::DEBUG;..#package main;.#.#sub userlazyapisub2{.# userlazyapisub();.#}.#sub userlazyapisub {.# Win32::API::Struct::lazyapisub();.#}.#.#sub userapisub {.# Win32::API::Struct::apisub();.#}.#.#package Win32::API::Struct;.#.#sub lazyapisub {.# lazycarp('bad');.#}.#sub apisub {.# require Carp;.# Carp::carp('bad');.#}.sub lazycarp {. require Carp;. Carp::carp(@_);.}..sub lazycroak {. require Carp;. Carp::croak(@_);.}..sub typedef {. my $class = shift;. my $struct = shift;. my ($type, $name, @recog_arr);. my $self = {. align => undef,. typedef => [],. };. while (defined($type = shift)) {.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32\API\Type.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	12777
Entropy (8bit):	4.591903084082145
Encrypted:	false
SSDEEP:	192:qAxSsbYP0Egtuhmhj+Lig1QWz6ycAdJ7FOJby4s6pKGLx/DFKLMy3oPlHbTKHxKI:qAxLbYPz49VoLq0ZCAeO
MD5:	E7E80CCA39D09E68744D5C695F4AD03D
SHA1:	4B79BAE517852B0385C0F586EC97FAF60AE7E0F8
SHA-256:	2CABD8CC72C49360BDE11E0A96CB39692657E05767554B3A289345C11E533B91
SHA-512:	A65E16C754E51FFC86403AE36D3345DB5D41C2FAAD43D66C39BED020CA5B135360BB0363C5165576DD16A82604A6D527DC0111C54C05E12984B10040F826A0F3
Malicious:	false
Preview:	#line 1 "Win32/API/Type.pm".package Win32::API::Type;..# See the bottom of this file for the POD documentation. Search for the.# string '=head'...#######################################################################.#.# Win32::API::Type - Perl Win32 API type definitions.#.# Author: Aldo Calpini <dada@perl.it>.# Maintainer: Cosimo Streppone <cosimo@cpan.org>.#.#######################################################################..use strict;.use warnings;.use vars qw( %Known %PackSize %Modifier %Pointer $VERSION );..$VERSION = '0.70';..#import DEBUG sub.sub DEBUG;.DEBUG = Win32::API::DEBUG;..#const optimize.BEGIN {. eval ' sub pointer_pack_type () { \''. .(PTRSIZE == 8 ? 'Q' : 'L').. '\' }';.}..%Known = ();.%PackSize = ();.%Modifier = ();.%Pointer = ();..# Initialize data structures at startup..# Aldo wants to keep the <DATA> approach..#.my $section = 'nothing';.foreach (<DATA>) {. next if /^\s*(?:#\|$)/;. chomp;. if (/\[(.+)\]/) {. $section = $1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32\Console.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	19324
Entropy (8bit):	5.0942442179175025
Encrypted:	false
SSDEEP:	384:mbKQgl2AbZF4GhB5DN1QAhtFroNOdj8w6J4KR5hqExaBsu6XpIRYXhQ:mylpF4GL5DN1QAhzcNOdj8w6J4KR5hqZ
MD5:	344B823E48D6962DB1D311EFA3F94C7C
SHA1:	847D6147782A61B086A2E6DEA300982B909EBEFA
SHA-256:	CE0B656E193159694A960591A07D083B841A2323832C31D724B8B1D528E1296D
SHA-512:	F417E3BCD36BF0141E90B245181FFA7528440F9EF9864FE0E91F5EC05CE7732CE8339EE46AA85ED44FB3C34B90B095E92B4A7A144F277BA3DC036EC234828501
Malicious:	false
Preview:	#line 1 "Win32/Console.pm".#######################################################################.#.# Win32::Console - Win32 Console and Character Mode Functions.#.#######################################################################..package Win32::Console;..require Exporter;.require DynaLoader;..$VERSION = "0.10";..@ISA= qw( Exporter DynaLoader );.@EXPORT = qw(. BACKGROUND_BLUE. BACKGROUND_GREEN. BACKGROUND_INTENSITY. BACKGROUND_RED. CAPSLOCK_ON. CONSOLE_TEXTMODE_BUFFER. CTRL_BREAK_EVENT. CTRL_C_EVENT. ENABLE_ECHO_INPUT. ENABLE_LINE_INPUT. ENABLE_MOUSE_INPUT. ENABLE_PROCESSED_INPUT. ENABLE_PROCESSED_OUTPUT. ENABLE_WINDOW_INPUT. ENABLE_WRAP_AT_EOL_OUTPUT. ENHANCED_KEY. FILE_SHARE_READ. FILE_SHARE_WRITE. FOREGROUND_BLUE. FOREGROUND_GREEN. FOREGROUND_INTENSITY. FOREGROUND_RED. LEFT_ALT_PRESSED. LEFT_CTRL_PRESSED. NUMLOCK_ON. GENERIC_READ. GENERIC_WRITE. RIGHT_ALT_PRESSED. RIGHT_CTRL_PRESSED. SCR

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Win32\FindFile.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.458069830245158
Encrypted:	false
SSDEEP:	48:lH8HMfs5iRfpAykkm9CZW8KVPbVhn2QWQ2M9H3:98s05CBcNWQWQV9X
MD5:	E9332EBA391D8B2C02479BB1A645ED2E
SHA1:	9564A4AE05DDB730C65678037A54E130E953D29E
SHA-256:	CB30096186994569AC5259FA5314694CBB03278DD109BE0D7DAF91B5B78DD5EC
SHA-512:	C215387E3FADD27E53BD4ACED6CB25ED1A6C81F79FDEE9B406F69C99A9ECE33A0E99C4FDA8D55A02BE8C403870225C991DC8A748EAE7F2154772A0FAB063F582
Malicious:	false
Preview:	#line 1 "Win32/FindFile.pm".package Win32::FindFile;..use strict;..use warnings;....require Exporter;....our @ISA = qw(Exporter);....# Items to export into callers namespace by default. Note: do not export..# names by default without a very good reason. Use EXPORT_OK instead...# Do not simply export all your public functions/methods/constants.....# This allows declaration.use Win32::FindFile ':all';..# If you do not need this, moving things directly into @EXPORT or @EXPORT_OK..# will save memory...our %EXPORT_TAGS = ( 'all' => [ qw(...FindFile ...ReadDir...FileTime...FileData...wchar ...uchar...wfchar.....DeleteFile...MoveFile...CopyFile...RemoveDirectory...CreateDirectory.....GetFullPathName...GetCurrentDirectory ...SetCurrentDirectory .....GetBinaryType...GetCompressedFileSize...GetFileAttributes...SetFileAttributes...GetLongPathName.....AreFileApisANSI...SetFileApisToOEM...SetFileApisToANSI...) ] );....our @EXPORT_OK = ( @{ $EXPORT_TAGS{'all'} } );....our @EXPORT = qw(...FindFile Fi

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WriteCanonRaw.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	24893
Entropy (8bit):	4.68252930206594
Encrypted:	false
SSDEEP:	384:H6KpAzWvOy0BL+FmObMG2B5Ap9s9pd0zeQmk1:H65RF7OYJ55pd06Ql1
MD5:	5676D140873D837BE0FECFFA6688B0D2
SHA1:	6F07A9893D44FAD3B4CC47F140D8979C39B5BBDA
SHA-256:	C44F45B6AF3FD63EA036350294D9B5D7580A85CC63CA749C2D4D848BAD85C311
SHA-512:	44D1D19E99B6FFDE89B272AFD4F6C6FE4BA43C3F1FFC50A3AF36A1E9A16C37CD36E30C481073022477BAB3920109DCF82153E169D7D9C2FE400758132EF248AF
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteCanonRaw.pl.#.# Description: Write Canon RAW (CRW and CR2) meta information.#.# Revisions: 01/25/2005 - P. Harvey Created.# 09/16/2010 - PH Added ability to write XMP in CRW images.#------------------------------------------------------------------------------.package Image::ExifTool::CanonRaw;..use strict;.use vars qw($VERSION $AUTOLOAD %crwTagFormat);.use Image::ExifTool::Fixup;..# map for adding directories to CRW.my %crwMap = (. XMP => 'CanonVRD',. CanonVRD => 'Trailer',.);..# mappings to from RAW tagID to MakerNotes tagID.# (Note: upper two bits of RawTagID are zero).my %mapRawTag = (. # RawTagID => Canon TagID. 0x080b => 0x07, # CanonFirmwareVersion. 0x0810 => 0x09, # OwnerName. 0x0815 => 0x06, # CanonImageType. 0x1028 => 0x03, # (unknown if no tag name specified). 0x1029 => 0x02, # FocalLength. 0x102a => 0x04, # CanonShotInfo. 0x

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WriteExif.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	129664
Entropy (8bit):	4.06504774918612
Encrypted:	false
SSDEEP:	768:8acUEgLnS8nvnI0YoAmIyjBN0JPLo9EGfNUf6EY7vMi4HDX/PybQHB5t41DNKSiR:xLS8vLjvzB74rybQF4rKSIbUWSAr
MD5:	7824502209808A1C545EDFA87032AF8B
SHA1:	1E0ACB7D60238497765758BD6BFAE26D623982AF
SHA-256:	E24A6CF29159B685A46E0C27192B522B75FDF17DAAAABA40EA4205E7702DB642
SHA-512:	0A84612D18ED4333455128700A909A3629857B1F7712819480BA54292E7613414ACB2C3B59363E53C51D73729D44EC97EAB5D6BEC117FBF4100EC2A1337934A3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteExif.pl.#.# Description: Write EXIF meta information.#.# Revisions: 12/13/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Exif;..use strict;.use vars qw($VERSION $AUTOLOAD @formatSize @formatName %formatNumber. %compression %photometricInterpretation %orientation);..use Image::ExifTool::Fixup;..# some information may be stored in different IFD's with the same meaning..# Use this lookup to decide when we should delete information that is stored.# in another IFD when we write it to the preferred IFD..my %crossDelete = (. ExifIFD => 'IFD0',. IFD0 => 'ExifIFD',.);..# mandatory tag default values.my %mandatory = (. IFD0 => {. 0x011a => 72, # XResolution. 0x011b => 72, # YResolution. 0x0128 => 2, # ResolutionUnit (inches). 0x0213 => 1,

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WriteIPTC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	30300
Entropy (8bit):	4.535854239361293
Encrypted:	false
SSDEEP:	768:5nPVwAOAieKns13VcTP7OujTZjHIWLwFn:5niRAlyqawp
MD5:	4E416AEE5CD807EF22BA76B4969D0F43
SHA1:	127679DCB5C70EC4D6238880E5ED650E6CEA9DC6
SHA-256:	08761DBB7A066868AA95F5C0629CC3845C8CB31A3D1EF16B74115135A9A39CA5
SHA-512:	8EE94B6994D4B297F4F2A938AD427D5CB0EB259D39A76D7433E501969524199008E0D906A9D05DB139048D69AB6560B665EA959CE7442C8EE765817B794A205B
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteIPTC.pl.#.# Description: Write IPTC meta information.#.# Revisions: 12/15/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::IPTC;..use strict;..# mandatory IPTC tags for each record.my %mandatory = (. 1 => {. 0 => 4, # EnvelopeRecordVersion. },. 2 => {. 0 => 4, # ApplicationRecordVersion. },. 3 => {. 0 => 4, # NewsPhotoVersion. },.);..# manufacturer strings for IPTCPictureNumber.my %manufacturer = (. 1 => 'Associated Press, USA',. 2 => 'Eastman Kodak Co, USA',. 3 => 'Hasselblad Electronic Imaging, Sweden',. 4 => 'Tecnavia SA, Switzerland',. 5 => 'Nikon Corporation, Japan',. 6 => 'Coatsworth Communications Inc, Canada',. 7 => 'Agence France Presse, France',. 8 => 'T/One Inc, USA',. 9 => 'Associated Newspapers, UK',.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WritePDF.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	29651
Entropy (8bit):	4.697961211446811
Encrypted:	false
SSDEEP:	384:5yA6lXw6eDlxan/hdhc+zT5Lrr1M0vYdTN07Bt2Kz2XU7zx5sVUkMBHihSCp:5clXw6evan/h7tLrr1v7tlz2O5ahSCp
MD5:	A2CDE7638FAD57DC86D283DDFAEC4EB3
SHA1:	735806D99418DCF27BDA6D85504070321532F4C6
SHA-256:	A19E64844C8790E6DE9021115546F6D4BC41C84EE2B9AC0E29E6F40161CA56CA
SHA-512:	F57ABB6E764EA7A95146A66BF649E2459288B7CB91C387C37B32E3DEFE6C1990C15A46F16FA0B8D5F5A12492AFCEC55142FD7E0C8D83BBF5216B7CF47D41945B
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePDF.pl.#.# Description: Write PDF meta information.#.# Revisions: 12/08/2007 - P. Harvey Created.#.# References: 1) http://partners.adobe.com/public/developer/pdf/index_reference.html.#.# Notes: The special "PDF-update" group can be deleted to revert exiftool updates.#------------------------------------------------------------------------------.package Image::ExifTool::PDF;..use strict;.use vars qw($lastFetched);..sub WriteObject($$);.sub EncodeString($);.sub CryptObject($);..# comments to mark beginning and end of ExifTool incremental update.my $beginComment = '%BeginExifToolUpdate';.my $endComment = '%EndExifToolUpdate ';..my $keyExt; # crypt key extension.my $pdfVer; # version of PDF file we are currently writing..# internal tags used in dictionary objects.my %myDictTags = (. _tags => 1, _stream => 1, _decrypted => 1, _needCrypt => 1,. _filtered => 1, _e

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WritePNG.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	16240
Entropy (8bit):	4.779799144898221
Encrypted:	false
SSDEEP:	384:/mbD1W86enOtS6teLekw/benLnt1vOL4VPXCt/sjmS4TEoTsbf:/mV6eNCeKPTenLzratk74TEcsbf
MD5:	383E2626BB554F510400EB1866A38E9F
SHA1:	049F60BF9D9AFE0B0B96E9F048007A0C5C3C4622
SHA-256:	C66FDEB5FD55D383B42BF5C66BB0CB10512235858D394D8F83E49E285BC86D10
SHA-512:	FC9826028F897F5F84252602FAE65362A90E7CF1B8E5846CEF01D5295DAB3D114733A259DC7C9CF445E6236B03DBDCB282FCAEB6CA73E450F71BB4A19BC700FC
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePNG.pl.#.# Description: Write PNG meta information.#.# Revisions: 09/16/2005 - P. Harvey Created.#.# References: 1) http://www.libpng.org/pub/png/spec/1.2/.#------------------------------------------------------------------------------.package Image::ExifTool::PNG;..use strict;..#------------------------------------------------------------------------------.# Calculate CRC or update running CRC (ref 1).# Inputs: 0) data reference, 1) running crc to update (undef intially).# 2) data position (undef for 0), 3) data length (undef for all data),.# Returns: updated CRC.my @crcTable;.sub CalculateCRC($;$$$).{. my ($dataPt, $crc, $pos, $len) = @_;. $crc = 0 unless defined $crc;. $pos = 0 unless defined $pos;. $len = length($$dataPt) - $pos unless defined $len;. $crc ^= 0xffffffff; # undo 1's complement. # build lookup table unless done already. unless

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WritePhotoshop.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	10799
Entropy (8bit):	4.608737519370114
Encrypted:	false
SSDEEP:	192:Fs/SyA4rYJYDZRzaB+km3Eo8Ck0BUd4l/SC38FyHl98xPoQfv0ThdB9:Fs6h4oYDZpO0Thdn
MD5:	9E49D031DE6E905ADE1451ACD4B50AB4
SHA1:	F89648664AF111F3B9C83B094772CF8BF45419F8
SHA-256:	BB0FF666046FCC8FCE9C17DD5678199973E31C437CF08E0665B0E94DD17E1254
SHA-512:	7EBF1A14E8851A324C0B5938F9193DF5148871E6BB31D744B82369F9737D38A725C19009248B59ABC31A5B9DFC7D6A34297B8CBF8395C37A3A2D2DAC6F9D7247
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePhotoshop.pl.#.# Description: Write Photoshop IRB meta information.#.# Revisions: 12/17/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::Photoshop;..use strict;..#------------------------------------------------------------------------------.# Strip resource name from value prepare resource name for writing into IRB.# Inputs: 0) tagInfo ref, 1) resource name (padded pascal string), 2) new value ref.# Returns: none (updates name and value if necessary).sub SetResourceName($$$).{. my ($tagInfo, $name, $valPt) = @_;. my $setName = $$tagInfo{SetResourceName};. if (defined $setName) {. # extract resource name from value. if ($$valPt =~ m{.*/#(.{0,255})#/$}s) {. $name = $1;. # strip name from value. $$valPt = substr($$valPt, 0, -4 - length($name));.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WritePostScript.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	29975
Entropy (8bit):	4.6884993259440115
Encrypted:	false
SSDEEP:	384:ozPEx7oDuaS2hzCEu2AxvRvt+kO/51coEC5QCe3zLXTayjwqaR0r5eqn4DQJ3AQk:oz0QgrpKcohCzn9yWew4DQ1MXAl4t
MD5:	204356E19C56EBC8EE03B5BC647A4625
SHA1:	26754A49418AB906EA0B83FE3E08D792538C6445
SHA-256:	005A6349E564EEDC65D3DA5C0DF4265C14A3F477C36FA91E9C96D31A33166030
SHA-512:	35645211BB02502EE9FF97DE3DE8662A0395C129E5411955DF5E8C6B4DCF93C6BB4C39CD30D5CC63E28051194AFE63BB4B6B8282EACB32895E6C4DBF2A3165E5
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WritePostScript.pl.#.# Description: Write PostScript meta information.#.# Revisions: 03/03/2006 - P. Harvey Created.#.# References: (see references in PostScript.pm, plus:).# 1) http://www.adobe.com/products/postscript/pdfs/PLRM.pdf.# 2) http://www-cdf.fnal.gov/offline/PostScript/PLRM2.pdf.# 3) http://partners.adobe.com/public/developer/en/acrobat/sdk/pdf/pdf_creation_apis_and_specs/pdfmarkReference.pdf.# 4) http://www.npes.org/standards/Tools/DCS20Spec.pdf.#.# Notes: (see NOTES in POD doc below).#------------------------------------------------------------------------------..package Image::ExifTool::PostScript;..use strict;..# Structure of a DSC PS/EPS document:.#.# %!PS-Adobe-3.0 [plus " EPSF-3.0" for EPS].# <comments>.# %%EndComments [optional].# %%BeginXxxx.# <stuff to ignore>.# %%EndXxxx.# %%

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WriteQuickTime.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	14856
Entropy (8bit):	4.519110756228935
Encrypted:	false
SSDEEP:	192:Hv4VKz0gn0fGhSd5tBtE27jvU5mH4EW0yCEGLcLZmefiEyBDXUgD90C6i9p+0/uo:wS0b5t5i7k2u1stuXq4E574TP
MD5:	E595FFEE2DF66A25EC78816B82B37779
SHA1:	5D9F32771B6D8A5DCFFE9EAC6C99A23D9D3C534F
SHA-256:	B7BC24B2A2E83650D67D1D03D81290B9AF937013866A61D789D4CDC9B0497E0E
SHA-512:	1CC45656241437A45CB96F22FED2BBB6FAF790B46BA541370DEC388E7FF25463D5389FC9F5B33B0E6F449BEBAD9B52235F6B8C2B7E7CDFF0EE36C5041A3AFEC3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteQuickTime.pl.#.# Description: Write XMP to QuickTime (MOV and MP4) files.#.# Revisions: 2013-10-29 - P. Harvey Created.#------------------------------------------------------------------------------.package Image::ExifTool::QuickTime;..use strict;..# map for adding directories to QuickTime-format files.my %movMap = (. # MOV (no 'ftyp', or 'ftyp'='qt ') -> 'moov'-'udta'-'XMP_'. XMP => 'UserData',. UserData => 'Movie',. Movie => 'MOV',.);.my %mp4Map = (. # MP4 ('ftyp' compatible brand 'mp41', 'mp42' or 'f4v ') -> top level 'uuid'. XMP => 'MOV',.);.my %dirMap = (. MOV => \%movMap,. MP4 => \%mp4Map,. HEIC => { }, # can't currently write XMP to HEIC files.);..#------------------------------------------------------------------------------.# Check to see if path is current.# Inputs: 0) ExifTool object ref, 1) directory name.# Returns: true if current

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\WriteXMP.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	63676
Entropy (8bit):	4.598173756017062
Encrypted:	false
SSDEEP:	768:Nn99jOk01gyaNVP0Qu6yHCTNQ32vjJjsG+0Ge+PkDHlS9QVkUX:t9tOV1gyaNVcRVHyoSljs9efVk4
MD5:	9AB19A54B96030195D01B036AE2DB522
SHA1:	42B48F458629A6B71698E07757D414117133AF1C
SHA-256:	2DE2AC9D1CDA3B9DCCDC404077990713BD7A895CE16F716270F41B476F273DFC
SHA-512:	B6C37864139D847A797F5E7C33B715BAB7481FAF943AD12327CE5DCE18A082408D1124CD1654C659C68593F8AC495ECAD4BAE15DE1A4B13ECEAF0C876119F20A
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: WriteXMP.pl.#.# Description: Write XMP meta information.#.# Revisions: 12/19/2004 - P. Harvey Created.#------------------------------------------------------------------------------.package Image::ExifTool::XMP;..use strict;.use vars qw(%specialStruct %dateTimeInfo %stdXlatNS);..use Image::ExifTool qw(:DataAccess :Utils);..sub CheckXMP($$$);.sub CaptureXMP($$$;$);.sub SetPropertyPath($$;$$$$);..my $debug = 0;.my $numPadLines = 24; # number of blank padding lines..# when writing extended XMP, resources bigger than this get placed in their own.# rdf:Description so they can be moved to the extended segments if necessary.my $newDescThresh = 10240; # 10 kB..# individual resources and namespaces to place last in separate rdf:Description's.# so they can be moved to extended XMP segments if required (see Oct. 2008 XMP spec).my %extendedRes = (. 'photoshop:History' => 1,. 'xap:Thumbn

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\Writer.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	288324
Entropy (8bit):	4.517373218068747
Encrypted:	false
SSDEEP:	3072:UUxj51AYPZFjHIQoat8+ESVKIr6mABVTyzYW6OsOKHH01+m09tAC8nH2p:J5lFWz+5K6yBVTKcmm82p
MD5:	3A2FDCA28E1D037B44C0DA45A61DCD3E
SHA1:	727BCD78BDBD7525BB31DA6E96A61E422E4478B1
SHA-256:	9067B01F4490FB7DBEB4DAF8205C019A70D912899164A28EB13E38D6FD3801C3
SHA-512:	9FF8F547ED07019AD9A7999652E999D244F2277D8080CF91ECFAD0F78F2768D6BC959CE5D989CC4880B784AD0278776EDD5AEA9436C64A5AA7A02516BE353BE6
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: Writer.pl.#.# Description: ExifTool write routines.#.# Notes: Also contains some less used ExifTool functions.#.# URL: http://owl.phy.queensu.ca/~phil/exiftool/.#.# Revisions: 12/16/2004 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool;..use strict;..use Image::ExifTool::TagLookup qw(FindTagInfo TagExists);.use Image::ExifTool::Fixup;..sub AssembleRational($$@);.sub LastInList($);.sub CreateDirectory($$);.sub NextFreeTagKey($$);.sub RemoveNewValueHash($$$);.sub RemoveNewValuesForGroup($$);.sub GetWriteGroup1($$);.sub Sanitize($$);.sub ConvInv($$$$$;$$);..my $loadedAllTables; # flag indicating we loaded all tables.my $advFmtSelf; # ExifTool during evaluation of advanced formatting expr..# the following is a road map of where we write each directory.# in the different types of files..my %

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\XMP2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	67804
Entropy (8bit):	4.717564120037501
Encrypted:	false
SSDEEP:	1536:d8s7ZzhINKJ6mDHtpYAOmcCU5gal+T/+ECNVh9PHbg0Wc/5y1XnDfo+Mb5mxm87j:d8eZzhI8J6mDHtpYAOmcCU5gal+7+EuS
MD5:	CF91C26DDEF693887D3A8BC7FC38F962
SHA1:	D7350BE1BCDEA3B957C80010AE1194F75FCBE52D
SHA-256:	073E2C9EA1FA4DA5794CA9FE77DA276D551F17C22230CBE2C888B09B7DFA1748
SHA-512:	28FCD062E3CB43470014FDCEFE1E94A51AC3EF9CB87E62202A83A88C2C325E8E35FDC83CB4E3F52552E5F83839C85D7AFFDA6744BBA3FEF4A6C641B46341E500
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: XMP2.pl.#.# Description: Additional XMP namespace definitions.#.# Revisions: 10/12/2008 - P. Harvey Created.#.# References: 1) PLUS - http://ns.useplus.org/.# 2) PRISM - http://www.prismstandard.org/.# 3) http://www.portfoliofaq.com/pfaq/v7mappings.htm.# 4) http://www.iptc.org/IPTC4XMP/.# 5) http://creativecommons.org/technology/xmp.# --> changed to http://wiki.creativecommons.org/Companion_File_metadata_specification (2007/12/21).# 6) http://www.optimasc.com/products/fileid/xmp-extensions.pdf.# 9) http://www.w3.org/TR/SVG11/.# 11) http://www.extensis.com/en/support/kb_article.jsp?articleNumber=6102211.# 12) XMPSpecificationPart3_May2013, page 58.#------------------------------------------------------------------------------..package Image::ExifTool::XMP;..us

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\XMPStruct.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	36039
Entropy (8bit):	4.473206188151363
Encrypted:	false
SSDEEP:	768:wgtEvRH0awGOdSUAJNRI1dsJn23D6Ketlh7z/X0LqjCVi:PtakSUAJNRI1c777Xmqjqi
MD5:	70289ADE47DAB540149088D7A9CE5A72
SHA1:	856CCC2A8AC47B88AAB16C924314AD01DB6E1ECC
SHA-256:	AD0CD30BFFC4F1654625FE7514A56B5F58E51EEA178597862BB66B954021AD97
SHA-512:	8B71A67FEB07149D6F5FE891C11A4210BB76F7AD3A2B38D3136724CA4E8879767AAB8778B64ACFD7256435512A90CB8ADBD2DC3257E5E0808ABA3DE766A3D77F
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# File: XMPStruct.pl.#.# Description: XMP structure support.#.# Revisions: 01/01/2011 - P. Harvey Created.#------------------------------------------------------------------------------..package Image::ExifTool::XMP;..use strict;.use vars qw(%specialStruct %stdXlatNS);..use Image::ExifTool qw(:Utils);.use Image::ExifTool::XMP;..sub SerializeStruct($;$);.sub InflateStruct($;$);.sub DumpStruct($;$);.sub CheckStruct($$$);.sub AddNewStruct($$$$$$);.sub ConvertStruct($$$$;$);..#------------------------------------------------------------------------------.# Serialize a structure (or other object) into a simple string.# Inputs: 0) HASH ref, ARRAY ref, or SCALAR, 1) closing bracket (or undef).# Returns: serialized structure string.# eg) "{field=text with {braces\|}\|, and a comma, field2=val2,field3={field4=[a,b]}}".sub SerializeStruct($;$).{. my ($obj, $ket) = @_;. my ($key, $val, @vals, $rtnVal);

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\XSLoader.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2910
Entropy (8bit):	4.977568751591642
Encrypted:	false
SSDEEP:	48:TwbXySkCBD9tbJkPc9wMAxHDxKXVOEaO0iXkrIFGvbqdxJEPdgY3U6FhwFpU:cvDt+B8YEaiqbqdxJEPWP6wFe
MD5:	B8522F245A152BD024FF1610F8368F75
SHA1:	2F8DCEEA6263CDE9058D36BFC23564AB990AD62C
SHA-256:	5E6804FD8319B47620E9BB1EE4C7A7DC158CDAA1D841CEB943B37B684905D564
SHA-512:	E06F73C50307FB88A3B959FFE2B5EF326DB2F3B4F29A346D877DFF125CFF2AEFE9B9E533840F3C8EE79297A2447EEF0DFB1632B5D9FFB68FBC0AB2A8A6AD13A8
Malicious:	false
Preview:	#line 1 "XSLoader.pm".# Generated from XSLoader.pm.PL (resolved %Config::Config value)..# This file is unique for every OS....package XSLoader;....$VERSION = "0.21";....#use strict;....package DynaLoader;....# No prizes for guessing why we don't say 'bootstrap DynaLoader;' here...# NOTE: All dl_*.xs (including dl_none.xs) define a dl_error() XSUB..boot_DynaLoader('DynaLoader') if defined(&boot_DynaLoader) &&.. !defined(&dl_error);..package XSLoader;....sub load {.. package DynaLoader;.... my ($caller, $modlibname) = caller();.. my $module = $caller;.... if (@_) {.. $module = $_[0];.. } else {.. $_[0] = $module;.. }.... # work with static linking too.. my $boots = "$module\::bootstrap";.. goto &$boots if defined &$boots;.... goto \&XSLoader::bootstrap_inherit;.... my @modparts = split(/::/,$module);.. my $modfname = $modparts[-1];.... my $modpname = join('/',@modparts);.. my $c = () = split(/::/,$call

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Bzip2\Bzip2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	6.2535311329413545
Encrypted:	false
SSDEEP:	1536:tzFpiwnkYDyWoFgpjn4Wzxm2BYUUiQp8Z:tVkERoFg5nZpqmZ
MD5:	D1872DBBFBE61F45BB0F86A6E7B52672
SHA1:	F10C2E5914E7B39B1416DA7497300161F5449C22
SHA-256:	7C236C110CF8F885FBEEF3207020FB00780B87C3DCBB4A155121EA22C8140297
SHA-512:	0B3B096D4BAA47B073BE650759FBE9147092BAB4749DDDD12925188811F8EC9C9186AF29F229B1FBEA27A07BF17DF8334935BCC19196039E992A8ACFDF1DD34D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o..W...........#.........$...... ..............h.................................]........ ......................@.......P..H...............................p............................p.......................Q..8............................text...............................`.P`.data...............................@.0..rdata..............................@.`@.bss.........0........................`..edata.......@......................@.0@.idata..H....P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..reloc..p............ ..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Zlib\Zlib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.3581909776902625
Encrypted:	false
SSDEEP:	1536:O/bZcrCZIdS0EhZz8taSZsKUw/5G2FANu4+4jxXqDASOhw6KRaAjGRHdGNKFO28x:ibZcGZIs0GzZKF5G2FctOD80flec2I
MD5:	A532ADE5F427A88EADA72EBAD34801A4
SHA1:	7F322E3F8D06E0DF314C488F1DD056971E1B9E96
SHA-256:	A8346E9C165D21A9A99313D32C3704DCAAB01F142C3BE0FBC0DEDD39756E3BD5
SHA-512:	83344E7ECB4197B325735E1CDCF72DFC403711457CF232E61EC34761C58BEB6455B403948B565707F1F31954129E0DEAAFD26E99C81690D1A16AF5104A453585
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..W...........#.....:.......... ........P.....f.................................h........ .................................d.......................................................................................`............................text....8.......:..................`.P`.data........P.......>..............@.0..rdata...B...`...D...@..............@.`@.bss..................................`..edata..............................@.0@.idata..d...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Cwd\Cwd.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.565146780074246
Encrypted:	false
SSDEEP:	384:fE1uF2cJshlAB9s+22Kz83cKcnOqAB/BmhzNJCVZhaDA:lshM9sN22OqABQhzNJCVf
MD5:	707F6CD0BA39238095A7CA6925708223
SHA1:	C7B8FDCF4660F28D53F5A53F8D74E63A5495B31D
SHA-256:	FA2960FE31C5DC687D11A93C22DDF03BE20714E7EE038BCEB54EC035CAC086A5
SHA-512:	B88FD8F08AE0833FB86F719B23AD6A58341DF256B11AE5E902662E7038A39604A78FA34FB674D17F04AFBD36CA8FE0DCC12D77B00D0669695806EB1C970ACA50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d..W...........#.........H...... ........@....Xb................................'3........ ......................p..........h............................... .......................................................D............................text....,..........................`.P`.data... ....@.......2..............@.0..rdata.......P.......4..............@.0@.bss.........`........................`..edata.......p.......8..............@.0@.idata..h............:..............@.0..CRT....,............D..............@.0..tls.... ............F..............@.0..reloc.. ............H..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\MD5\MD5.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.863412190687638
Encrypted:	false
SSDEEP:	384:kmt2M1EWKb+XSZdB0P8hxWE+dG6L9SEvHPLjvp2bJlej7fX:IzZdlkG6L1vHPwbJsn
MD5:	C112EAAC75BE019C9CDD2984471DBBFC
SHA1:	3C12B61DA69DD88CDB19CDB053B3E96734138E6B
SHA-256:	E8B94D35CF384BBA2598317A842D1C147B9AEAB8A7E1DE2516FA1999A0C510D0
SHA-512:	2B5960056330D6DB9E47B6441CF76518E5C6465D061CF0F2C84151F8B30EB479B7FCAA61B51C821AFCA3C06D256BC443F0E55E46DFDAAD662ED258899ADB2BF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....4...P...... ........P.....j.......................................... .................................$...................................................................................`................................text...t3.......4..................`.P`.data........P.......8..............@.0..rdata..\|....`.......:..............@.`@.bss.........p........................`..edata...............@..............@.0@.idata..$............B..............@.0..CRT....,............L..............@.0..tls.... ............N..............@.0..reloc...............P..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\SHA\SHA.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	6.337691455843865
Encrypted:	false
SSDEEP:	768:0nnyNDQp8PVfgpxUa/dYHD+AAo2T/i7qJD/skjglfJTzN:0yNzPVfgd/dYHD+AAN/iORk
MD5:	474B8592DC71DF7EBC8F776E3FE746E0
SHA1:	22DC0A6AF5142F1221867AE60DA215094B7EBE62
SHA-256:	A963A1E365F519BA7E32CED85C3BC75FA61411C7057769D96D3DA2701FBC0D28
SHA-512:	387FB96C8D4B1D94E9C7D54786E5DF57D82083E9C7FC6082A77ECEADC540633CBA32B72DBE666106C9BEC7EBF282C4389701D88A95679E7D6BA6B695E9201E35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#................ .............0f......................... ................ .................................................................X...................................................T................................text...T...........................`.P`.data...............................@.0..rdata..\...........................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..X...........................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Encode\Encode.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.974894250716047
Encrypted:	false
SSDEEP:	768:X3/x3HZfPnfRHv/5nBBtR8aROd+nQPJEGvQg1fGeJ:X3/x3HZfPnfRHv/5Bx88OiQBQg
MD5:	F7992DB1F844A2D9C263C2627BB8A945
SHA1:	E110B856C647C2CDB1C1C5C0FBB76630F942917B
SHA-256:	5CC5AB3445E73175471EDAA84984B3C94DD638877E585DFF084829AC27D78DC3
SHA-512:	1082EBB1C150F70E18220360B0FC8472530B91AE0C756D64FEBF204F256594A9001C5AE9FAFF5E598EE1652FC218E80D72D64833CA249EC350D10B3004DFBB09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{..W...........#.....`.......... ........p....Tj.......................................... .........................I...........................................................................................................................text....^.......`..................`.P`.data........p.......d..............@.0..rdata...............f..............@.`@.bss..................................`..edata..I............v..............@.0@.idata...............x..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Fcntl\Fcntl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.656581726826691
Encrypted:	false
SSDEEP:	384:f7ExypKw9VFsca1uNDveFFkayfrmbgr7GDL7jp9dSci48eHl:fp3scQuN7eXkangrQLlSR4B
MD5:	B5915CE10B208305ADE35E9E336F8547
SHA1:	9FB2888E33D3CFB02C3BD1ADBAA79E5B8B6CBFB3
SHA-256:	AD40E880026B5E3C4C66FD1542D1786C79C3F8523E9D3A65CA22A4D74FAB0643
SHA-512:	04C5D399A4AA848EA7580A806B06CE2AC1108EB1C5644F2D8794B32C8A04846A62838AFF198A09D56F33648134BEB65353806B23EE8336C050A91B6FB3F4E1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#..... ...B...... ........0.....f.......................................... ......................`.......p......................................................................................\q...............................text............ ..................`.P`.data........0.......$..............@.0..rdata.......@.......&..............@.`@.bss.........P........................`..edata.......`.......4..............@.0@.idata.......p.......6..............@.0..CRT....,............>..............@.0..tls.... ............@..............@.0..reloc...............B..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\File\Glob\Glob.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.8478100353465265
Encrypted:	false
SSDEEP:	384:60TBwFN+qN6tznAWOP7Eckb5yOa7qjHWRF21HJG06+oYTfuO4q0v:6O9ICyOa75F21HJG0aYTfkq
MD5:	A8AE9002EAE09AB963E604F92D1510E4
SHA1:	46A6EDFBB61B25D70C01D6812C38C7960533E9BF
SHA-256:	AC8FA59812BFF98BBDC147E5F5C92A5A58DC51D1192BE55B9B5C20735C1601D0
SHA-512:	C41B5FBDD5E1A31CB6A16F8A03F67EA2A5C1DE9623230E8012F187FD8200AA7E84A6E7CE6020806BC84E766465AB89974A162E24EA4C7493B5ED59706957BE49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........#.....B...`...... ........`....\|p.......................................... .................................................................p.......................................................p............................text....@.......B..................`.P`.data... ....`.......F..............@.0..rdata.......p.......H..............@.`@.bss..................................`..edata...............N..............@.0@.idata...............P..............@.0..CRT....,............\..............@.0..tls.... ............^..............@.0..reloc..p............`..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\IO\IO.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.649395333316567
Encrypted:	false
SSDEEP:	384:whY3bHejSRGOIZlMRZXUcEKzjuJruGsiywPv9QO4HjzS:wwXUD+jC7ywPv9GDz
MD5:	0708E9C00B837F9FFB609802A0DFC554
SHA1:	17C9B11FC9BA756C4AD1151FD1DBECF78872DFF6
SHA-256:	16E220DE234AFAD379BD5AE434542DF2ADA7100AE47E14A97797F3491CA903AD
SHA-512:	83137FD0009C756D204B3992579A81ED79E1D95C795CED9DC84E0CFDEFA9621963D449ECE249A77106C5AE1B0DD9C295F521D435E288D2E5B9E4AD438257A3A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........#.....2...P...... ........P....Lg................................D......... .................................,.......................................................................................X............................text...$1.......2..................`.P`.data........P.......6..............@.0..rdata..`....`.......8..............@.0@.bss.........p........................`..edata...............>..............@.0@.idata..,............@..............@.0..CRT....,............L..............@.0..tls.... ............N..............@.0..reloc...............P..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\List\Util\Util.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.105799136611243
Encrypted:	false
SSDEEP:	768:FK5STJ8OnSw5qvIC6Q+qtJbpIkICl/y0Mx1RBa0EiYr2OWTPv9tBVv+:FKAT6OlqaQ+iJbzM0MBQ0EiYr2OW
MD5:	716DC81D2B39810FA28B8F14BA41D014
SHA1:	F38D7E2D701F8CEBC51E456BFC1E25450F972444
SHA-256:	3B7654EAC8A06F4D172BFA90A06C35336E3085AE4AFD8065DD523F7865B59CBD
SHA-512:	BE3C7AED665280F2F33620F632E886667F4054B38B291EBE78D1F6120FBF9D62723509DD3955BCEAE432F6AEEAECAE173B4498EA9F5B87C6372563D194B14EA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#................ ..............b......................... ................ .....................................................................................................................8................................text...D...........................`.P`.data...............................@.0..rdata..d...........................@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\MIME\Base64\Base64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.630210816753018
Encrypted:	false
SSDEEP:	384:fq8vi0nsPeiznHB84DfndkkouycCczS4r1jweY8:fqBznh82ZouNCCS499T
MD5:	6C42809F79D0DD22E9903114426CDC64
SHA1:	DF28C06214913F2457AD15E34C7E3806EA839530
SHA-256:	532AD6EC74111C5170273C355A1E5C7B21372122F655B1B2FE4CCB80E42725C5
SHA-512:	5A1315AC678801F7AE5023ADBD431496A0AD0367538F1B379E0A6A3552451AA344A90986FF5D34790D9DE2C4E7CF17B8254C5B5BD833CDD5CBC354C6EAB8AB4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........#.....,...D...... ........@.....o................................x......... ......................p..........4...................................................................................@................................text...4*.......,..................`.P`.data........@.......0..............@.0..rdata.......P.......2..............@.`@.bss.........`........................`..edata.......p.......6..............@.0@.idata..4............8..............@.0..CRT....,............@..............@.0..tls.... ............B..............@.0..reloc...............D..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\FastCalc\FastCalc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.665141901986503
Encrypted:	false
SSDEEP:	384:S5ZoPG76cqpbp8wI+fT6Tx8h1w4klKi8ePv9MeHVcb:HZSwJ6TxMu4mKBePv9R1k
MD5:	7B7C20797DD91C30810B45F2CC5BDB7E
SHA1:	D7B79AA31D6D757B8A519DB3B5CDB3A7EF6AF14F
SHA-256:	1EE2ABBCB641D76C03C249B7207C0DD9403C32E7FE13BCDEC75AE4576CE2A0EF
SHA-512:	6F287734DFA16D766E0785B1BFA0806567111BF88DB4E100FA8A1E50C5226C8CA2EAD57A3ED147ECC544AEEEBFCB6D42CD67E402A384C8AC2F3BAC96991DC389
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..W...........#........B...... ........@....,o.......................................... ......................p..............................................................................................X................................text....(.........................`.P`.data........@......................@.0..rdata.......P.......0..............@.0@.bss.........`........................`..edata.......p.......4..............@.0@.idata...............6..............@.0..CRT....,............>..............@.0..tls.... ............@..............@.0..reloc...............B..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\GMP\GMP.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.202635727299415
Encrypted:	false
SSDEEP:	6144:f5file5XfBWSaft8X8VfcY21eTOOoPopjUm0+J3:f99BZJaftM8WctoPWUYJ3
MD5:	495796B597A9F485E0CBAE2E81825BB8
SHA1:	7C98E2002D6C8A87E20E3F9D0658C0E6358D958E
SHA-256:	7591628FFAF339857088D1F3B156F5C635E9A8FE6B8617414DCC6CAAA8D45796
SHA-512:	34ABAC0BE2891B78D80A5CCC5735C43584A871E2E4AF0FAEACEB5FE4635953D2AC0B8C8265099D8FD97807855B30E6F631C6ADA7E41283C8FA5CCD32A76270F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....W...........#................ .............tn.........................@................ .........................Q....................................0............................... ......................`................................text...............................`.``.data...\...........................@.`..rdata..<(.......*..................@.`@.bss..................................`..edata..Q...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..reloc.......0......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\POSIX\POSIX.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	6.3185784465539365
Encrypted:	false
SSDEEP:	768:XCKpMF2o/pXgGGH7Bg91Urc8TMC/Z/yXTwzQx/quGHQEfn5SOewVT2Ye0bCjkCyC:XCKqFvX2s8c8YCxWExgygJ8DY8QqPG
MD5:	6A2B060848824D269B20FF7747F0B497
SHA1:	DDD8FF12D5B2600C10863E8DB14842A64BFCC0D3
SHA-256:	B16F77F7AF6DD51C87A75BF8D6CC0372561BE2220018D553DCF60717D3B0D893
SHA-512:	61E9C548B3344E4F163E116B2F437C23D0C2E4936B1C1F3B1111269580E1303EC2E2021553EB0C224EC7CC6CEA4E8DFB30C054D2F9DF523A143DC3F738402599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.........t...... ..............c.................................H........ .....................................................................................................................................................text...T...........................`.P`.data...`...........................@.P..rdata...D... ...F..................@.`@.bss.........p........................`..edata...............L..............@.0@.idata...............N..............@.0..CRT....,............`..............@.0..tls.... ............b..............@.0..reloc...............d..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Socket\Socket.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.788718066098964
Encrypted:	false
SSDEEP:	384:Ufapvk3fvWgP9HfO5H1KBLKu2LgCol0J0eXJGu9SQJdX6KuYwfJpe1YBa:9SfODKBLKu2LE0WIP8vfJI
MD5:	2414097D97AAC42205B4790303EABB9E
SHA1:	137BB58263181AC08982CC76207428F79B6C4BC7
SHA-256:	7DBB9F1F91B6A86B68D54A0F8F5D2436D3CCCFBE9B3F1543E67088E98AC049D0
SHA-512:	99797EF60794745F93BAC45D9006CDDBEB5C532146BBED548DDBF315D21A29AE6F1E5F1C84B6D8E67C5C1BA75EAF5DD8B7E7FC9BE5414877465846EED3F9F9BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..W...........#.....4...l...... ........P....Dg.................................t........ .........................................................................................................................@............................text...D2.......4..................`.P`.data........P.......8..............@.0..rdata..<....`... ...:..............@.`@.bss..................................`..edata...............Z..............@.0@.idata...............\..............@.0..CRT....,............f..............@.0..tls.... ............h..............@.0..reloc...............j..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\HiRes\HiRes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.870913293108737
Encrypted:	false
SSDEEP:	384:cDnwSVGILc1oOibFwyK0UlbZAVR4wiKdKeLhDrFARjPv9HtjPnRAX:WOipTYZAVewiKce9DrFYjPv9Njn
MD5:	CB0035D8ACA2F90ED764CA9241C13C88
SHA1:	B8ED0FD3971C881DF50652265854E5B16FBD1E75
SHA-256:	B0C0E46F869E2C14586207F749EA79EDF4E12E78FF5346F1E669A963CD71D44F
SHA-512:	D08B53BA3001B93A972A1F65A856787C05541384EC30DBD30A1C9FC5EE9FFCAC90CCE2F5E228E809A01992D344875CB62BC4F156E539F9433537F4289E4FED74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....6...X...... ........P....0a.................................)........ .................................................................<...................................................p... ............................text...T5.......6..................`.P`.data... ....P.......:..............@.0..rdata.......`.......<..............@.@@.bss.........p........................`..edata...............F..............@.0@.idata...............H..............@.0..CRT....,............R..............@.0..tls.... ............T..............@.0..reloc..<............V..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\Piece\Piece.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.791664922282194
Encrypted:	false
SSDEEP:	384:3Pw6J8EXKdQXA3/3BbyW9gzc/2QJy88Pv/L4DBP2E:3idQwPB+qO42QJD8PvM19
MD5:	236952E52097340F7D4EF83492EC526A
SHA1:	D488B6528CA53FB27B6609EF61B1DADD180F7B38
SHA-256:	63D8DA56B139540161BA2C24E553F0D4FB2FFC8C30FE113057A9C3C6B04E52D7
SHA-512:	56540055067E9EA8181774C5C8A92F52169CA62F2939FEF57B366A87BF40F4456A0540CFECD4174EED1236968ED3B1C060AA5C98EA7961FD851F99594CC86235
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....4...T...... ........P....Hi.......................................... .................................................................t.......................................................0............................text....2.......4..................`.P`.data........P.......8..............@.0..rdata.......`.......:..............@.`@.bss.........p........................`..edata...............B..............@.0@.idata...............D..............@.0..CRT....,............N..............@.0..tls.... ............P..............@.0..reloc..t............R..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32API\File\File.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	5.863286063204077
Encrypted:	false
SSDEEP:	768:leTbtKSMdL07u3Ds156NLqow9UEX5xfEowY3Tzg0EfsgsD9LwBySkf9BbmStUHj1:lnn/4tJPs0EflsDsYmj1
MD5:	E640F383458838B613CC082ABE34AC76
SHA1:	A846C0486093BF3A976F6CE0267EF11D2AB437A1
SHA-256:	8E4F9505CAA50DB78056393C2E2B7655AFF2CF22FC1DE68D59796D23E6AC87CA
SHA-512:	652EF489CC08515A16FF43B5441AE93A5ADEDAE4FB38E568DD1DB548FB25491A7CF09EE9EDF471FF908CC6721199719BBA24AA5AEE9C0D27F5B9380A49E6E9C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#........."...... .............`e.......................................... ......................@.......P..T............................................................p.......................Q...............................text...............................`.P`.data...............................@.0..rdata..\|.... ......................@.0@.bss.........0........................`..edata.......@......................@.0@.idata..T....P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..reloc..............................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\API\API.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.934846636262196
Encrypted:	false
SSDEEP:	768:Tf6VlFS+8vQ5Ptw5IiBN+2MPv9yI7JkgJg:LMFqIVw5ly2PgJg
MD5:	F7DD47A068B7F3D5C64AD91B6A30E7C7
SHA1:	BEE60E09E8B17BCAA5A107CBE801C40543D13D3F
SHA-256:	7C6018DAEF31E150232CFB178F622213DCEE8482A581254BBB5846E3D7E6D82B
SHA-512:	3EF18B4040AF73452200EF39225980449B0B2629C999659650423C33531F79E7E1B2D3DDDFE165029F70D07C41CC4A61C037EEE7121A1B81D45CC08BD8F39C4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....>...f...... ........P.....b.......................................... .................................................................h....................................................................................text...D=.......>..................`.P`.data... ....P.......B..............@.0..rdata.......`.......D..............@.0@.bss.........p........................`..edata...............P..............@.0@.idata...............R..............@.0..CRT....,............`..............@.0..tls.... ............b..............@.0..reloc..h............d..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Console\Console.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	5.928617993509944
Encrypted:	false
SSDEEP:	384:CsbEja/pRIDkBd3mWjvEjrc/tCctCOvkWLIO1D6NDPWVvch9gy+jUi2/M5p889Cn:tmkBdbvybaO+Vvc0y+oi2IQnf9GQVD9
MD5:	630DE11C11EE1FA2BF4DBACB75AB4799
SHA1:	F86EF65443D2C12EB00879C3B4A9ED99CB299D49
SHA-256:	CFB2894DB56A9633FCAD67D6D5B7F7C0F78C0A2FF44DA8712FDD4AC9B25D9C36
SHA-512:	80D07E61449C44ADD3472C928E09437BEECFCA1D9D3AFAA9C4AC6C8DAF9C7179C09659FE8A44BAD49718DBDAD6DD9A2D996A19EBB81135A32196BD918307A438
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....~.......... ..............q.................................A........ .................................8...............................$....................................................................................text....\|.......~..................`.P`.data...............................@.0..rdata..H...........................@.0@.bss..................................`..edata..............................@.0@.idata..8...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..$...........................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\FindFile\FindFile.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	6.07286484796476
Encrypted:	false
SSDEEP:	768:pZ5iCyESB9ROhPggBnAgMgKzlB/Aca7AwYXR5gYBtp7wzXPvLLM3:pLNSB9R0PxlRVKzlGAhR5PJ
MD5:	D5BEC90E16F99FE32727B00CF2048CE5
SHA1:	9D841386C2F63EA8ED195BA710471AB1A890567D
SHA-256:	EED7CA7FC3C06D749688FC5F2EFCB7B76C70AEE9B7755BC6EECF92FF45D0B41F
SHA-512:	021C8441E139D2756EFBE74397D0E7F9838BF627048864AC06A3FD1223242786AFF361ADBEDD97C4F0D3EEA93E3DF46D8B902FFE56B5C6A6C2D8E4120B0AB6B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....%X...........#.....p.......... ..............b................................x......... .........................T.......D............................... ....................................................................................text....n.......p..................`.P`.data................t..............@.0..rdata...............v..............@.@@.bss..................................`..edata..T...........................@.0@.idata..D...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc.. ...........................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Win32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	6.020354158187508
Encrypted:	false
SSDEEP:	768:MwYkmL0oXxkjGgx9r2oVxUjjsCdkT5pjLIW/ymyQOH5WkSUl/3TkLuF0TOO8eAAY:MwoL0o69CoCjjdc5pB/ymqWTU53TkLuN
MD5:	83E4A46C2DA50A551469DF4C299570FC
SHA1:	2A7AD11E09581CFB4351CDF60D92498F874DBB02
SHA-256:	9C0FA5A8BF5A0DCF7777C32A4DE912DC1844296995F7468C1152CACC2A8E2AC3
SHA-512:	34D41FEBAEDA6FF34EC03207B94C69D4EE7C24C3452B83283F77273D94754D650F1EA7D3F8136D6061BF07C1704966822382F8852016E733DEE298188F47FF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.....\|.......... ..............p.........................0......hh........ .............................................................. .. .......................................................0............................text...T{.......\|..................`.P`.data... ...........................@.0..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc.. .... ......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\mro\mro.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.681974720018673
Encrypted:	false
SSDEEP:	384:hgubsejS1EXujg1zOILYD9yfyd0HWOnTScX/9Te67kC:rIILYD9j/OnTScv9CYk
MD5:	8ECD5BAB1F28A7B4DF0FD2D601F9284E
SHA1:	37E20AA7496A162F1D8FD66837056FB5CC32581D
SHA-256:	49248D9CD4316C97B874318C9C38E891EAF16BA2BF8513A96363B7E4115C50D9
SHA-512:	523C860FB8FB69927D6AE70254C716AD3A376D183163302388A9AE98D564E6AE3BE72DB5F6743057C3F1DCCEC3FEAC75D17459DFE5D4D89237FA4F77B2650F1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!..W...........#.....2...P...... ........P....xn.......................................... .................................(...............................l.......................................................p............................text...t1.......2..................`.P`.data........P.......6..............@.0..rdata..l....`.......8..............@.0@.bss.........p........................`..edata...............>..............@.0@.idata..(............@..............@.0..CRT....,............L..............@.0..tls.... ............N..............@.0..reloc..l............P..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\re\re.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	601088
Entropy (8bit):	6.269935079974536
Encrypted:	false
SSDEEP:	12288:hoQgDze4Hv5ptNTUX1y10h/1K9wUiGGoS/:Qzrv5ptNT30h/1K9wUVGoS/
MD5:	87D3F3AA9CB8CD61740E3828578A83CA
SHA1:	60593893D38397306B7AC740F1E19676EE17DB4B
SHA-256:	CA8CACB9FA02D2B949AED355C3D6CBD312353458130EB596E43978784EF7C2A1
SHA-512:	9D19628A0AA691880091E10C2F744B6220CD26E452D95862045D75238326F88FFDF536E16253D0F21EDEAAFC5C72BD9FADD2F83C95523AC423CC7F5A7D3C1628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W...........#.........(...... ..............p................................ 6........ ..............................................................@..xG...........................0......................@................................text...............................`.P`.data...............................@.`..rdata..\...........................@.`@.bss..................................`..edata..............................@.0@.idata........... ..................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..reloc..xG...@...H..................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\autouse.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	5.07841388220062
Encrypted:	false
SSDEEP:	48:uXUx/xNzpbz1lgDCUl0gULXf9YFxbno6Yvc6v7LwI3VEe4cj:gI/3Nn1lDXf0bo6YvdTLwKj
MD5:	985DA2B800F6A0AD52EE3CB70E75442C
SHA1:	393FC471618C776C3A2B4761EDFC6814A295D0AD
SHA-256:	BA2196E87654216C3A3FF0F20A64B3BB2F300015A249584232037D43526A32B2
SHA-512:	7E9C61E4ACBFBAA219A6BD960E6EEFB70717C790D8CBBCE154EF97DB8020D596F8ECC5D1F2D8706EF9781CCC7C36A4BFB7C3B8DDE63F65355CD3FD377907494F
Malicious:	false
Preview:	#line 1 "autouse.pm".package autouse;..#use strict;..# debugging only.use 5.006;..# use warnings..$autouse::VERSION = '1.11';..$autouse::DEBUG \|\|= 0;..sub vet_import ($);..sub croak {. require Carp;. Carp::croak(@_);.}..sub import {. my $class = @_ ? shift : 'autouse';. croak "usage: use $class MODULE [,SUBS...]" unless @_;. my $module = shift;.. (my $pm = $module) =~ s{::}{/}g;. $pm .= '.pm';. if (exists $INC{$pm}) {..vet_import $module;..local $Exporter::ExportLevel = $Exporter::ExportLevel + 1;..# $Exporter::Verbose = 1;..return $module->import(map { (my $f = $_) =~ s/$.?$$//; $f } @_);. }.. # It is not loaded: need to do real work.. my $callpkg = caller(0);. print "autouse called from $callpkg\n" if $autouse::DEBUG;.. my $index;. for my $f (@_) {..my $proto;..$proto = $1 if (my $func = $f) =~ s/$(.)$$//;...my $closure_import_func = $func;.# Full name..my $closure_func = $func;..# Name inside package..my $index = rindex($func, '::');..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\base.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5373
Entropy (8bit):	4.764253206884749
Encrypted:	false
SSDEEP:	96:/Q/YcNwfYYz29I/fcG0PA1KVIPNLSGbfGu4kHFgrHyiU9uqEnd/eSVxlq:/xgYz6I/f50I1K6OGbOuFsyiNqE5Vzlq
MD5:	E1E937C14CC9F82DEE1DAFE82B0F2188
SHA1:	F5139ABA09DB23175457B5328F3BD8817F6B5CD4
SHA-256:	AB3A37FCE2CEA09A1DC340B1354AD7BAB9987C4EC3357B70CE96260C9332CD92
SHA-512:	ABAEA6457A4B3E3FDE5CF2049ABE689E4BB10DA5AAF268CBF974831AD2ABFA96F6FC90D33AE4205C5BD032EADD5CDD4DF3D51ED9FB36DBB5CAF88863625248FA
Malicious:	false
Preview:	#line 1 "base.pm".use 5.008;.package base;..use strict 'vars';.use vars qw($VERSION);.$VERSION = '2.23';.$VERSION =~ tr/_//d;..# constant.pm is slow.sub SUCCESS () { 1 }..sub PUBLIC () { 20 }.sub PRIVATE () { 21 }.sub INHERITED () { 22 }.sub PROTECTED () { 23 }...my $Fattr = \%fields::attr;..sub has_fields {. my($base) = shift;. my $fglob = ${"$base\::"}{FIELDS};. return( ($fglob && 'GLOB' eq ref($fglob) && $fglob{HASH}) ? 1 : 0 );.}..sub has_attr {. my($proto) = shift;. my($class) = ref $proto \|\| $proto;. return exists $Fattr->{$class};.}..sub get_attr {. $Fattr->{$_[0]} = [1] unless $Fattr->{$_[0]};. return $Fattr->{$_[0]};.}..if ($] < 5.009) {. get_fields = sub {. # Shut up a possible typo warning.. () = \%{$_[0].'::FIELDS'};. my $f = \%{$_[0].'::FIELDS'};.. # should be centralized in fields? perhaps. # fields::mk_FIELDS_be_OK. Peh. As long as %{ $package . '::FIELDS' }. # is used here anyway

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\bytes.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.175092331334978
Encrypted:	false
SSDEEP:	12:TFXAGsQU6gAWzFYOCxsztyJtwl4sgFqlf0jx+VMjJ9KEqYPsn:TWQU6gVz4sEw4ffxWWKEqY0n
MD5:	7415F9FD48EA58D9E1C0A2F5B33E3DA7
SHA1:	F229476F295887F7BF71BA639ED2A63157B9C328
SHA-256:	294C6F432F8F9E874DA33CA8735B437B1D843A19689069C677E6D6F7E90FB12C
SHA-512:	B717DB3B62C9A54C839BB03252DD316CDBD0688D10EBF2CF285EDCB087836B3CA7A591434266E2A3033DDE4A8E3C981D7A5FEA46559BA9FE6E310B3627D0D3B5
Malicious:	false
Preview:	#line 1 "bytes.pm".package bytes;..our $VERSION = '1.05';..$bytes::hint_bits = 0x00000008;..sub import {. $^H \|= $bytes::hint_bits;.}..sub unimport {. $^H &= ~$bytes::hint_bits;.}..sub AUTOLOAD {. require "bytes_heavy.pl";. goto &$AUTOLOAD if defined &$AUTOLOAD;. require Carp;. Carp::croak("Undefined subroutine $AUTOLOAD called");.}..sub length (_);.sub chr (_);.sub ord (_);.sub substr ($$;$$);.sub index ($$;$);.sub rindex ($$;$);..1;.__END__..#line 127.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\bytes_heavy.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	758
Entropy (8bit):	4.881379259988107
Encrypted:	false
SSDEEP:	12:quxQ1QNwhQ1Q5gBUWs9/fxQ1QNomTQ1QNcBQ1Q5gBs6o162BQ1Q5gBPoOM:qesQShsQ5gBUWs9/fxsQdTsQCBsQ5gBg
MD5:	50D2926265097AD82558258A95FF0DD8
SHA1:	F7C0517AE493A39E0A6B2FBA90D9B69BC421B4A3
SHA-256:	C7DEF62CBF7D031C4FE319E414117043F2A273885BFF93BD18E11935D00A6677
SHA-512:	97F4077FCF60463C67F31B1F881C5512028DCE75FF1E1D5BAE1C03459061979A0010DE53513A0E127ABA9A19DF837965C776E99D6E6DD15989286EB3F0482856
Malicious:	false
Preview:	package bytes;..sub length (_) {. BEGIN { bytes::import() }. return CORE::length($_[0]);.}..sub substr ($$;$$) {. BEGIN { bytes::import() }. return..@_ == 2 ? CORE::substr($_[0], $_[1]) :..@_ == 3 ? CORE::substr($_[0], $_[1], $_[2]) :.. CORE::substr($_[0], $_[1], $_[2], $_[3]) ;.}..sub ord (_) {. BEGIN { bytes::import() }. return CORE::ord($_[0]);.}..sub chr (_) {. BEGIN { bytes::import() }. return CORE::chr($_[0]);.}..sub index ($$;$) {. BEGIN { bytes::import() }. return..@_ == 2 ? CORE::index($_[0], $_[1]) :.. CORE::index($_[0], $_[1], $_[2]) ;.}..sub rindex ($$;$) {. BEGIN { bytes::import() }. return..@_ == 2 ? CORE::rindex($_[0], $_[1]) :.. CORE::rindex($_[0], $_[1], $_[2]) ;.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\constant.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	5769
Entropy (8bit):	5.188267168740443
Encrypted:	false
SSDEEP:	96:OZ+wXQPSdyGdrrzyXQdIEmt+BhEKiMCB9soCC3qqax6MVPZHxML/c5:OZDX4SdL+emsBhEKiNUqax63L/4
MD5:	195E539FF8259676DB66B8D22D6CE172
SHA1:	A2582796CD1E3531513C1F7016B62E6A57749C15
SHA-256:	A01C6455A6EDCC030C83E831877E89E22DEDCDF7F3AA2B1E050B0789D89F834D
SHA-512:	7F6FD13A80A63051932C8FF6FFD053F7980E922986CAA43A91139B122963C7C6A293DF40D6AF80CCF99D6A6FBEE1930B086B8E5964D3DDE2177ECDB3BCADBACD
Malicious:	false
Preview:	#line 1 "constant.pm".package constant;.use 5.008;.use strict;.use warnings::register;..our $VERSION = '1.33';.our %declared;..#=======================================================================..# Some names are evil choices..my %keywords = map +($_, 1), qw{ BEGIN INIT CHECK END DESTROY AUTOLOAD };.$keywords{UNITCHECK}++ if $] > 5.009;..my %forced_into_main = map +($_, 1),. qw{ STDIN STDOUT STDERR ARGV ARGVOUT ENV INC SIG };..my %forbidden = (%keywords, %forced_into_main);..my $normal_constant_name = qr/^_?[^\W_0-9]\w\z/;.my $tolerable = qr/^[A-Za-z_]\w\z/;.my $boolean = qr/^[01]?\z/;..BEGIN {. # We'd like to do use constant _CAN_PCS => $] > 5.009002. # but that's a bit tricky before we load the constant module :-). # By doing this, we save several run time checks for every call. # to import.. my $const = $] > 5.009002;. my $downgrade = $] < 5.015004; # && $] >= 5.008. my $constarray = exists &_make_const;. if ($const) {..Internals::SvREADONLY($cons

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\feature.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4346
Entropy (8bit):	4.9532223860223565
Encrypted:	false
SSDEEP:	96:ss7QhZnVdfgJVzVYxIxtnZ/TdBgnaCZ+biw7o3UyR1JT5KWRiCOTSDh7v3KZX:ss7+VuVzVYSDnRiTw/y95KzCOT+wX
MD5:	57A594AFB48DED1ED5E6831ECF59F3F9
SHA1:	338B471E9E08DE0E495DD2190EA89392CE96BADA
SHA-256:	CB170BA9A13DB7211006F5507803E7BDF35941C0E36E222312DCF04AB8F8E791
SHA-512:	C05903D7698375C7F0AA1DCF26B71E22496C16CE1505FF0DCF3DF7893E7F3E53FF8A115033F96A7E90292E440E6EE6279719ACC9791A120D3A2389A7EDEAC86B
Malicious:	false
Preview:	#line 1 "feature.pm".# -- buffer-read-only: t --.# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!.# This file is built by regen/feature.pl..# Any changes made here will be lost!..package feature;..our $VERSION = '1.42';..our %feature = (. fc => 'feature_fc',. say => 'feature_say',. state => 'feature_state',. switch => 'feature_switch',. bitwise => 'feature_bitwise',. evalbytes => 'feature_evalbytes',. postderef => 'feature_postderef',. array_base => 'feature_arybase',. signatures => 'feature_signatures',. current_sub => 'feature___SUB__',. refaliasing => 'feature_refaliasing',. lexical_subs => 'feature_lexsubs',. postderef_qq => 'feature_postderef_qq',. unicode_eval => 'feature_unieval',. unicode_strings => 'feature_unicode',.);..our %feature_bundle = (. "5.10" => [qw(array_base say state switch)],. "5.11" => [qw(array_base say state switch un

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\integer.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.857891751518141
Encrypted:	false
SSDEEP:	6:TFETMOwsQFa83GY5sFYRanWswYyvswYkw:TFE7wsQU82Y5sFYMWstyvstkw
MD5:	7CDF6973565C33284817452F7D7B28C6
SHA1:	22C94DEF611BBF47923537442E4DCAAC396E3943
SHA-256:	82A3F6FE1774ACD0AFF681AB4399ABE86B40DDAB824F6A6D3D040C1D3980623C
SHA-512:	D2C5371F7184BF51E86A6D1F6C168AB46410FE778EE05AB80479007397EC671FD14329F702745886D036CCA45DC8968D9FAEA771C4B18D33B365522AE7230606
Malicious:	false
Preview:	#line 1 "integer.pm".package integer;..our $VERSION = '1.01';..#line 82..$integer::hint_bits = 0x1;..sub import {. $^H \|= $integer::hint_bits;.}..sub unimport {. $^H &= ~$integer::hint_bits;.}..1;.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\locale.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	4.179165118146971
Encrypted:	false
SSDEEP:	96:teQmkXYl4Sd0vki0VgmBMAwUMBfw3ypCP:EwXYl4ey70OmBZwUCayw
MD5:	601EAD3884EC5C6461F2B079AD1ED5D9
SHA1:	E316691D005A31CA880F2838BF42B337CA96C26D
SHA-256:	53E62333C7C9D8A99F5BAABB0BB494E78B0BF564DE36FAE48D5ED3DA1D8D374E
SHA-512:	EEF4923549F9D6C9E57CD66C661465A8095614A93AC6CAA7852928F08F91E520CB819557616FB973C9917FBDB0565970E764E919115B0958953B0F77BC7A5C1B
Malicious:	false
Preview:	#line 1 "locale.pm".package locale;..our $VERSION = '1.09';.use Config;..$Carp::Internal{ (__PACKAGE__) } = 1;..#line 48..# A separate bit is used for each of the two forms of the pragma, to save.# having to look at %^H for the normal case of a plain 'use locale' without an.# argument...$locale::hint_bits = 0x4;.$locale::partial_hint_bits = 0x10; # If pragma has an argument..# The pseudo-category :characters consists of 2 real ones; but it also is.# given its own number, -1, because in the complement form it also has the.# side effect of "use feature 'unicode_strings'"..sub import {. shift; # should be 'locale'; not checked.. $^H{locale} = 0 unless defined $^H{locale};. if (! @_) { # If no parameter, use the plain form that changes all categories. $^H \|= $locale::hint_bits;.. }. else {. my @categories = ( qw(:ctype :collate :messages. :numeric :monetary :time) );. for (my $i = 0; $i < @_; $i++) {. my $arg = $

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\mro.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	873
Entropy (8bit):	5.090496780130617
Encrypted:	false
SSDEEP:	24:TitHqicyIrTZHpQQURJLcyvKz3cNzn/X5HS:WzcyYTTQQUfDq8/X5HS
MD5:	3186D689195F051E466556458E3FDCDE
SHA1:	2ABDF9B313280324A330C4CF9B914DD25DEE8E32
SHA-256:	00C3B13A1F12D4157D10E4D5C18BBE60993C59B3906BE91543D67D6D1DE7D434
SHA-512:	2CBD8745F31BD4AC0A30E1F3D82FE0582D67E2909ABB6A194403FF60E454F99410E67075D1EEC5B7E17E1267706C81970E46E2B22CF431364CFE49462D762340
Malicious:	false
Preview:	#line 1 "mro.pm".# mro.pm.#.# Copyright (c) 2007 Brandon L Black.# Copyright (c) 2008,2009 Larry Wall and others.#.# You may distribute under the terms of either the GNU General Public.# License or the Artistic License, as specified in the README file..#.package mro;.use strict;.use warnings;..# mro.pm versions < 1.00 reserved for MRO::Compat.# for partial back-compat to 5.[68].x.our $VERSION = '1.18';..sub import {. mro::set_mro(scalar(caller), $_[1]) if $_[1];.}..package # hide me from PAUSE. next;..sub can { mro::_nextcan($_[0], 0) }..sub method {. my $method = mro::_nextcan($_[0], 1);. goto &$method;.}..package # hide me from PAUSE. maybe::next;..sub method {. my $method = mro::_nextcan($_[0], 0);. goto &$method if defined $method;. return;.}..require XSLoader;.XSLoader::load('mro');..1;..__END__..#line 354.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\overload.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	4500
Entropy (8bit):	5.022539306423407
Encrypted:	false
SSDEEP:	96:MQkzz20DhoA23Jc0ikGxaFgS3o8y3wjlGcwgSlJxyvkzauiL/JQv:MVO0toA2ZUkGxaFgS3fy3clag4PniL/s
MD5:	202733364AC0B3BB450F97139F49AF70
SHA1:	9A7223EF5986AF116BBC1D249405861EB80FB537
SHA-256:	5D0DEF12F2B1B322A6DD62AC62192EC0262F55BB9B86F959116439B33B174B5B
SHA-512:	0425B568C3F8D02A8E60BF2E82D9F768A8DC363E6AEC53FA963F3B550DA9219B04E0A02A7436D6B336111DEC79DDD499ED24409E69FD9B2808B39B0F8F686689
Malicious:	false
Preview:	#line 1 "overload.pm".package overload;..our $VERSION = '1.26';..%ops = (. with_assign => "+ - * / % ** << >> x .",. assign => "+= -= = /= %= = <<= >>= x= .=",. num_comparison => "< <= > >= == !=",. '3way_comparison' => "<=> cmp",. str_comparison => "lt le gt ge eq ne",. binary => '& &= \| \|= ^ ^= &. &.= \|. \|.= ^. ^.=',. unary => "neg ! ~ ~.",. mutators => '++ --',. func => "atan2 cos sin exp abs log sqrt int",. conversion => 'bool "" 0+ qr',. iterators => '<>',. filetest => "-X",. dereferencing => '${} @{} %{} &{} {}',. matching => '~~',. special => 'nomethod fallback =',.);..my %ops_seen;.for $category (keys %ops) {. $ops_seen{$_}++ for (split /\s+/, $ops{$category});.}..sub nil {}..sub OVERLOAD {. $package = shift;. my %arg = @_;. my $sub;. *{$package . "::(("} = \&nil; # Make it finda

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\overload\numbers.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	4.213951126073501
Encrypted:	false
SSDEEP:	48:HAfT4zs/bU/FF+1hzxTnghjil4y8M/Rbyhg:HAYswNUbhQ2h8MZ2hg
MD5:	D06FE1B26216841B953DD1BBA28CD496
SHA1:	969F6454E51BF2A87F48D5C2C6D2BE19CD2D6F92
SHA-256:	6DF9F193DB0FCB34DD2BD629577A31DEF404619D2EA10714948258E7F7EE1505
SHA-512:	302E73E36B0123D00FCCF4F5622DFCFC31209231998D0DE6ECD0427EBF36F536E1788103F4980AAD0748ABD1A4102632AD3ED432B63653A2C6FE6B8742C74FEB
Malicious:	false
Preview:	#line 1 "overload/numbers.pm".# -- buffer-read-only: t --.#.# lib/overload/numbers.pm.#.# Copyright (C) 2008 by Larry Wall and others.#.# You may distribute under the terms of either the GNU General Public.# License or the Artistic License, as specified in the README file..#.# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!.# This file is built by regen/overload.pl..# Any changes made here will be lost!..package overload::numbers;..our @names = qw#. (). (${}. (@{}. (%{}. ({}. (&{}. (++. (--. (bool. (0+. ("". (!. (=. (abs. (neg. (<>. (int. (<. (<=. (>. (>=. (==. (!=. (lt. (le. (gt. (ge. (eq. (ne. (nomethod. (+. (+=. (-. (-=. (. (=. (/. (/=. (%. (%=. (. (*=. (<<. (<<=. (>>. (>>=. (&. (&=. (&.. (&.=. (\|. (\|=. (\|.. (\|.=. (^. (^=. (^.. (^.=. (<=>. (cmp. (~. (~.. (atan2. (cos. (sin.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\overloading.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	999
Entropy (8bit):	5.179334020975377
Encrypted:	false
SSDEEP:	24:TG2QJS8jmHAUqbibx3sl7P5j4lL5MYVd7P9S8Hbbv:LQxjXWpsl7Zjud748H/v
MD5:	FDB6CF6DF1CDDDEEC6294A7DB4D0FA93
SHA1:	EF499A5317F14B5B20FDA0569AEE8E9F0204587B
SHA-256:	17DF9D3360658A8910E79856414501C8715A43C42DDCE642435F39E00D9983BD
SHA-512:	42DDF5ED8E4245BE15E23E6D104F0F9EC4E9CF210CBE743AF82E72873FCC98E98003F5F93184226F4FE67C8DCF77D5D6114FF8C01C35E8594ACA0E4EFE0C8E61
Malicious:	false
Preview:	#line 1 "overloading.pm".package overloading;.use warnings;..our $VERSION = '0.02';..my $HINT_NO_AMAGIC = 0x01000000; # see perl.h..require 5.010001;..sub _ops_to_nums {. require overload::numbers;.. map { exists $overload::numbers::names{"($_"}..? $overload::numbers::names{"($_"}..: do { require Carp; Carp::croak("'$_' is not a valid overload") }. } @_;.}..sub import {. my ( $class, @ops ) = @_;.. if ( @ops ) {..if ( $^H{overloading} ) {.. vec($^H{overloading} , $_, 1) = 0 for _ops_to_nums(@ops);..}...if ( $^H{overloading} !~ /[^\0]/ ) {.. delete $^H{overloading};.. $^H &= ~$HINT_NO_AMAGIC;..}. } else {..delete $^H{overloading};..$^H &= ~$HINT_NO_AMAGIC;. }.}..sub unimport {. my ( $class, @ops ) = @_;.. if ( exists $^H{overloading} or not $^H & $HINT_NO_AMAGIC ) {..if ( @ops ) {.. vec($^H{overloading} \|\|= '', $_, 1) = 1 for _ops_to_nums(@ops);..} else {.. delete $^H{overloading};..}. }.. $^H \|= $HINT_NO_AMAGIC;.}..1;.__END__..#line 100.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\parent.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.6276033331209625
Encrypted:	false
SSDEEP:	12:TFGvEIMlfMQCCQ4J4zE/liCZVusqolqL4YQe4kN/8lsqBTstwLFV:TYvEr5/rGCZosjU/qs8JUC
MD5:	D8736CE9F6D6766FFC8DA308E867167C
SHA1:	DE23F932E29CEFE3A611907C1FE47921BC138FF2
SHA-256:	C8B0DBA14A28B22C6F006FD94B41153C6602C39B53A9451F0A0223E46C7418B1
SHA-512:	FE53C4A32E4EC08EA8A16D7F13D8D17727624CF135EF0B35AA7F8F842EB6D79C4BC1EB8349298A86258D6DF9C579063F0D4503C873C72495C1F2B2C345FA62C3
Malicious:	false
Preview:	#line 1 "parent.pm".package parent;.use strict;.use vars qw($VERSION);.$VERSION = '0.234';..sub import {. my $class = shift;.. my $inheritor = caller(0);.. if ( @_ and $_[0] eq '-norequire' ) {. shift @_;. } else {. for ( my @filename = @_ ) {. s{::\|'}{/}g;. require "$_.pm"; # dies if the file is not found. }. }.. {. no strict 'refs';. push @{"$inheritor\::ISA"}, @_;. };.};.."All your base are belong to us"..__END__....#line 120.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\re.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	8665
Entropy (8bit):	4.5559107571282516
Encrypted:	false
SSDEEP:	192:06fr8z6jLbOJykcC88mCA1wtaYTLrJizfDb:06frJ3qcOaY1ib
MD5:	882840CEEB32BB03795C3FE67A91CEF7
SHA1:	79EB015EF9511AA503B34E218BCEA1C5C20B40F7
SHA-256:	D2FD30CB1BA4D41547E8E6EE233F60165F990E8A027B1EA784D92F52808E852D
SHA-512:	755BAEED6D3F91990959397C05F97E871A02476CC2C99F6E92BA8694E7CB3988B3E514B34545925BC3F9B34D18C6DC36C4DD72D2C4027043A6173E322536EE4E
Malicious:	false
Preview:	#line 1 "re.pm".package re;..# pragma for controlling the regexp engine.use strict;.use warnings;..our $VERSION = "0.32";.our @ISA = qw(Exporter);.our @EXPORT_OK = ('regmust',. qw(is_regexp regexp_pattern. regname regnames regnames_count));.our %EXPORT_OK = map { $_ => 1 } @EXPORT_OK;..my %bitmask = (. taint => 0x00100000, # HINT_RE_TAINT. eval => 0x00200000, # HINT_RE_EVAL.);..my $flags_hint = 0x02000000; # HINT_RE_FLAGS.my $PMMOD_SHIFT = 0;.my %reflags = (. m => 1 << ($PMMOD_SHIFT + 0),. s => 1 << ($PMMOD_SHIFT + 1),. i => 1 << ($PMMOD_SHIFT + 2),. x => 1 << ($PMMOD_SHIFT + 3),. n => 1 << ($PMMOD_SHIFT + 5),. p => 1 << ($PMMOD_SHIFT + 6),. strict => 1 << ($PMMOD_SHIFT + 10),.# special cases:. d => 0,. l => 1,. u => 2,. a => 3,. aa => 4,.);..sub setcolor {. eval {....# Ignore errors. require Term::Cap;.. my $terminal = Tgetent Term::Cap ({OSPEED => 9600}); # Avoid warning.. my $pro

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\strict.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.753789119241651
Encrypted:	false
SSDEEP:	48:qLaQWwRqEoaqhRVsNRGFnZObG8iVyHneArJqU0:qLaQWk8aIOcFZOK8iYHT1k
MD5:	C89509623E867EE19E27CD913F131D7B
SHA1:	BDF741578F7B01C9A8254378FF83A0926518890A
SHA-256:	A1BC3C3005259D596538F22899B506430C9925677CE7306577DAD021C8780B22
SHA-512:	01207CA06BD6F940F11FCDBD4FD93A4FD671CCA7AC26C2BE3029B7AAE76CABC99D059E363449A130FC867DB46F8F7FE57CE3E0A55A3727C5368280BDAB2B6CE0
Malicious:	false
Preview:	#line 1 "strict.pm".package strict;..$strict::VERSION = "1.11";..my ( %bitmask, %explicit_bitmask );..BEGIN {. # Verify that we're called correctly so that strictures will work.. # Can't use Carp, since Carp uses us!. # see also warnings.pm.. die sprintf "Incorrect use of pragma '%s' at %s line %d.\n", __PACKAGE__, +(caller)[1,2]. if __FILE__ !~ ( '(?x) \b '.__PACKAGE__.' \.pmc? \z' ). && __FILE__ =~ ( '(?x) \b (?i:'.__PACKAGE__.') \.pmc? \z' );.. %bitmask = (. refs => 0x00000002,. subs => 0x00000200,. vars => 0x00000400,. );.. %explicit_bitmask = (. refs => 0x00000020,. subs => 0x00000040,. vars => 0x00000080,. );.. my $bits = 0;. $bits \|= $_ for values %bitmask;.. my $inline_all_bits = $bits;. all_bits = sub () { $inline_all_bits };.. $bits = 0;. $bits \|= $_ for values %explicit_bitmask;.. my $inline_all_explicit_bits = $bits;. all_explicit_bits = sub () { $inline_all_explic

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\Blocks.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8978
Entropy (8bit):	5.264135596524987
Encrypted:	false
SSDEEP:	192:w1LTUgj3wUSpmmFHGWe6FEhnzu5FKiRdp6gIRRq:wTVjipmeHpe6FEhzIagIRRq
MD5:	865201CD6FF4959621B86620365B9DEB
SHA1:	E1B29A88E2ACEE8911501FF427109A5159798618
SHA-256:	288FC7B85C76BDA296E296C8465F1F4BAEB456CB814430DFAA0F546BFBE86B4A
SHA-512:	7D11590E5678A06B51D9FAB787FA4912120EA5E8DC8F89B2CDDDA9472DADD52514A74B0D3672F47E38F1ED3691E0599CDF6134CD4BBC7B5121977B57E8C842EF
Malicious:	false
Preview:	# Blocks-8.0.0.txt.# Date: 2014-11-10, 23:04:00 GMT [KW].#.# Unicode Character Database.# Copyright (c) 1991-2014 Unicode, Inc..# For terms of use, see http://www.unicode.org/terms_of_use.html.# For documentation, see http://www.unicode.org/reports/tr44/.#.# Format:.# Start Code..End Code; Block Name..# ================================================..# Note: When comparing block names, casing, whitespace, hyphens,.# and underbars are ignored..# For example, "Latin Extended-A" and "latin extended a" are equivalent..# For more information on the comparison of property values, .# see UAX #44: http://www.unicode.org/reports/tr44/.#.# All block ranges start with a value where (cp MOD 16) = 0,.# and end with a value where (cp MOD 16) = 15. In other words,.# the last hexadecimal digit of the start of range is ...0 .# and the last hexadecimal digit of the end of range is ...F..# This constraint on block ranges guarantees that allocations.# are done

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\CombiningClass.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	4.67432645050329
Encrypted:	false
SSDEEP:	96:0zoEnz/1x5mN7rfx5xIIIECzQHFXVGrC0rhEXInyc6nCVSP1CH:iZT1x5mN7rfJCUHBVelE/2VSPk
MD5:	88FE907DFE4DFD53990C8FACC5D9938D
SHA1:	8FDFF5ED4A75C051E2AF1608BB8CB32E1573E2E3
SHA-256:	19A7726A803077F35A0E5F5634C1053797B2AB23658598C6695B65AC58D1BBBC
SHA-512:	B04282A3D23F9909D66CD6EF2970E1A26484C1CF6EB52690581268664A76E9814899E000A76626738958890760C970A28FDE0AE6F5C4F26727059A6DEA64D335
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToCombiningClass'}{'format'} = 'i'; # integer..$utf8::SwashInfo{'ToCombiningClass'}{'missing'} = '0';....return <<'END';..300.314.230..315..232..316.319.220..31A..232..31B..216..31C.320.220..321.322.202..323.326.220..327.328.202..329.333.220..334.338.1..339.33C.220..33D.344.230..345..240..346..230..347.349.220..34A.34C.230..34D.34E

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\Decomposition.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	114805
Entropy (8bit):	4.84754604217051
Encrypted:	false
SSDEEP:	1536:1RIz4KaXb2JDq1nUuj2R0zmjqKqCkBs+1RK6RI2yFHX4AK3JSuZp:oz44t8QRqJS4
MD5:	AF0323A1EB2818D84D5F20A111ED2233
SHA1:	DEC3AC14B6D34167F565F1AFF084D3E32BA069E4
SHA-256:	843E17A48A9AD614493D9B914195022356E1DB48FD8C4500E2381476F2CDF060
SHA-512:	99FF4F7006D48EC8909CC10807A4D7C647A9F8DE2E5AE706F4EF0CECC32191222CD5A65769E2618F030C7BB62744D83000028A786578D93D79F0318D8BD29836
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..A0..<noBreak> 0020..A8..<compat> 0020 0308..AA..<super> 0061..AF..<compat> 0020 0304..B2..<super> 0032..B3..<super> 0033..B4..<compat> 0020 0301..B5..<compat> 03BC..B8..<compat> 0020 0327..B9..<super> 0031..BA..<super> 006F..BC..<fraction> 0031 2044 0034..BD..<fraction> 0031 2044 0032..BE..<fraction> 0033 2044 0034..C0..0041 0300..C1..0041 0301..C2..0041 0302..C3..0041 0303..C4..0041 0308..C5..0041 030A..C7..0043 0327..C8..0045 0300..C9..0045 0301..CA..0045 0302..CB..0045 0308..CC..0049 0300..CD..0

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\Heavy.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	136199
Entropy (8bit):	5.156108623199621
Encrypted:	false
SSDEEP:	3072:RlG+a1rjgd+KCtx4wFkFKJADX1YV0oJ+SeNtkx8NKV9vFxprlD7/:RlG+krjgd+KwlDT
MD5:	BBDDE5AFD78AABBAEB9FCCC074E0FBB6
SHA1:	FC0DBC5E1D17AA0F4ADE432EB1107D7CCDD61FB8
SHA-256:	53C73A72B8F3A0EC504AB182133E48CC7C8999FB1DC552BAAC5DA5DCA500E1B9
SHA-512:	74B395F1C97E662A706712C91872E697E27EF1520B9F8D9393C5E0A97001B98BB6FBA8D3AC03E2551AA3E97DEFFCF061D6DECF648B0393D494342395C4DAB1B6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!......# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# This file is for the use of utf8_heavy.pl and Unicode::UCD....# Maps Unicode (not Perl single-form extensions) property names in loose..# standard form to their corresponding standard names..%utf8::loose_property_name_of = (..'age' => 'age',..'ahex' => 'ahex',..'alpha' => 'alpha',..'alphabetic' => 'alpha',..'asciihexdigit' => 'ahex',..'bc' => 'bc',..'bidic' => 'bidic',..'bidiclass' => 'bc',..'bidicontrol' => 'bidic',..'bidim' => 'bidim',..'bidimirrored' => 'bidim',..'bidipairedbrackettype' => 'bpt',..'blk' => '

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\Name.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	974552
Entropy (8bit):	4.837214309337095
Encrypted:	false
SSDEEP:	6144:0ZajVfCqoqYXktIxAW35jZtz2XalH5TXO9SM68Xq2Q/wuuiIzj8vb4CuloxFHA/X:ZVKqo39L+krUin28F6ndVAWT
MD5:	9E6E12F6F250633D7AE8CB2EE9D9DE9D
SHA1:	EA055C05E2C9F94D50DCDC9FAEB41F1E5B3E991F
SHA-256:	6E2CF8AEC8DFE70CDB91D2E1A8447B8B1714B7796554E7BE0C3DAC3EB02008D1
SHA-512:	070E5A2CE3AACC51F85E46D08CA460B8CE8B8A0975835435472A93C4B2A1D45C02BF4E89B0FC9725CBEB777A9EB1FA69C947A8C7A0B0DFC9C5A729700D83E5A2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..00000.NULL..00000.NUL..00001.START OF HEADING..00001.SOH..00002.START OF TEXT..00002.STX..00003.END OF TEXT..00003.ETX..00004.END OF TRANSMISSION..00004.EOT..00005.ENQUIRY..00005.ENQ..00006.ACKNOWLEDGE..00006.ACK..00007.ALERT..00007.BEL..00008.BACKSPACE..00008.BS..00009.CHARACTER TABULATION..00009.HORIZONTAL TABULATION..00009.HT..00009.TAB..0000A.LINE FEED..0000A.NEW LINE..0000A.END OF LINE..0000A.LINE FEED (LF)..0000A.EOL..0000A.LF..0000A.NL..0000B.LINE TABULATION..0000B.VERTICAL TABULATION..0000B

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\Name.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	9505
Entropy (8bit):	5.286968910393191
Encrypted:	false
SSDEEP:	192:+03enAAR4d7J4J7w8WU7L6916t7i8yaGya2jb7xdcmMO7a/FkXd:+03/u4d7J4J7w8WU7L6916t+8yaGyBXt
MD5:	17124A94344B1E44263CC9014C41682A
SHA1:	73F781A2DF0E8813DFCF326B9FAC06910A3CD4EC
SHA-256:	132FB9E755F8E61636B2D5D1823F30095E8FAB7815B13D008B3B57ABBB5EE96B
SHA-512:	F79CB74FA9D062979CD94FBBFB58B28CA597A7609FFF81AADCCF8BDEB14B805DCF7E6E7D1246DCD4044CACD06722ED4BBA945D27595B93608DAF675907BEBACE
Malicious:	false
Preview:	#line 1 "unicore/Name.pm".# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!......# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......package charnames;....# This module contains machine-generated tables and code for the..# algorithmically-determinable Unicode character names. The following..# routines can be used to translate between name and code point and vice versa....{ # Closure.... # Matches legal code point. 4-6 hex numbers, If there are 6, the first.. # two must be 10; if there are 5, the first must not be a 0. Written this.. # way to decrease backtracking. The first regex allows the code point to.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\NamedSequences.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17879
Entropy (8bit):	4.8626074674625706
Encrypted:	false
SSDEEP:	192:Latp5wqD6Du/PCR3mjaROYg2w36G4i2ykFieNK38AbkB4amB0amBZPZS9EuuK81d:y5sOYg2wvuscjR+02M0Vfdi+E
MD5:	9A547B9DA61F18FA83849189F085B28B
SHA1:	35711B80053F4428C9F9C6C936A1FD9F98B011DB
SHA-256:	E4C29D9CEEFBE2382AF819AC7646265A9E4EA599CE04A90D31BEC97CFAA2848F
SHA-512:	183DFDAC4106291AAB9D511D2971E58A59CB5461028E6AC569CFFDD9E3ADD67E17C205FEB27731B668CA1ACCBFE400B0E0293505EA7817D6EB9DAFCF9E72D497
Malicious:	false
Preview:	# NamedSequences-8.0.0.txt.# Date: 2015-02-19, 00:30:00 GMT [KW, LI].#.# Unicode Named Character Sequences.#.# This file is a normative contributory data file in the Unicode.# Character Database..#.# Copyright (c) 1991-2015 Unicode, Inc..# For terms of use, see http://www.unicode.org/terms_of_use.html.#.# Format:.# Name of Sequence; Code Point Sequence for USI.#.# Code point sequences in the Unicode Character Database.# use spaces as delimiters. The corresponding format for a.# UCS Sequence Identifier (USI) in ISO/IEC 10646 uses.# comma delimitation and angle brackets. Thus, a Unicode.# named character sequence of the form:.#.# EXAMPLE NAME;1000 1001 1002.#.# in this data file, would correspond to an ISO/IEC 10646 USI.# as follows:.#.# <1000, 1001, 1002>.#.# For more information, see UAX #34: Unicode Named Character.# Sequences, at http://www.unicode.org/unicode/reports/tr34/.#.# Note: The order of entries in this file is not significant..# However, entries are generally in script orde

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\SpecialCasing.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	16740
Entropy (8bit):	5.330496501323402
Encrypted:	false
SSDEEP:	192:I1W0G0k/i0Ru4gH9dGg6+UzPDwNQS0kmLRlHqiTWIEG9cyNA5wfhy2m7INT+Eom/:v3YWcHw5zPomLP5byyNEwfhmlmJt
MD5:	4C17368651BC455636F58C3366BDBBEB
SHA1:	F85CE0F440C79DA761059D3D0352A78CD21F497E
SHA-256:	FB2025DAE3B9B17649B6E379C1CDBDDF50641267CA6D2446CAECCF4A141FE167
SHA-512:	332DE6BDF9773572F6FD19280D7B9246468939428DB95552EA3801D336F9E5C5ADA8893B2CEB2F9F666CE487C373FDC5CD940E6F73640F18A60D95B0EEFBD25F
Malicious:	false
Preview:	# SpecialCasing-8.0.0.txt.# Date: 2014-12-16, 23:08:04 GMT [MD].#.# Unicode Character Database.# Copyright (c) 1991-2014 Unicode, Inc..# For terms of use, see http://www.unicode.org/terms_of_use.html.# For documentation, see http://www.unicode.org/reports/tr44/.#.# Special Casing.#.# This file is a supplement to the UnicodeData.txt file. It does not define any.# properties, but rather provides additional information about the casing of.# Unicode characters, for situations when casing incurs a change in string length.# or is dependent on context or locale. For compatibility, the UnicodeData.txt.# file only contains simple case mappings for characters where they are one-to-one.# and independent of context and language. The data in this file, combined with.# the simple case mappings in UnicodeData.txt, defines the full case mappings.# Lowercase_Mapping (lc), Titlecase_Mapping (tc), and Uppercase_Mapping (uc)..#.# Note that the preferred mechanism for defining tailored casing operations is

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Age.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19258
Entropy (8bit):	4.299767751058823
Encrypted:	false
SSDEEP:	384:iZRxXfZNrCx8sJSybs1lS6px7QLWz2wHiYflV5nSFX5TyXRAP8k7e/+SE:YxNexpbAlSQVzNiwlV5nS95uXRAP8k7f
MD5:	0A210A63DAFACE415785CC28A2302BA9
SHA1:	EBEEBCF91C1DA032DF70ED19A2F94776DC93079A
SHA-256:	7387A358272DE23D6F92A9B17BA453C4EB1C3C7987CE60EF0A88437B8EF6B5C0
SHA-512:	E067626CC4F87F95B959A1464BAEC55CD2CE0065E7ACACCB64ACF96CB777A8D5B9498E5684C7A95D3CF2B1B4C60CEC0E74D368E037AD8870BF7CF5D63018441B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToAge'}{'format'} = 'f'; # floating point number..$utf8::SwashInfo{'ToAge'}{'missing'} = 'Unassigned';....return <<'END';..0.1F5.1.1..1F6.1F9.3.0..1FA.217.1.1..218.21F.3.0..220..3.2..221..4.0..222.233.3.0..234.236.4.0..237.241.4.1..242.24F.5.0..250.2A8.1.1..2A9.2AD.3.0..2AE.2AF.4.0..2B0.2DE.1.1..2DF..3.0..2E0.2E9.1.1..2EA.2EE.3.0..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Bc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8552
Entropy (8bit):	4.718641434720383
Encrypted:	false
SSDEEP:	192:iZ79svYd/a3LSt4YjFg35RRcXs6j7bpkTQnIyH6dZ7h:iZ76vYd/aiFFoGXs6j7bpiyHyh
MD5:	43C53024AA36B6B3E11E0B5DEAC8FD72
SHA1:	3081140C421797F654B5DFCDBC2E4D8EC3282F6B
SHA-256:	6FB5C7325B27CD9BE11BC74ABB8351077DE5ED86B96BFDAEE387ACF2BE4E09BF
SHA-512:	B9C763AC540079A2AFC4736E3925E75D42C5C5E2C0D6D8C71B762A807A3C3A31CDCB0BCA1859D2D2E8F7766B863CF554E562851B357E019A6D5B127356E7B150
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToBc'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToBc'}{'missing'} = 'L';....return <<'END';..0.8.BN..9..S..A..B..B..S..C..WS..D..B..E.1B.BN..1C.1E.B..1F..S..20..WS..21.22.ON..23.25.ET..26.2A.ON..2B..ES..2C..CS..2D..ES..2E.2F.CS..30.39.EN..3A..CS..3B.40.ON..5B.60.ON..7B.7E.ON..7F.84.BN..85..B..86.9F.BN..A0..CS..A1..ON..A2.A5.ET.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Bmg.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	4.658153390857795
Encrypted:	false
SSDEEP:	96:0zo/2traAp6saZzU5UQeQY0i22N2NUC2RQh78IaCKLKwEjRer2rb7lgR2rICGs:iwMfHaK5UYYg202RmHwEder2r3lgIFGs
MD5:	4156720B31BA815DBE48918FE8EC578A
SHA1:	74EA2CE9BA3CF9FDA3370844DB564ED5EB350C1C
SHA-256:	DA7DF4ED0F0756CC86FF599C707D2EA9F649428CA9C0DBFC9A25FD717B7138B7
SHA-512:	91D4569494A765E969D7BB26AD63B9D229072EEA1A5004DDD008933C36A0017D4D72AEFC6789D86856F027B7F22E8DADD917239C0C662D01E1178F50E48F9647
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('Bidi_Mirroring_Glyph') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToBmg'}{'format'} = 'x'; # non-negat

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Bpb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2268
Entropy (8bit):	5.096826640868393
Encrypted:	false
SSDEEP:	48:0z+XnEncQq4AfZzE5ivTGVu78EP9UCK6EYR2rICGo:0zoEnztuZA5iN78IaCK6EYR2rICGo
MD5:	FC35B0F671A0C47062C71D187E5F7D22
SHA1:	26FC6632DCE7A1B684231EFD4FC20E518F422270
SHA-256:	3E005BF2559B243B1595F173B60AA507FAABA3CAB2D0070A7157679A7A8024CA
SHA-512:	F02A47EF4C105FA5BF4EEBA2261B1E723C9C3AFADF6293D7A00EE0E98D8F78E661CC2581EB6BF230A4273AA3FAD196A8800C7247EFB663CA80188A01AB782972
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToBpb'}{'format'} = 'x'; # non-negative hex whole number; a code point..$utf8::SwashInfo{'ToBpb'}{'missing'} = ''; # code point maps to the null string....return <<'END';..28..0029..29..0028..5B..005D..5D..005B..7B..007D..7D..007B..F3A..0F3B..F3B..0F3A..F3C..0F3D..F3D..0F3C..169B..169C..169C..169B..2045..2046..2046..2045..207D..207

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Bpt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1835
Entropy (8bit):	5.042681569380258
Encrypted:	false
SSDEEP:	48:0z+XnEncQcbixkL/3isGAJppKpOaIxNOquJEF:0zoEnzcexe/yq/pKpOawNWJEF
MD5:	D9997B8E348D6A79902BD211E668AF3D
SHA1:	9C9D2A178890D250A736A4924C2B60D3CB31AAC8
SHA-256:	24FACC9FCD37172E8E8D1F718B579A59702F95894B0FD67D7AC891BF8D4356E6
SHA-512:	6F700B0E85873E226B5DAFD62F4E08AB30A42C183D7756C413B5FC3A4E442A60DEBA3311E1BC672E113E7781B3DA0CA8FE2F44D444487849CF42D2A3AA9201F5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToBpt'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToBpt'}{'missing'} = 'n';....return <<'END';..28..o..29..c..5B..o..5D..c..7B..o..7D..c..F3A..o..F3B..c..F3C..o..F3D..c..169B..o..169C..c..2045..o..2046..c..207D..o..207E..c..208D..o..208E..c..2308..o..2309..c..230A..o..230B..c..2329..o..232A..c..2768..o..2769..c..276A..o..276B..c

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Cf.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16177
Entropy (8bit):	4.996906906350867
Encrypted:	false
SSDEEP:	192:iZvTgEJAUsnZa1UGchD7+IrlSEKFqM/YGIWlxhP6asR2iv1+JVpGbN25UGh2kHsF:iZbd3qJ+Ip5y5/1IwxRxsRkO4rh2kW
MD5:	7EFC54E8E05F11F1977ACB2E477256BF
SHA1:	3E9F6655FDADABC13BBC947D5EFD74B18E3F7A4B
SHA-256:	0E2E6B8777E8B688BFE1E23367AF3C003B5EBFB485FD85E09DE2F8AD33188E6E
SHA-512:	6142977A9593F7E8FB3A82BD94181B2A98D7496C0401A2A22A130A65F3D6F25D34771279C86E0620933F3C4A8F1CE16A618F6F7A4B10D28D40116300B5C156AA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# The mappings in the non-hash portion of this file must be modified to get the..# correct values by adding the code point ordinal number to each one that is..# numeric.....# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToCf'}{'format'} = 'ax'; # mapped value in hex; some entries need adjustment..$utf8::SwashInfo{'ToCf'}{'specials_name'} = 'utf8::ToSpecCf'; # Name of hash of spec

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Digit.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6250
Entropy (8bit):	4.603831157278587
Encrypted:	false
SSDEEP:	96:0zo/2tra+J/XIPX2SsYOgeTiQwhp3ddyzbZFh3jaiM7FqCyuqCTGK05mZ53qa1h/:iwM1PINPNdyzFjaiM5ByTuGtWoqhLL
MD5:	1B5CB26C7B53CC9CC2A87C4981A62213
SHA1:	432585BCF592451D6714E18D4EF0A2E0FF7D0B09
SHA-256:	AAA1FA94E34C1AAD917566AFA3FF54D1389ED69310FDD7977D562E6C490CB44E
SHA-512:	19D8E5F627A5AD3B8EDE53CB1D77F26CCEDB26180B539743850B4E3BE5ED91C3CC42869B5ED0891D055ABC695523B49E03974B67E977C9D818BB552B43852F4E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('Perl_Decimal_Digit') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToDigit'}{'format'} = 'd'; # single de

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Ea.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	4.835085553711307
Encrypted:	false
SSDEEP:	48:0z+XnEncQCZ1yjgn+qB3WvajzPXjSnYcQRvXPThLBkTkk71ZIhgNjWXt:0zoEnzCZ4q+KhzPj6m1OZIo4
MD5:	8030035C7EFFB3D32D88D053D22E4E6F
SHA1:	01F885E99A1142F4636C9BDFF587A98ED8CF9566
SHA-256:	1178B53E94E6A8553F6BD72C72DAF5BC331339B1BBE2D15114471EC9FD1D58DB
SHA-512:	72D5975E219AD3032A2229E7CF7A31736BF1B1C8E704D54746B24101479C7251EACF67D7E1139270E4F7854D99A7C670E4161E4F4B4AB3EDB8E8ABA3C3B05496
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToEa'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToEa'}{'missing'} = 'Neutral';....return <<'END';..20.7E.Na..A1..A..A2.A3.Na..A4..A..A5.A6.Na..A7.A8.A..AA..A..AC..Na..AD.AE.A..AF..Na..B0.B4.A..B6.BA.A..BC.BF.A..C6..A..D0..A..D7.D8.A..DE.E1.A..E6..A..E8.EA.A..EC.ED.A..F0..A..F2.F3.A..F7.FA.A..FC..A..FE..A..101..A..111..A..113..A

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Fold.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24128
Entropy (8bit):	4.828603088036559
Encrypted:	false
SSDEEP:	384:iwkK3qJ+Ip5J6VRPYIU+a9iYuEjH7mYFhuM57wUQph2kRbdr7:73qJ+Ip5J6VJYQa9i+D7ms5sUe2k77
MD5:	96F53E0F8B0690D7FA64EC3DA7D4DCC9
SHA1:	2135970A356CCBA38AC2DB8BE0AEA2A993AF0DC8
SHA-256:	79F5596407892AB8CA04569439D67AA11905FD61A110348EB6149896F8C940FC
SHA-512:	4D3F01FDEE6004ABF43533BA34079B6C6ADED02CC92B3C4CB76F3354E529C71852986845411481B1ED3DCE11714D128FCA7DC22AEF8EE9973E35313D19F7817E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('Case_Folding') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToFold'}{'format'} = 'x'; # non-negative hex

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\GCB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18706
Entropy (8bit):	4.9155130047475515
Encrypted:	false
SSDEEP:	384:iZqSg+moXvG8Y/qHBlE3eA6icSiDWIreKda0z4Wayx:x5mXvG8Z03jUhpXXx
MD5:	C923AAF4839707520F1951BB2AB47930
SHA1:	0C947FA5851FAFAFE559BC3DD55B9104CCFF56D2
SHA-256:	C29812BC9D45FDB119AC36053F5A0D669E761AE7BEA34D317FD90224BEADD46E
SHA-512:	B46F9FCECA58D9A12A99B006615D89076ED2AF354AA7CD041BFC62DB6A0A3DEE390D0CC4048F81084FE780603B4FBFA08BFFB5932FB20577664B7526E3E6A35B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToGCB'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToGCB'}{'missing'} = 'Other';....return <<'END';..0.9.Control..A..LF..B.C.Control..D..CR..E.1F.Control..7F.9F.Control..AD..Control..300.36F.Extend..483.489.Extend..591.5BD.Extend..5BF..Extend..5C1.5C2.Extend..5C4.5C5.Extend..5C7..Extend..600.605.Control..610.61A.Extend..61C..Cont

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Gc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34729
Entropy (8bit):	4.532361737571483
Encrypted:	false
SSDEEP:	384:iZ6KczyWIMJRmc0vbppvqERVBNw7Lwb7Xbvrx5UCwJvoku9ttNw3LF6k0OpsmPP4:Hhiwh09pvqMcCwJvhh3P5Qmig0
MD5:	DB1CECB5062BE3B04857CE6B40E296EF
SHA1:	0DE2F9A5AE8FBFE7EB3CFB676A6E3C991F32B15E
SHA-256:	A62A51325C949F9754241BA0D6DE10B4B789CFA7926644E0801A7D5D5CBAC99A
SHA-512:	7396F2D598D630743B35D0DFD86FC201FE19366D78346E39E52FA7A1CE7F2A8DEA9811E0BA201AB9A2802B31EFD31641F8D5AD5504B04F60F41AA6E2C7AA1474
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToGc'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToGc'}{'missing'} = 'Cn';....return <<'END';..0.1F.Cc..20..Zs..21.23.Po..24..Sc..25.27.Po..28..Ps..29..Pe..2A..Po..2B..Sm..2C..Po..2D..Pd..2E.2F.Po..30.39.Nd..3A.3B.Po..3C.3E.Sm..3F.40.Po..41.5A.Lu..5B..Ps..5C..Po..5D..Pe..5E..Sk..5F..Pc..60..Sk..61.7A.Ll..7B..Ps..7C..Sm..7D..Pe..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Hst.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10825
Entropy (8bit):	4.501994856995577
Encrypted:	false
SSDEEP:	192:iZdP08ybvZPa2slr7vjzxOB0VicZBmopy9z3eAQFr2+LxIG1WymFXKWIrneFKdaK:iZds8Y/qHBlE3eA6icSiDWIreKdaK
MD5:	F4B0EEC486604E69A5CF0DC148C1525B
SHA1:	7368351C391BD42C7F88B98093F502A61D9C90BF
SHA-256:	5CF6F5A89A3F9AFF4CA6984A537AB50BD55B2B4CE23E24A5CF6703D2273DF3ED
SHA-512:	1AB6380B2A1E459E1C396B2A25348BA77F43744014559F2C6F2EEE2E17A7C37D9DFA174096225F8D0D7259EB9ECD5DD775014E1C0DDD8F2B6B07251D99BB7F57
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToHst'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToHst'}{'missing'} = 'NA';....return <<'END';..1100.115F.L..1160.11A7.V..11A8.11FF.T..A960.A97C.L..AC00..LV..AC01.AC1B.LVT..AC1C..LV..AC1D.AC37.LVT..AC38..LV..AC39.AC53.LVT..AC54..LV..AC55.AC6F.LVT..AC70..LV..AC71.AC8B.LVT..AC8C..LV..AC8D.ACA7.LVT..ACA8..LV..ACA9.ACC3.LVT..ACC4..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\InPC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	4.9655698634781205
Encrypted:	false
SSDEEP:	96:0zoEnzKTXKmVpc1RDdlyL7LMTk8N/wziq46CQiyPF497ZrnkSQlYtyH:iZmumVi15cY/wzlutx97ZV2YcH
MD5:	D655ACF523139CF86B6E2DCB8C820FDC
SHA1:	BC1B782780828BC75288D9894E1A2CBB09CB70F0
SHA-256:	B01A2DE9DEEB2DDB18283281887A33C78E252C4EE52780F408F5C45A4D242291
SHA-512:	A8A8243E83DE7603BABB8661C9E10CDE729B12FF142E15EC8F702387750F03B3FB4F371B1647E32E2D0847FF660318A513C048AC0C42F15D9ED2E9C8CBA2BB70
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToInPC'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToInPC'}{'missing'} = 'NA';....return <<'END';..900.902.Top..903..Right..93A..Top..93B..Right..93C..Bottom..93E..Right..93F..Left..940..Right..941.944.Bottom..945.948.Top..949.94C.Right..94D..Bottom..94E..Left..94F..Right..951..Top..952..Bottom..953.955.Top..956.957.Bottom..962.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\InSC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13954
Entropy (8bit):	5.117811515034806
Encrypted:	false
SSDEEP:	192:iZjtLNVFvnmzNKr64fdGAkExr1frPB5EU3PxHrP9Ixe/Qa5/u7yV:iZjtLMNW6yGAkExr1frbLP6xeXVO6
MD5:	4560AB3181A03CA11FA6F28F77C80D63
SHA1:	5B82BD65EFD757ECDFC7A55C49D2789D752D9272
SHA-256:	27BD4AAC72F726782398484D13C941495AF4955E376B97043AD433E93E457E10
SHA-512:	FBA24FF3C8D86FF56A2EB916060AAF3211856B99E0CABE07A7213390F62356A016A1203DCAFC5AB4F135A3A8949FBED0EBA385D9254E0FEA9387D036C242393B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToInSC'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToInSC'}{'missing'} = 'Other';....return <<'END';..2D..Consonant_Placeholder..30.39.Number..A0..Consonant_Placeholder..B2.B3.Syllable_Modifier..D7..Consonant_Placeholder..900.902.Bindu..903..Visarga..904.914.Vowel_Independent..915.939.Consonant..93A.93B.Vowel_Dependent..93C..Nuk

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Isc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	821
Entropy (8bit):	4.925961879958829
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Mzr6OAQnxcTKtv8Fk0Aa:002+XT731GRnXE7MzrsQgkaE/7ibTAQ
MD5:	AA6D868C4C09E8F6D4CCBE6C4C4E47EF
SHA1:	2859F3B622CFB25FA51140FF8DC4D94C920A4DC6
SHA-256:	F3129848646596191FCE22095F14CFF42004DBFD71F36826E1795A324112A8B2
SHA-512:	4061CD741D7A0E1717E582C456EE08708702B20B4A5C36C38AC1FC957AF242735FECA4AF4631787EE2A9F5BC8DE2B63779035A42F7A90C43726C191951538EFD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToIsc'}{'format'} = 'd'; # single decimal digit..$utf8::SwashInfo{'ToIsc'}{'missing'} = ''; # code point maps to the null string....return <<'END';..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Jg.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	5.294089786640136
Encrypted:	false
SSDEEP:	96:0zoEnzamIKc98XtWlh5q1OFlsQYRhmno8pCKpX7owaA4+iCAJC7dF:iZ2m7cq9WlhEssQuGpXJaA4+iCAJC7f
MD5:	897206732989C2540F821F164EA3CACB
SHA1:	FD913F21036C5F77BBDF666B10E061D8D658D7D1
SHA-256:	58BE6BDC4BC286A4352A999BD21F0FBB9889F2858FE5E4F49BEEF48946540A11
SHA-512:	1E7A2524AD2FDFED3DAF17B59D173C83E7364C58CB9B8A95225E27ABF53A19D73077880440CAC29DCD7FACA4A41C92E8DCA16EC429027C0FFEB48E3FE682979A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToJg'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToJg'}{'missing'} = 'No_Joining_Group';....return <<'END';..620..Yeh..622.623.Alef..624..Waw..625..Alef..626..Yeh..627..Alef..628..Beh..629..Teh_Marbuta..62A.62B.Beh..62C.62E.Hah..62F.630.Dal..631.632.Reh..633.634.Seen..635.636.Sad..637.638.Tah..639.63A.Ain..63B.63C.Gaf..63D.63F.F

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Jt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5113
Entropy (8bit):	4.702699470492274
Encrypted:	false
SSDEEP:	96:0zoEnzasjXn7r0S17wooBDji1W+PRjGEZi1bIjdKFTMwhaWpf:iZ2sz74SOtm1NZGTMqaWpf
MD5:	7E440891BE5E8649A8806A198C9AF900
SHA1:	5B07A8EF68FE93940B8100F4D468CE2AAF50A48E
SHA-256:	852B0387D771DF1C3FC37C2B1E85AF23CFC51045DB1AB5C94011AAB93292297B
SHA-512:	8B1CCF5E0522783819E58F0845758EF4AE009D40E6AEFF92E422D8B7331B0E129FFD41DF7984830118DE4482A170CB4AAD8BA04F8CF6E0FF6F2E97DBDFF05659
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToJt'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToJt'}{'missing'} = 'Non_Joining';....return <<'END';..AD..T..300.36F.T..483.489.T..591.5BD.T..5BF..T..5C1.5C2.T..5C4.5C5.T..5C7..T..610.61A.T..61C..T..620..D..622.625.R..626..D..627..R..628..D..629..R..62A.62E.D..62F.632.R..633.63F.D..640..C..641.647.D..648..R..649.64A.D..64B.65F

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Lb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	31556
Entropy (8bit):	4.464580688684146
Encrypted:	false
SSDEEP:	768:3ZhkiXfX4MRJbbctD1jNGFCSbg6NnvJlKBHHy0iKTag8RBTLew4soG+kl/7NCVdT:pSiXP4kbmdNGFCGNNnvJlKBHHy0iKTaE
MD5:	AA95EA1C820B29E7ACEB173DAA3BA140
SHA1:	5AC982A7DD083E74D15F8724A505A6ACB7AF83A4
SHA-256:	1B8F122E7A1842A14E00C869CBBE653DD23CEAA1424D5C95F7643206C7836DB7
SHA-512:	779A03E758DA7745F54F55FEB0C953C9AEC588E39F5B933CC8E71132917DB6C2D286683F6E5D742E77AB088B9BCEA58CAB98300A708806540E39449B1660F41C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToLb'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToLb'}{'missing'} = 'Unknown';....return <<'END';..0.8.CM..9..BA..A..LF..B.C.BK..D..CR..E.1F.CM..20..SP..21..EX..22..QU..23..AL..24..PR..25..PO..26..AL..27..QU..28..OP..29..CP..2A..AL..2B..PR..2C..IS..2D..HY..2E..IS..2F..SY..30.39.NU..3A.3B.IS..3C.3E.AL..3F..EX..40.5A.AL..5B..OP..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Lc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8868
Entropy (8bit):	4.743306203407469
Encrypted:	false
SSDEEP:	192:iZvjMf5qMMYG9WNiP6asR2iv0JV+GbI25UGh2kHs+:iZri55M19AixsRoTprh2kZ
MD5:	EBDDACCE55853E4174A38B1842B9470F
SHA1:	2DAB92240C23EE933BC629160EF74FEA9176BE9C
SHA-256:	65304EC9CDE1C85A04FD55A3445520296675F6DDA1B40D466D65A065EF8E99FF
SHA-512:	EF4160BB94332762B911802AA2FA39D9CF6B105EA4810865450087E7023209938E2C2B8A7459941F7CCC823F296F382E2573500BCDF805FD89625BAACF084E0A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# The mappings in the non-hash portion of this file must be modified to get the..# correct values by adding the code point ordinal number to each one that is..# numeric.....# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToLc'}{'format'} = 'ax'; # mapped value in hex; some entries need adjustment..$utf8::SwashInfo{'ToLc'}{'specials_name'} = 'utf8::ToSpecLc'; # Name of hash of spec

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Lower.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16795
Entropy (8bit):	4.501079105997979
Encrypted:	false
SSDEEP:	384:iwA+wVRQYIUNah9YuEjH7mDuJChuJ57wUQph2khdr7:DwV2Y/ah9+D7mCn5sUe2kX7
MD5:	87FE8AA87638A193A33CDD0A74EAFF49
SHA1:	A8D633C3E769CF0F7C9D33C59E5E365AF40872E7
SHA-256:	CDFA3FCBAF7CA20F44FAFCEA569A73AC4E632DDF5219DEC47BE0D05E9DDE7F6D
SHA-512:	3A2D001B1DC91EE8C37BB7F62EE8DA53A286A08F7C686E6AF1D79C84E1B4B3FAD0784C04AF09B2896EC028F5221B4ACE60BB8AF2E26C9D87F208D617DAD7CEDC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('Lowercase_Mapping') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToLower'}{'format'} = 'x'; # non-negati

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\NFCQC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1888
Entropy (8bit):	5.17470252490238
Encrypted:	false
SSDEEP:	48:0z+XnEncQyI+WonlDtOkSJlFEwcB74Mylr/ust:0zoEnzDylDtOkSBEdUMyNt
MD5:	C6C50F34C16A7D4FD5C2AE869D60A511
SHA1:	D08BE56FE0F489863E76FB31FE5FFC6142B8B69F
SHA-256:	E0EAA44DA8285DE3A5D57F40692A0F4A0780C8D669A32B38C55A323A3216AB37
SHA-512:	F495C2E3B090919F193E15824222860825CD4F467CA6D49F0C8296ED3897E62CF5AF1F2468CE283FE8C39A4144101900E1B1FB6B042B7D196D0070FEEB8B974B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNFCQC'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNFCQC'}{'missing'} = 'Yes';....return <<'END';..300.304.M..306.30C.M..30F..M..311..M..313.314.M..31B..M..323.328.M..32D.32E.M..330.331.M..338..M..340.341.N..342..M..343.344.N..345..M..374..N..37E..N..387..N..653.655.M..93C..M..958.95F.N..9BE..M..9D7..M..9DC.9DD.N..9DF..N..A33

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\NFDQC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3174
Entropy (8bit):	4.859453722094628
Encrypted:	false
SSDEEP:	96:0zoEnz+mNT0Pkrhnh48gkR3z7dSQOamMbkq02AvRGbUMyA+t:iZyYT0PypgE35m+02AvRGbX6t
MD5:	801EB7D54AD7C0D4586481B3B9923235
SHA1:	D9E267C580C61263D83436DA96F3AB1EE50F610E
SHA-256:	BF6435075903181C523BADAB0C45406AA9C494A9EDA98BF247103130B234685A
SHA-512:	6B9F4FF6677CFC9AE0D694F07D10B8A29E9AD2BCD79A404C58CA074617D66CAFE9279E6F01E2E23DD4153332059CD5C1E173BECA235D3A755A2DD7D02769EF70
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNFDQC'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNFDQC'}{'missing'} = 'Yes';....return <<'END';..C0.C5.N..C7.CF.N..D1.D6.N..D9.DD.N..E0.E5.N..E7.EF.N..F1.F6.N..F9.FD.N..FF.10F.N..112.125.N..128.130.N..134.137.N..139.13E.N..143.148.N..14C.151.N..154.165.N..168.17E.N..1A0.1A1.N..1AF.1B0.N..1CD.1DC.N..1DE.1E3.N..1E6.1F0.N..1F4

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\NFKCCF.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	408475
Entropy (8bit):	4.1474707902925685
Encrypted:	false
SSDEEP:	3072:ktpQISCTX+8Ae6+I0UuMAYccQWsEW+GGS6IaciK8dZ/fv1jJfvjpJlTplfLhxzJx:ktptgYvvDZUD35bBJr
MD5:	0F7242B5D6307E5583C93BEFA05C5343
SHA1:	6E5D6F66EC3806305A5471EDBB1B48E060390E1E
SHA-256:	8E475C59FC32D76E5F4D6E1BCD2F3E0301CC2A11F0D5F5E393BDB97FDAF42434
SHA-512:	314E1D23EA5B683EA855299083F8DA46947615499B5107F311301FEDBE6446643B510E67AE0E76A30251B6C10A13AD31890FA94748F06DAE2FF7EA6844A38502
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('NFKC_Casefold') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNFKCCF'}{'format'} = 'x'; # non-negative

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\NFKCQC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4027
Entropy (8bit):	4.79560762747152
Encrypted:	false
SSDEEP:	96:0zoEnzGuAtEKUMDtOn0RyvAYVnaBNvhnEMyVHiXo3FyIHcfwR8:iZquAtE4xzYZ+pnHqHiXRfwR8
MD5:	9CA4EA27A53E51CA3648BD26BF4D33BE
SHA1:	3D09D09588C123F9F7795C35091EC0D2D673AB5F
SHA-256:	A0B61A7FD4BCC55AE93628984CE140735A956909183C3ECD13F70904A710E32E
SHA-512:	051B80E0796E175191A00FF4C1354B5937692ADC74262065B9F2DA65BFBC5DD8DFE5EB9D0D514ACBA6FF39EEAD6442ABE5C5E1CF01FB3544F30251AA4BC6CF9B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNFKCQC'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNFKCQC'}{'missing'} = 'Yes';....return <<'END';..A0..N..A8..N..AA..N..AF..N..B2.B5.N..B8.BA.N..BC.BE.N..132.133.N..13F.140.N..149..N..17F..N..1C4.1CC.N..1F1.1F3.N..2B0.2B8.N..2D8.2DD.N..2E0.2E4.N..300.304.M..306.30C.M..30F..M..311..M..313.314.M..31B..M..323.328.M..32D.32E.M.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\NFKDQC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5132
Entropy (8bit):	4.649250722611946
Encrypted:	false
SSDEEP:	96:0zoEnzrhAwNTrhyFXMkKxh48g7R3z7MLOuLgHYV3taKqi2AvRGxvhbEMyVHie+oc:iZnhAWTrgtOpgd3QuYVSi2AvRGxpbHqi
MD5:	B3F332D6F868211D4A6FA96798F12081
SHA1:	016F37F63309B5EDC8077E1989A1AE85A2F7E1DF
SHA-256:	6CEAC878260D595014650549A1E29179CE0BD8F5B32F9DAB6CBE6F8B6158FEBE
SHA-512:	E5B09F554B725810BA3862A21EAA17B808CDDCE82747A7E4A2A90286F29B6DD1DB95A31CCA394CC8991E6659A66E5D637463F14E46CF41F162E93109FF2FFE0D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNFKDQC'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNFKDQC'}{'missing'} = 'Yes';....return <<'END';..A0..N..A8..N..AA..N..AF..N..B2.B5.N..B8.BA.N..BC.BE.N..C0.C5.N..C7.CF.N..D1.D6.N..D9.DD.N..E0.E5.N..E7.EF.N..F1.F6.N..F9.FD.N..FF.10F.N..112.125.N..128.130.N..132.137.N..139.140.N..143.149.N..14C.151.N..154.165.N..168.17F.N..1

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Na1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65564
Entropy (8bit):	4.793917816493898
Encrypted:	false
SSDEEP:	768:RaEsOy0G7dnZs0uXlGSxbTSy+T6BUnpwfAMVqrYnHQt8TJ53/QRofIKWwOZtJR8Q:4gqYqrkUik37
MD5:	0CB65508406A84AE815E6B54DB8A66C0
SHA1:	AF8C522F2B458C1EF40001B4BEBD6B2FA4D7D51F
SHA-256:	8CE84FC1931B55B5CDFAA373121223442F9150C1CB7E130CE58ECE000D946AD4
SHA-512:	56EC82E5C448CE2C20B53FAB249958D610169B1CC3F41CEDBFC15F9A06E4B7009FE573E260B8B2DBB2F94921E601570D6F53B0B676491859A060FEBD819FB3A0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNa1'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNa1'}{'missing'} = ''; # code point maps to the null string....return <<'END';..0..NULL..1..START OF HEADING..2..START OF TEXT..3..END OF TEXT..4..END OF TRANSMISSION..5..ENQUIRY..6..ACKNOWLEDGE..7..BELL..8..BACKSPACE..9..CHARACTER TABULATION..A..LINE FEED (LF)..B..LINE TABULAT

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\NameAlia.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13848
Entropy (8bit):	5.218701130310257
Encrypted:	false
SSDEEP:	192:iZTvhaFYijc1bKbejnBiROTXrNMQLfWbTpMKoNjbF4wUcsEbwJtJlcsAiA2g2Oy:iZTpb9WbTpMDkwUcsEbwJtJlpAiA2g4
MD5:	C1DA800FD97C41572AA045BDD4333B12
SHA1:	35D01D25B1B039BC31202CE2A41F8EC3475A1B90
SHA-256:	A2D4FB41DC42DD5855E59CD348A6C3892939CB591DB571E7D24A3679FA0B9623
SHA-512:	28159F76DFFEFEE21E87BC6647F89553FA5FA7DA8B7269920C56A0F3AE372BED27B90A5D6951A88DAF62D1C80824B91E3034B8C8F91B6282A663AA6661C351C9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNameAlias'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNameAlias'}{'missing'} = ''; # code point maps to the null string....return <<'END';..0..NULL: control..0..NUL: abbreviation..1..START OF HEADING: control..1..SOH: abbreviation..2..START OF TEXT: control..2..STX: abbreviation..3..END OF TEXT: control..3..ETX: abbreviation

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Nt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4443
Entropy (8bit):	5.057328480400076
Encrypted:	false
SSDEEP:	96:0zoEnz+v4WbhimB31CMQiq7nJgKfjypBdMh:iZy5lCMQiq7+K2pB2
MD5:	27E792EE1A4BB5263E3B87ECD13C1145
SHA1:	BAD0F16BE9955542AA34900AC39452AEFC694F76
SHA-256:	EECE8F8384EB47E3BA7EA01D5EF2987A0FA2A03C4A6F85DB4C0D698EC8B8B77C
SHA-512:	11312FE6A47FB21E54C7EF4334BA1197A0135B35744959A49E18511B429E3E08389E2EAC13476128BADFFA8770A62CD6575B5BA1567675139F90495CD120A905
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNt'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToNt'}{'missing'} = 'None';....return <<'END';..30.39.Decimal..B2.B3.Digit..B9..Digit..BC.BE.Numeric..660.669.Decimal..6F0.6F9.Decimal..7C0.7C9.Decimal..966.96F.Decimal..9E6.9EF.Decimal..9F4.9F9.Numeric..A66.A6F.Decimal..AE6.AEF.Decimal..B66.B6F.Decimal..B72.B77.Numeric..BE6.BEF.D

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Nv.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8157
Entropy (8bit):	4.351847957740307
Encrypted:	false
SSDEEP:	96:0zoEn3WBMdlyIMNk2G9NLy4CO9PqNG+9xrYRinksbRbhW00k0VIe2np3Pofk:iZndonNk5Pp8Hv3wmj2s
MD5:	2EE373E1D047EC5977D98F8D4E29BB3A
SHA1:	CE6D362C3524AEA317374E272586B332C92A8E55
SHA-256:	6B1BA533B783755B0D33E2E98F16D35A5D6F787EC50081A5AC2FC874201D05BD
SHA-512:	81914CA6064852A00D2267A2420FB08C1D08F4CE5EF98F5E25478197524963FE929734F2316F70908A4D402F5BBB3131BB06DC157FFDD9354AD049685D09ABC4
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# The mappings must be modified to get the correct values by adding the code..# point ordinal number to each one that is numeric.....# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToNv'}{'format'} = 'a'; # some entries need adjustment..$utf8::SwashInfo{'ToNv'}{'missing'} = 'NaN';....return <<'END';..30.39.0..B2.B3.2..B9..1..BC..1/4..BD..1/2..BE..3/4..660.669.0..6F0.6F9.0..7C0.7C9

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\PerlDeci.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	5.257756435238762
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7BKDsfzrsQgkaDFHDFdTc+ZZ96SmhsWfVIwHkDMn1Jo:0z+XnEncKZQwx2qTqhsLwHkDMn3o
MD5:	26C39EF5A8A67581383D4D1B609D074E
SHA1:	DB41E02673E19E9C877F0AABBA36DF01EEBDFFD4
SHA-256:	5A73FAB1A31385BD594DAFC9437F7A59FA17F00421D265C28F99D224B08B21AA
SHA-512:	3A82E3ECEFE435D2B003C17F171348DF7584E97F59960FEB4259B405BBE7B235B230A77E27C9FAFB320F67FCADA4D57DD47328BF98C926C3AEF0F7DF6FD5A9E0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# The mappings must be modified to get the correct values by adding the code..# point ordinal number to each one that is numeric.....# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToPerlDecimalDigit'}{'format'} = 'a'; # some entries need adjustment..$utf8::SwashInfo{'ToPerlDecimalDigit'}{'missing'} = ''; # code point maps to the null string....return <<'END';..30.39.0..660.669.0.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\SB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33288
Entropy (8bit):	4.770822119846703
Encrypted:	false
SSDEEP:	384:iZVMr0Ar777rVJKPbJ3QWmj1M6ni3q+EuoL6/12LqQx6vO4scdeDRV20uD6:MMQ1PbJVm6x3LoL6/1h6GO4s2etUj6
MD5:	D9F47FD3F8A6F43CF43E2D5585A86EBA
SHA1:	59414AADA1AF6862D461DFD7E37546D2E41DE61B
SHA-256:	D203548ED84B285EC69C99BB3E344F95D45F8994B2230FED30F604C9ED88C490
SHA-512:	CDD97DB19C3F534A161587DDC9B8013F2F256D17A336933EF0966AF5F257303912C8832CE7C4FA4128DC80B0A8206888124C88AC185282B7EF9EF7BF1FEA67F2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToSB'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToSB'}{'missing'} = 'Other';....return <<'END';..9..Sp..A..LF..B.C.Sp..D..CR..20..Sp..21..STerm..22..Close..27.29.Close..2C.2D.SContinue..2E..ATerm..30.39.Numeric..3A..SContinue..3F..STerm..41.5A.Upper..5B..Close..5D..Close..61.7A.Lower..7B..Close..7D..Close..85..Sep..A0..Sp..AA..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Sc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15957
Entropy (8bit):	5.168225416340755
Encrypted:	false
SSDEEP:	384:iZGV0Ch2foQ2vcPuxUKTbk5NuH20eCYslRI2+6827:zV0yNQ2vmuxUKTbk5NuH2ps7I2+6R
MD5:	6578CB66B4833A40CFED8176643F0313
SHA1:	09EB56C84866B12A510BB4298787EDEAD63AC4B4
SHA-256:	73C5CF8FFBAA2521E4C8C4B5632AB456982162F3D9840546A50616DC5038FA3D
SHA-512:	C8E38FF9395E164DB83E1C4BF29C79766331A915F24793A1F375DBC456CB710EAEE1402CC63322F86E4A763B1F4F0E42BEEE5BE27DC62E557BD5077EAAD26163
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToSc'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToSc'}{'missing'} = 'Unknown';....return <<'END';..0.40.Common..41.5A.Latin..5B.60.Common..61.7A.Latin..7B.A9.Common..AA..Latin..AB.B9.Common..BA..Latin..BB.BF.Common..C0.D6.Latin..D7..Common..D8.F6.Latin..F7..Common..F8.2B8.Latin..2B9.2DF.Common..2E0.2E4.Latin..2E5.2E9.Common..2E

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Scx.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18737
Entropy (8bit):	5.224687851963277
Encrypted:	false
SSDEEP:	384:iZxEgw+sgRfFixHo9qPi8wdPeUKTbk5NsL31H20eCYsldI2+4827:IEgfkaQKdPeUKTbk5NsL31H2psPI2+4R
MD5:	5401D30367ACAD3ABAEDA2A7EAB30278
SHA1:	290C8441F15879766EE02A20889D879CDF8C8E65
SHA-256:	C1DE0D6223CE3F29EBEE3DC4C9728F6412B07FB38A34D324AA6E2A488C67107E
SHA-512:	28C13944F1773690E8AAD7ECFD35F9DBFE3716A2C52BBFF722091CCDB49AD219CF3EA006B903C0B2EE86F12309F897BD3E316F614D955A0236AC02D202EAD15D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToScx'}{'format'} = 'sw'; # string, but some elements are interpreted as a list; white space occurs only as list item separators..$utf8::SwashInfo{'ToScx'}{'missing'} = 'Unknown';....return <<'END';..0.40.Common..41.5A.Latin..5B.60.Common..61.7A.Latin..7B.A9.Common..AA..Latin..AB.B9.Common..BA..Latin..BB.BF.Common..C0.D6.Latin..D7.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Tc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12270
Entropy (8bit):	5.0066138507642295
Encrypted:	false
SSDEEP:	192:iZvD8n/2VgurOB/g5yhkQHRUJ6b//noRh36xchnGdo34WpgDW77Jh:iZL6/2VguC+5tE5Xnon3gchnGdm4Wpg2
MD5:	3DDD4AC3FAD98D1A107F9D541481FDFB
SHA1:	0CAF796B573395028767A3955F47F419628A6C10
SHA-256:	9A939FD8835F1210295E3CBB0C972D077A845E2D2BF637C59748CCA28F385D11
SHA-512:	53A925C82712BE4E93217493B54FBDDFD21FA81FFF90C3D2905564C1FBE8D8D541E50C33976EFD9C7B9A07C17BF37345496A76B6A27BBC837B7CA6FC595118C6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# The mappings in the non-hash portion of this file must be modified to get the..# correct values by adding the code point ordinal number to each one that is..# numeric.....# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToTc'}{'format'} = 'ax'; # mapped value in hex; some entries need adjustment..$utf8::SwashInfo{'ToTc'}{'specials_name'} = 'utf8::ToSpecTc'; # Name of hash of spec

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Title.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20226
Entropy (8bit):	4.745881596309054
Encrypted:	false
SSDEEP:	384:iwPQ2VguC+jKXF3bc/w0Hfte23gchnGdvW04SpgDWd1Jhj7:nVguC++hc/wAt7/VuCWddj7
MD5:	536FFC781360FE2904FCFBE6F3A1F84C
SHA1:	02E0DBB0C8880F94336F20D8C53EF80B2D11B760
SHA-256:	C97CE1A3D03DFEEE1F0D15454F63876C2FCAA77F5A5C7F7824B39BCAF5DB6B75
SHA-512:	79CD9B361C8861A7FDAE5B14C470C0197C12FF1875D78AA309BDE85AFB4F782DE3D667499A65A3D37906809E27F11A448B9C918970281BA41DBAF255FE881FCF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('Titlecase_Mapping') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToTitle'}{'format'} = 'x'; # non-negati

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Uc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15996
Entropy (8bit):	4.99865370468481
Encrypted:	false
SSDEEP:	384:iZj79ahMcNQiCrcnE5Xnon3gchnGdm4WpgDW71h:W9auMQiCrPNo3iiCW7n
MD5:	5E1D28AF7CEBC5AB0DFE27DA2599505B
SHA1:	8BB2776AD0913821365697E1DA84C7ECD95D5CDC
SHA-256:	F367D4D2124849A4530A0083381DBF9C28CFF90A43A9D35215EF411FBD62AD44
SHA-512:	426C765EC500ABDF940AFB680E756997098500A2300F59AAEBF57FAD180262C7FF6A4CFD88893A22299C3D994573AF2D33C15AA2BD4672905A4EDE0010FE16CF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# The mappings in the non-hash portion of this file must be modified to get the..# correct values by adding the code point ordinal number to each one that is..# numeric.....# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToUc'}{'format'} = 'ax'; # mapped value in hex; some entries need adjustment..$utf8::SwashInfo{'ToUc'}{'specials_name'} = 'utf8::ToSpecUc'; # Name of hash of spec

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\Upper.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23628
Entropy (8bit):	4.837837403935424
Encrypted:	false
SSDEEP:	384:iwlIahMcNQiCrsKXKvsc/w0Hfte23gchnGdvypgDWd1Jhj7:4auMQiCrZnc/wAt7BCWddj7
MD5:	951B8C7B14953373E6D1BDE2EDC5CAD6
SHA1:	EDA1EFE699C2C51B9FD1E09B22C1AAF92988A147
SHA-256:	AECD3B220C286B050A687C71A813EBD778A16F81D8429C352BA9FB007B88B465
SHA-512:	4AAABE3AF71611080187BB56126F1E853100C685DFFE3E33ECF40ECB39D74C4ED2581BC6941362586B628989D6214FE1EB3F8F081C34F1914BC6541A49180D6E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! IT IS DEPRECATED TO USE THIS FILE !!!!!!!....# This file is for internal use by core Perl only. It is retained for..# backwards compatibility with applications that may have come to rely on it,..# but its format and even its name or existence are subject to change without..# notice in a future Perl version. Don't use it directly. Instead, its..# contents are now retrievable through a stable API in the Unicode::UCD..# module: Unicode::UCD::prop_invmap('Uppercase_Mapping') (Values for individual..# code points can be retrieved via Unicode::UCD::charprop());........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToUpper'}{'format'} = 'x'; # non-negati

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\WB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16041
Entropy (8bit):	4.758683752592496
Encrypted:	false
SSDEEP:	384:iZJIWDk6u54Q+1OxzQnvJGBo4YW9/cUzPxnv:QIWDk6ufNEnv25YW9/tTxnv
MD5:	B4AFE58BC7CFEF473DF9151F57EC5CC2
SHA1:	A94ECC5457DA872406E2A8EF865DD9EE534F0A37
SHA-256:	50E0446B5F7F64AF1EC7BF7EDDBB0524DE5AB8494A531F8989AA8F2ED57604FB
SHA-512:	8E3A42C3AB4A3C82826B516890C0EF4AEA2604CEB5F7CF3EC067B4D09D46CE0EB5D7E7DC033824D39AED961AE371D8A8930EC968D635A74488B3F761B9E9D28F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'ToWB'}{'format'} = 's'; # string..$utf8::SwashInfo{'ToWB'}{'missing'} = 'Other';....return <<'END';..A..LF..B.C.Newline..D..CR..22..Double_Quote..27..Single_Quote..2C..MidNum..2E..MidNumLet..30.39.Numeric..3A..MidLetter..3B..MidNum..41.5A.ALetter..5F..ExtendNumLet..61.7A.ALetter..85..Newline..AA..ALetter..AD..Format..B5..ALetter..B

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\_PerlLB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30056
Entropy (8bit):	5.176286771417902
Encrypted:	false
SSDEEP:	768:32qJByNsFCSbg6NnvJlKBHHy0iKTag8RBTLew4soG+kl/7NCVdPE62gxJs6PNN3D:DJ5FCGNNnvJlKBHHy0iKTag8RBTLew4L
MD5:	72E8FB7AE0AA2ABBEEE1D556FF37E50B
SHA1:	AFDD2C7C13A0EB2D6C0386C18B26F358AB9529E0
SHA-256:	CBD15228ACE23D7B7D4FAC2F616AC34C6B2CE12E12D2416229F0959F17994FE7
SHA-512:	B838C4759A7D2963F67E807FA1898EA638D36F20ED3DB21B5CEB1B30E55E3477F4DA200EE095577EA8E98293A7266FAA60AD749B5756AB46027DF8FF9BF084AD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'To_PerlLB'}{'format'} = 's'; # string..$utf8::SwashInfo{'To_PerlLB'}{'missing'} = 'Alphabetic';....return <<'END';..0.8.Combining_Mark..9..Break_After..A..Line_Feed..B.C.Mandatory_Break..D..Carriage_Return..E.1F.Combining_Mark..20..Space..21..Exclamation..22..Quotation..24..Prefix_Numeric..25..Postfix_Numeric..27..Quotation..28..Op

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\To\_PerlWB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16272
Entropy (8bit):	4.787899394971305
Encrypted:	false
SSDEEP:	384:iZb31Dk6u54Q+1Ox8QnYmDo4YW9/cUzPxnv:w31Dk6ufNlnYY5YW9/tTxnv
MD5:	CCEA3C50106C546E38F2A1A5B98C2528
SHA1:	88ECA4F818618625CE38F77157170FDC00D7EEA6
SHA-256:	7D00F66594683C3A4616F6641786E132F4D03707570E8715728FBC2F19DBF5CE
SHA-512:	66FFA650FC353DA2EF4775BB63F83302B1751E401E1D6AF5BDB556772B99FE2544F1C2ADE22C21F83039AD614BB5009EC638A43CCA321F989DB9FFCFFE704BA4
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.........# The name this swash is to be known by, with the format of the mappings in..# the main body of the table, and what all code points missing from this file..# map to...$utf8::SwashInfo{'To_PerlWB'}{'format'} = 's'; # string..$utf8::SwashInfo{'To_PerlWB'}{'missing'} = 'Other';....return <<'END';..9..Perl_Tailored_HSpace..A..LF..B.C.Newline..D..CR..20..Perl_Tailored_HSpace..22..Double_Quote..27..Single_Quote..2C..MidNum..2E..MidNumLet..30.39.Numeric..3A..MidLetter..3B..MidNum..41.5A.ALetter..5F..ExtendNumLet..61.7A.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\UCD.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	121353
Entropy (8bit):	4.925207856159164
Encrypted:	false
SSDEEP:	3072:ynSgLpbfpJh9Iqrphfjt9NFBBOqL1hVbBiqRYqxRdZJwQzqBaT+wUUuRBcGmaLcc:ynSgirffpbBaT+bUuRBcGmaLD/Of+Xsw
MD5:	22829208C2415DC0104217537CDF8EC9
SHA1:	A251939C5E7FD324252CEE427E18D14120409247
SHA-256:	186670B65A798D6AA63D4370B2DB8FFC7E256A3932AA034BE80AE2434021D8A8
SHA-512:	3C708112B861CB0E32E5C3E7714C791632B9F31E12899690B3B4B6E5BED6A3B41F10BD34899694986A50E422694F02BA21FBC8462E3C4D491DD25E66C08F8D6F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!......# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......# This file is for the use of Unicode::UCD....# Highest legal Unicode code point..$Unicode::UCD::MAX_UNICODE_CODEPOINT = 0x10FFFF;....# Hangul syllables..$Unicode::UCD::HANGUL_BEGIN = 0xAC00;..$Unicode::UCD::HANGUL_COUNT = 11172;....# Keys are all the possible "prop=value" combinations, in loose form; values..# are the standard loose name for the 'value' part of the key..%Unicode::UCD::loose_to_standard_value = (..'age=1.1' => '1.1',..'age=2.0' => '2.0',..'age=2.1' => '2.1',..'age=3.0' => '3.0',..'age=3.1' => '3.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\NA.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8925
Entropy (8bit):	3.851523658772129
Encrypted:	false
SSDEEP:	192:iZGVjWErjvipBLaxabMftr+wk/DvC0YuQLpIeilFahBA8ZALMC5bP:iZCK2j6pBLaxabMVr+wku0zipIeili7m
MD5:	DB6A025C2B8D61011B958D6153B901FB
SHA1:	40D009EABA082E1B07C9DB7518EB8BDFDDE4E4F5
SHA-256:	DADB29BF940C05AD1D4AEFCC9F180ABEF58A9DFBBCE3D97B18997B8697A56CE6
SHA-512:	BD6779C30CE6D02EFE295AC96D93534195AA6F55AC417221F586F991002150B70ED7C142C2A6FE136D48076138F30F0FC4B052D5FA1F05B8C912359B7C09E24A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1245..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602..26

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V11.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4040
Entropy (8bit):	4.1171044891100825
Encrypted:	false
SSDEEP:	96:0zoEny3fBW50fvaRjyhdiXPALFbcc6wADu+XHYZlEXbsX:iZ8fffCjyhdi/ALFbc3JDu+XH4lEYX
MD5:	54F7207A9CA832531CA84279A7F44290
SHA1:	5E72EA6ED86A080D7BDDB1793681E6E6E8CCC1ED
SHA-256:	29244875934D66B9213E85AC09A1E7321219314BDA7196DC3895A87F4CF651F7
SHA-512:	17F45532F591227FEF500D78590F39E59016691279ABDFE442A04F3E6C9F507EE97B99201A44ECCDD5A10ABE2A683594CF68541967D8A228E4745204F2C1C6FE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V576..0..502..506..536..592..681..688..735..736..746..768..838..864..866..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..983..986..987..988..989..990..991..992..993..994..1012..1025..1037..1038..1104..1105..1117..1118..1159..1168..1221..1223..1225..1227..1229..1232..1260..1262..1270..1272..1274..1329..1367..1369..1376..1377..1416..1417..1418..1456..1466..1467..1476..1488..1515..1520..1525..1548..1549..1563..1564..1567..1568..1569..1595..1600..1619..1632..1646..1648..1720

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V20.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	916
Entropy (8bit):	5.108233066635544
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Ih5gP9eJmGeY2e7BeGtV:002+XT731GRnXE7a+FecelBGW+96
MD5:	04EF9CE9435709E4839B37BDB7524550
SHA1:	BF7A26DC051F0FDD4A2CE736A74223C9E8652360
SHA-256:	38BE77CF53B59C006703BE2CE72BD9F73DA84FD6445381DFA85FA97A03F62FD5
SHA-512:	5D97665EC6BCFE8074E5E003FD34C60439310E39228E301A548A9513557AA93A82286DE9D6F8DAB9FF0CD88409F3CE082CB44994B10FB3B83A23436175EAAF1A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V58..1425..1442..1443..1456..1476..1477..3840..3912..3913..3946..3953..3980..3984..3990..3991..3992..3993..4014..4017..4024..4025..4026..7835..7836..8363..8364..44032..55204..55296..57344..131070..131072..196606..196608..262142..262144..327678..327680..393214..393216..458750..458752..524286..524288..589822..589824..655358..655360..720894..720896..786430..786432..851966..851968..917502..917504..983038..1114112..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V30.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1968
Entropy (8bit):	4.526174264732891
Encrypted:	false
SSDEEP:	48:0z+XnEntMB+WGCzLqtc4kjz/fpLRNIiFCoaHCauvLAzv:0zoEniAWJHqtc4M/fdR2yjaHCDvLKv
MD5:	A22EA62CE3F24B5166381AA2EFAE769D
SHA1:	9234470221B58EBCBE39CE83AE0ED1AAB83ADB99
SHA-256:	CD8395983C1F7249353B04DA3948B3FFF20EBC73CD3334E8A0A54E10A8939D86
SHA-512:	5E7BDE689CE38F3A0746126D264E6A1543959BAAA91FFE7E9208AB7D36298D8168D2CB0A571E7784B6E1493316A95E129BF04D15094B7EDFF2DE2CE23BE8480E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V242..502..506..536..544..546..564..681..686..735..736..746..751..838..847..866..867..983..984..987..988..989..990..991..992..993..994..1024..1025..1037..1038..1104..1105..1117..1118..1160..1162..1164..1168..1260..1262..1418..1419..1619..1622..1720..1722..1727..1728..1743..1744..1786..1791..1792..1806..1807..1837..1840..1867..1920..1969..3458..3460..3461..3479..3482..3506..3507..3516..3517..3518..3520..3527..3530..3531..3535..3541..3542..3543..3544..3552..3570..3573..3946..3947..3990..3991..4014..4

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V31.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	4.949119130216293
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7IFcWpIKzpCv3u1Grn9dasghQaM:0z+XnEnjaozYv3Nt5
MD5:	FFFFB4EF94A27C8565667D3B98027957
SHA1:	EA7DD03CD29270C174D6CE39CF068AB62C07C318
SHA-256:	9C9671699E74F1BAF2493948490E5CBF09CDDE3F4AD0D628D0F33DED11A3711A
SHA-512:	13F2D68B7FD0C9EA90616AF8B5F0DC884BEFFD87C8A924748BBA4FF58869A1DA750F26BBE3723CA7611D1A3D9E8009E048A59CA9DBCEAA1753685D068474FAD8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V72..1012..1014..64976..65008..66304..66335..66336..66340..66352..66379..66560..66598..66600..66638..118784..119030..119040..119079..119082..119262..119808..119893..119894..119965..119966..119968..119970..119971..119973..119975..119977..119981..119982..119994..119995..119996..119997..120001..120002..120004..120005..120070..120071..120075..120077..120085..120086..120093..120094..120122..120123..120127..120128..120133..120134..120135..120138..120145..120146..120484..120488..120778..120782..120832..13

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V32.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	4.860622662229567
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7bMwEOGDoCv0DzGL0hAldvloLAYf79Wk:0z+XnEnmMhuCLmAjGLAK
MD5:	3939F3602241D1D0D7D71CAC674DEB68
SHA1:	D28F71A0B8D109BA112241F345241DB06273540B
SHA-256:	E0AC09CA61BE6C3E9B539BBBDDA80DCD7ECB5BFBB07795DD8D326A781DB93443
SHA-512:	1A062FB253F7D0AA3B43DC4A6492AB68B2BE27CE731F64917292AD7B1580E6DFA94741EAC4532E12E1E8B6159F00DCCE59F122FE149712AF4BA8E3EF3CF74DE3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V118..544..545..847..848..867..880..984..986..1014..1015..1162..1164..1221..1223..1225..1227..1229..1231..1280..1296..1646..1648..1969..1970..4343..4345..5888..5901..5902..5909..5920..5943..5952..5972..5984..5997..5998..6001..6002..6004..8263..8264..8270..8275..8279..8280..8287..8292..8305..8306..8368..8370..8420..8427..8509..8524..8692..8704..8946..8960..9084..9085..9115..9167..9451..9471..9622..9632..9720..9728..9750..9752..9842..9854..9856..9866..10088..10102..10192..10220..10224..10240..10496..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V40.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1496
Entropy (8bit):	4.728164524557149
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE79kHuyGqVnAPzK2IdCgXd1RBccb5kzVmRyAl3RZTlvQ+kyJ7lu:0z+XnEn1OyJAe1rR2cb5kMhhi+ksl602
MD5:	7BCA747909D6B76C6F7CD289E02BF152
SHA1:	4FF45982A0113231FD5EFB8D471A5AB7BF74B08B
SHA-256:	5227BE7C7339690E86ECD06167F0841D0020D803F92F84BB8B497F915CF2C598
SHA-512:	DDB1AB4DCADD0C545A85B2A06EE59FA83F78CB5E300657E052B718EC935A75EFDA295C1C33EFD9B68C6EF3382492A723F0AE9D31D0A5D56774C8581CCF76DCB1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V154..545..546..564..567..686..688..751..768..848..856..861..864..1015..1020..1536..1540..1549..1558..1622..1625..1774..1776..1791..1792..1837..1840..1869..1872..2308..2309..2493..2494..2561..2562..2563..2564..2700..2701..2785..2788..2801..2802..2869..2870..2929..2930..3059..3067..3260..3262..6109..6110..6128..6138..6400..6429..6432..6444..6448..6460..6464..6465..6468..6510..6512..6517..6624..6656..7424..7532..8275..8277..8507..8508..9167..9169..9471..9472..9748..9750..9866..9874..9888..9890..11008

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V41.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	4.657391591294325
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7kSWWE6nsXJ05caeWRpHcvdKHOCEKgQ3/+9jBA/jFJPFT1b:0z+XnEnfUHs5/DSc1IH3/+9jBA/bP7
MD5:	75CD2EA3CA0BF29EC067D1B43BAE250B
SHA1:	6388A42159FBEA12D7FE93C5ADCF3651C1328ABA
SHA-256:	77FE021F3DE416DE84742C93B5A175A3A8D4E781D2DA82105AB0D844C3A9471F
SHA-512:	3B909550BD3156A975AB505870B3442BA1BB57D8E6CA649FFDE8A52EFD074189130C452E7A382082267DD71D0332D044D64DFB9DCA3B648AACB4AA6E4A3E4BE7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V172..567..578..856..861..1020..1024..1270..1272..1442..1443..1477..1480..1547..1548..1566..1567..1625..1631..1872..1902..2429..2430..2510..2511..2998..2999..3046..3047..4048..4050..4345..4347..4348..4349..4615..4616..4679..4680..4743..4744..4783..4784..4815..4816..4847..4848..4879..4880..4895..4896..4935..4936..4959..4961..4992..5018..6528..6570..6576..6602..6608..6618..6622..6624..6656..6684..6686..6688..7532..7620..8277..8279..8280..8287..8336..8341..8370..8374..8427..8428..8508..8509..8524..852

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V50.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.047460349746535
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7IU3CTSCxHMh9QLubRF:0z+XnEnjRRMhk+F
MD5:	5A6DD9B4D6E8EED7C3D15A4854DB71DD
SHA1:	C1933A15F018BC76AC8B322FF2CCEAD5F15E76B5
SHA-256:	D9A1B8F258EFFDDE6DC4CB851B4618675377609B8EC2388DD712CC84BC293EA5
SHA-512:	317B360F8AF333EE49AC5F3AF02D5AB038B082D0A6A0E7F5D34D8B4ABFC99FE2FAECC4DE16949DDB6DD2F1E692504F2B46851ED7920A9AB764EAF93126C90002
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V70..578..592..891..894..1231..1232..1274..1280..1296..1300..1466..1467..1984..2043..2427..2429..2430..2432..3298..3300..3313..3315..6912..6988..6992..7037..7620..7627..7678..7680..8428..8432..8525..8527..8580..8581..9180..9192..9906..9907..10183..10187..11028..11035..11040..11044..11360..11373..11380..11384..42775..42779..42784..42786..43072..43128..67840..67866..67871..67872..73728..74607..74752..74851..74864..74868..119648..119666..120778..120780..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V51.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1654
Entropy (8bit):	4.674829195400051
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE78CW2C9WpJ4EqcRF5wTCGEJbEKdYSh07OnFdLN01exu:0z+XnEnrPtcRUGGj740aFdRu
MD5:	5260C2F1BA8859804949D4EAFEC2D3F7
SHA1:	6F035A799D0CF16F842BAE9CDAAD1935F45D8A6F
SHA-256:	C8F79456F5A3D077EF89C1BE89BAA4F44A19F27C3E857C3333CA0F4551821A35
SHA-512:	748CB4506FC594B52B1AD2E2FD64B21823359CA4799ECFCEE8B49F2A0052BFB2BBB988DAA27BD9F7D7E4030C4FA237F4537A8C21ADAD1DA74B13E33F249D7194
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V178..880..884..886..888..975..976..1159..1160..1300..1316..1542..1547..1558..1563..1595..1600..1902..1920..2417..2419..2641..2642..2677..2678..2884..2885..2914..2916..3024..3025..3133..3134..3160..3162..3170..3172..3192..3200..3389..3390..3396..3397..3426..3428..3440..3446..3449..3456..3947..3949..4046..4047..4050..4053..4130..4131..4136..4137..4139..4140..4147..4150..4154..4160..4186..4250..4254..4256..6314..6315..7040..7083..7086..7098..7168..7224..7227..7242..7245..7296..7627..7655..7836..7840.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V52.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	4.65916846936793
Encrypted:	false
SSDEEP:	48:0z+XnEnnODHChSEm43GIUSZDCHbpSEx+i:0zoEnOrySr42IUECHdSi
MD5:	71EA1BC0F40084607DE5C51057C1BF2E
SHA1:	FA90D890712574ACDE409A1FBC4FCA292AD9456D
SHA-256:	E8845D8265463EDD42BCA4615C955E6D673C0B30B64D44E70C4A5921A46ED3F0
SHA-512:	F7101452781F07C3C2789F47862F9B78D55AE4E75DAD1AC602E0134CF8B78FE6C81E237C01FE3EBCEFD65AD11C1B5088002A53A937070421F78CB18F9DBB5D1F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V180..1316..1318..2048..2094..2096..2111..2304..2305..2382..2383..2389..2390..2425..2427..2555..2556..4053..4057..4250..4254..4442..4447..4515..4520..4602..4608..5120..5121..5751..5760..6320..6390..6570..6572..6618..6619..6688..6751..6752..6781..6783..6794..6800..6810..6816..6830..7376..7411..7677..7678..8374..8377..8528..8531..8585..8586..9192..9193..9886..9888..9917..9920..9924..9934..9935..9954..9955..9956..9960..9984..10071..10072..11093..11098..11376..11377..11390..11392..11499..11506..11825..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V60.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	4.52714414593872
Encrypted:	false
SSDEEP:	48:0z+XnEnBTGSeXHYdrVxZTRvqxPbGed3oXKZgVwKdv:0zoEn1GSeXHYdpxkbGeuXKZgeKdv
MD5:	034FD128E7A0246CB5C48533D994073F
SHA1:	1D635F2EB1611FF6FB866BDC76339038E45A12C0
SHA-256:	FA86B8E7998EFB3A9AFDB5A4874C659818179FDED0ADB989698817B58D40972E
SHA-512:	323977D6E0BE5C9EEEA7895EF9DA30852E6653563F2899C295214A2C9378C4B91DB681C96A606A570CD5E446EBEA2FBFB735FADBF62CED71D78FFBBC4B16A7BF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V212..1318..1320..1568..1569..1631..1632..2112..2140..2142..2143..2362..2364..2383..2384..2390..2392..2419..2424..2930..2936..3369..3370..3386..3387..3406..3407..3980..3984..4057..4059..4957..4959..7104..7156..7164..7168..7676..7677..8341..8349..8377..8378..9193..9204..9934..9935..9954..9955..9956..9960..9989..9990..9994..9996..10024..10025..10060..10061..10062..10063..10067..10070..10079..10081..10133..10136..10160..10161..10175..10176..10190..10192..11632..11633..11647..11648..12728..12731..42592

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V61.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1820
Entropy (8bit):	4.582834846204195
Encrypted:	false
SSDEEP:	48:0z+XnEnTJiFHvNSJ0/5E3l40nLcQKJImEBl6RkMfXKZgVwKh:0zoEnTJavNC0xLg/a9fXKZgeKh
MD5:	F43D5C66FE2D5AE22BD1FE92E2018285
SHA1:	F6DDB74A0936B52BAD41292D47C6571DF5AF195E
SHA-256:	F4005FA2C554321C5B9A9DE9EF502B7E22410B8C6DF09F5C9FB91BE1D37C5F38
SHA-512:	43F813359F78343B3F97E90CD8C9FD079CA299EC9A7FDF1E6412C3E311208F1DFF73B1F108B44A82245D3EBDD60295A3D5B8FEDB9702FF0A64D8DE70BA50153F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V178..1423..1424..1540..1541..2208..2209..2210..2221..2276..2303..2800..2801..3806..3808..4295..4296..4301..4302..4349..4352..7083..7086..7098..7104..7360..7368..7411..7415..10187..10188..10189..10190..11506..11508..11559..11560..11565..11566..11622..11624..11826..11836..40908..40909..42612..42620..42655..42656..42898..42900..42922..42923..43000..43002..43744..43767..64046..64048..67968..68024..68030..68032..69840..69865..69872..69882..69888..69941..69942..69956..70016..70089..70096..70106..71296..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V70.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	4.4082983397614495
Encrypted:	false
SSDEEP:	48:0z+XnEnqg9JQJlhZdYANpnew7rV7OE6+beq4xZG5d2UWnw:0zoEnqgTQJlPdYeewvV6+aq4DG5snw
MD5:	B6EF7796ACB170711A5399DCD2EEB4FC
SHA1:	CD0D0A6835F47B6B7702CAB3142D413A012EE9B1
SHA-256:	09C12522870E847047EE344EE91762B81EBF630B68DBD2A3510DC075D9998CB1
SHA-512:	C8AB21677F06D525257781919A9BA12675817CC85AD11AAEBA033A0CFB268E9454871F15318970651C4050EC05418A182BCF72321BEA40352F2F669DC35DBBCB
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V282..895..896..1320..1328..1421..1423..1541..1542..2209..2210..2221..2227..2303..2304..2424..2425..2432..2433..3072..3073..3124..3125..3201..3202..3329..3330..3558..3568..5873..5881..6429..6431..6832..6847..7416..7418..7655..7670..8379..8382..9204..9211..9984..9985..11085..11088..11098..11124..11126..11158..11160..11194..11197..11209..11210..11218..11836..11843..42648..42654..42900..42912..42923..42926..42928..42930..42999..43000..43488..43519..43644..43648..43824..43872..43876..43878..65063..6507

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Age\V80.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	4.825567103414594
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7qQi6U71LupBNWWOUsBRz/0k2IACMJWCkhdT/XIXwS/:0z+XnEn+i6U5LuRWRUuz/t9ACMJWJdzY
MD5:	DBECD40B31661A1805356D670B1D1211
SHA1:	620626206C8475AEBB1650831542021D05D56643
SHA-256:	B04253957B1A51453D10279BE2A3DB432569EC495E3C5981EB9A0AD2C5E01238
SHA-512:	443F065F44F9B642EA2229335FBB6AECFC9FC11D1D7068BFA31A05D3F9DF9D78C69E312FF9EA45B9CFEEBF88E6D316C264D556D4C32C479853453861FC8DC9B5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V118..2227..2229..2275..2276..2809..2810..3162..3163..3423..3424..5109..5110..5112..5118..8382..8383..8586..8588..11244..11248..40909..40918..42654..42655..42895..42896..42930..42936..43260..43262..43872..43876..43888..43968..65070..65072..67808..67827..67828..67830..67835..67840..68028..68030..68032..68048..68050..68096..68736..68787..68800..68851..68858..68864..70089..70093..70107..70112..70272..70279..70280..70281..70282..70286..70287..70302..70303..70314..70400..70401..70480..70481..71114..7113

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Alpha\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8629
Entropy (8bit):	3.8572319034939446
Encrypted:	false
SSDEEP:	192:iZKX229ap3tLav3nmq+95qoxk/Hm8L8UyQJqlWOeifqrqqbLM6:iZbmap3tLa/nm/95qPvwzQJqlWOq+Z6
MD5:	8BAD21BCA3095F9CCC4D3B75512699CD
SHA1:	A808EFDE4F483A0F5C8C09EDEA4D9FBDD9C4D247
SHA-256:	A75172A2728A71B28DE36132B1447E87462FC3DEBAF20DD1A47009D761E8B05B
SHA-512:	7D7C5E04608F1C821CAF55C8E7198889CE96533CBCDCAE5EF5CE82A4928FF78A8FEEB149968A5F8A5A906A2D20821C069CB1FF2652641B5408BABDE2A88F402E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1234..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..837..838..880..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1456..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1624..1625..1632..1646..1748..1749..1757..1761..1769..1773..1776..1786..1789..1791..1792..1808..1856..1869..1970..19

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\AL.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.142440688375921
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7pR7hZUnTRRPbvDeRQZof:002+XT731GRnXE7pRlZUTRRzvScof
MD5:	55FABB44111E9235D1FE0C10B88C285B
SHA1:	8C3505A195B5495DD1ED5E0B9FA8FC23F8D3184D
SHA-256:	04494D74541FEAB43CA3187CA35B07CEB9313189462917F11045D10BF2255520
SHA-512:	0C590DB6BEDD9CACC0F4AE3987FB6ADBC5C704F72219DC2FA7E77FE54C4B9AF952ACE7EF949E29396741D91F3AF56DB209ED8B982A05181AA8095EBBD158EED8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V40..1544..1545..1547..1548..1549..1550..1563..1611..1645..1648..1649..1750..1765..1767..1774..1776..1786..1809..1810..1840..1867..1958..1969..1984..2208..2275..64336..64830..64832..64976..65008..65021..65022..65024..65136..65279..126464..126704..126706..126720..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\AN.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	569
Entropy (8bit):	5.086418418672203
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP748q3DN:002+XT731GRnXE74N3J
MD5:	DE77B499534C35896273A4545D574095
SHA1:	AC7F442B27E309A2016A6A0860E68712AACD28FD
SHA-256:	B22B00E041C8AB8A43CAC7C0606A2709D4B44D0A194867A22A0AF6CF69C584A1
SHA-512:	B2EAF11E97D2FE43D206E08B3C57A66EB8767AAEDFB4DA1A02439261C7D89FC3565202454639E76EDFE37E6BA248558513E4D85F4F7DF9C4AD1D28EFA226A68B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..1536..1542..1632..1642..1643..1645..1757..1758..69216..69247..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\B.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	553
Entropy (8bit):	4.991860593039845
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74VJQNyrQ:002+XT731GRnXE74fo5
MD5:	790E491C00FE7166A9706C31963FE87C
SHA1:	573FB460B40051EB6005533A8461B3DCEAF41B29
SHA-256:	0CB20706BD36BFE3DB2DB241CBD28D517621A4C34D0F7A96E8517EE96ACD8ED7
SHA-512:	D52A45C71A2AE295F562621CA44E9568F1E21E09409C5562B79C25AB57342DAB1D22B3570953380F1F1B8D2BE1FC7549AFE8FE2E373FBFD049C425E5A055429D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..10..11..13..14..28..31..133..134..8233..8234..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\BN.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.073844259173684
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7faFLFl5a869G2RlBGW+0Ut1:0z+XnEnLFhak2Dktt1
MD5:	DB7D565475442FDDE2AFCD7516765297
SHA1:	330629B7A6A17FF16C56F101B9A31C69D1EECFA9
SHA-256:	4FE53C3A80529ADD3E8F84BAA8B7E24024EEF7CE7B6DE5B1B0D6036802AE4E9D
SHA-512:	EA261C1950C797494A8148396F7AE220AFD5C2DB442555BC0B91D457C73798F3A7438ED2B0D1EEB7C312C9595863F91502E86AEA8023844DA633A385F3205981
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V64..0..9..14..28..127..133..134..160..173..174..6158..6159..8203..8206..8288..8294..8298..8304..64976..65008..65279..65280..65520..65529..65534..65536..113824..113828..119155..119163..131070..131072..196606..196608..262142..262144..327678..327680..393214..393216..458750..458752..524286..524288..589822..589824..655358..655360..720894..720896..786430..786432..851966..851968..917502..917760..918000..921600..983038..983040..1048574..1048576..1114110..1114112..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\CS.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	5.142268374213357
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Nov+4CdbNXy+4M:002+XT731GRnXE76v+vy+4M
MD5:	8D46ED64BF2627C0BED0DA8AE7F02C68
SHA1:	2B9CF4E90649512B55A595CDE995F03EEEDAD6BE
SHA-256:	859D955C891C6F11681E9E159B8658DE6CB1B6DB89DC7D664C0232A05ECD07F0
SHA-512:	CD26FBBECDBF9760FA4593B2C68DAD635FDB52743AD1F3D2857BE8243D3EA1202209E7D53291BFEE40F852B667631729651F7673EBE2802AA8D7F8D40A1F8145
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..44..45..46..48..58..59..160..161..1548..1549..8239..8240..8260..8261..65104..65105..65106..65107..65109..65110..65292..65293..65294..65296..65306..65307..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\EN.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	655
Entropy (8bit):	5.156885852504475
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7De0BdvIt5mXk9MUpv:002+XT731GRnXE77BdQt6kGUB
MD5:	53698EFB9EBCED4F7C112DF49A6FBD96
SHA1:	54BED29EDFD80BC322C8B0D505A744573410B894
SHA-256:	C1DEAC272D6EFC720E6EE65F641E459C44C87208C97C48B6285BB6BF6E40C1E8
SHA-512:	2CA7A924E4F50D8535940D5D8DCEA1CA3BC16C1DB090463C0C761BD716065A5B5EEADEFE517C739925650361E23EEFE2F25D6FF385A75D7F92CBD11D5CA7415F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V24..48..58..178..180..185..186..1776..1786..8304..8305..8308..8314..8320..8330..9352..9372..65296..65306..66273..66300..120782..120832..127232..127243..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\ES.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	5.139527465370124
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7H1yl45XyG:002+XT731GRnXE7H1HJyG
MD5:	91B42C97446D881368136ECD5C987C08
SHA1:	2C1C3599892F252BD8EB57522F2DA9718CFBBC86
SHA-256:	12118FD9DABF3273E5596787EE3C0370972AD46CB8AF9725A4590210869284FC
SHA-512:	5D92D4349ADEED4492DF1BCCCF20B1502A262B872EE05D95718B02E907B1C5DCF8F67D92B663CFE1BA1D1379F1E00B651E81DB02D09FD1844474421DA9701739
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..43..44..45..46..8314..8316..8330..8332..8722..8723..64297..64298..65122..65124..65291..65292..65293..65294..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\ET.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	775
Entropy (8bit):	5.126721248862426
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7wnz4dLbznkWGKvP6tZFT:002+XT731GRnXE7wz6bzk5GEReSUyuov
MD5:	B4C87CA6302D5FEB138EC01053BF3E81
SHA1:	9ACC452923ADD25E38A6059AB1B8A2C974D423C6
SHA-256:	5DFBC56331DA7AF3DFEDF4F0DC1F07540F65891B5EBD0466562A5EBE1691EE62
SHA-512:	4900E8E07E13D7C555BB181BB14DC35BFFD222264CE94F15FC0B9EEA615B3FD892DF8B3B30937EE4A6A533B2E91B3DD4EB4EE0140D304F52CFDB6C68416A461A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V44..35..38..162..166..176..178..1423..1424..1545..1547..1642..1643..2546..2548..2555..2556..2801..2802..3065..3066..3647..3648..6107..6108..8240..8245..8352..8400..8494..8495..8723..8724..43064..43066..65119..65120..65129..65131..65283..65286..65504..65506..65509..65511..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\L.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5719
Entropy (8bit):	3.99270570841213
Encrypted:	false
SSDEEP:	96:0zoEnIB8jDiXHolYa+hDQvvC02rwi4FajCk6l0LnR9X5YBdNyZdweJ/Abn0M:iZIB8jDi3oll+WvvC02rsa2kbRNuMw0M
MD5:	7A3D8BFBCEDC87EFB99D2A51FDAC6096
SHA1:	30348ABAD155E5D11AC3C3C04795F3E301277654
SHA-256:	BAA6E1C4B3CB3CBC18F69577218861B8E8217BA64C43251536BEAD266F34FE04
SHA-512:	FA9CF09E7327994E2A3391BBD660D402752CC2D22499852255536619E27698EF2B9B58AF56D46FB910C75E4877D2A16DD2F7368693059E19B3B4300271CEA9B3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V789..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..697..699..706..720..722..736..741..750..751..880..884..886..894..895..900..902..903..904..1014..1015..1155..1162..1418..1419..1421..2307..2362..2363..2364..2365..2369..2377..2381..2382..2385..2392..2402..2404..2433..2434..2492..2493..2497..2501..2509..2510..2530..2532..2546..2548..2555..2556..2561..2563..2620..2621..2625..2627..2631..2633..2635..2638..2641..2642..2672..2674..2677..2678..2689..2691..2748..2749..2753..2758.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\NSM.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	4.146087861789579
Encrypted:	false
SSDEEP:	96:0zoEn7V8cDiXMCNm+hDATspCKl0LnRL85YBdNye9eJEc:iZ7V8cDicCg+uscfbRL8uDw
MD5:	BAFFB1A46FD9B46FC9C38423AC67E3AF
SHA1:	324A8200545D98C6AEFCE7211702EF9C2B98CB16
SHA-256:	D1810FE9EA36425B60E1B58E50F2D38AF7D4D6AAC5FD31C142736E1EDBC6AB0E
SHA-512:	105B9954FA7A817E8A8951AD2262B19B636BB4C3FE7773D3E8056A217B5B505633D97396DCFC565ED1FA8F61C8B72A2D87579393E95E75C583DBC68C1B01D80A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V524..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2307..2362..2363..2364..2365..2369..2377..2381..2382..2385..2392..2402..2404..2433..2434..2492..2493..2497..2501..2509..2510..2530..2532..2561..2563..2620..2621..2625..2627..2631..2633..2635..2638..2641..2642..2672..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\ON.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	4.30174230997026
Encrypted:	false
SSDEEP:	48:0z+XnEnITdNC0EEvWq9CeRIgJRpLSCWfQFVk4FUIqkKaQL9wcuzWjByO5vkt9UWI:0zoEnu/C9MuCWf6i4FUt1/wzWhmbnI
MD5:	78318AE7897E96DFBCFCAB33DADA407B
SHA1:	6230E1F52C5AE13D7489F8CA5E3AC34F19BE4BB2
SHA-256:	77ACE9490610067BA0A8D2F8D3127B2F0A20C14489AAC30857DF728D3AE24D3B
SHA-512:	B6A5586A84E696EBD799B2332042F58EB68540B4670C7C2AF3A9B9A6A7E8218185F7C4EF4550B31005FFBA9BB74D6F37AE90F6A4082653890235F68857BEB332
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V348..33..35..38..43..59..65..91..97..123..127..161..162..166..170..171..173..174..176..180..181..182..185..187..192..215..216..247..248..697..699..706..720..722..736..741..750..751..768..884..886..894..895..900..902..903..904..1014..1015..1418..1419..1421..1423..1542..1544..1550..1552..1758..1759..1769..1770..2038..2042..3059..3065..3066..3067..3192..3199..3898..3902..5008..5018..5120..5121..5787..5789..6128..6138..6144..6155..6464..6465..6468..6470..6622..6656..8125..8126..8127..8130..8141..8144.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\R.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	917
Entropy (8bit):	5.064945485749576
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE74LqBFSCgFyO+vO/Py/yu3s8HcVRjAJHZ:0z+XnEnLKFSCgFyu4yM8XjAJHZ
MD5:	78DF266230C6C183D7B588665B2008FB
SHA1:	DE06EEC3AB62F04779F32DF800D3824E412E60B9
SHA-256:	E6B633B129A6EE3E9C1F2095CB039681237BE47E6493BC4FBB7BC871A961FF69
SHA-512:	AB1E474C26DFEBB9495C2BAF8D8CF6B524359C850EAE0C8BA940D425D7E762FD647FAE12500EE1550D58BE1F5B98A5D672EFD766570EFFC51B84B72112F2CFA7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V62..1424..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1536..1984..2027..2036..2038..2042..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2208..8207..8208..64285..64286..64287..64297..64298..64336..67584..67871..67872..68097..68100..68101..68103..68108..68112..68152..68155..68159..68160..68325..68327..68409..68416..69216..69247..69632..124928..125136..125143..126464..126720..126976..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bc\WS.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	585
Entropy (8bit):	5.076615040282228
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP70M+n/v:002+XT731GRnXE7V+nn
MD5:	5238431A3C7E1F10B57CB3A8ED7660F0
SHA1:	62414EEB7826339F70B1F7F6DF72EDBC6AFC08A3
SHA-256:	E32DC27A7C91F249B99B26E86E983F09C5556BE4A929548C659B379E9E0BACF9
SHA-512:	2F6D716E959B62A90FDB3A84CC8E787DDDB53E2F7061778E72AD9251AFA4E436AB73A8D30C3EBB0FA02A3F4654B642C6826C87D900BA220E1C553646366947DA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..12..13..32..33..5760..5761..8192..8203..8232..8233..8287..8288..12288..12289..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\BidiC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.041891236773502
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7LsYA:002+XT731GRnXE7LhA
MD5:	DC74AE7FD2E59B7E25F80D314C7A5252
SHA1:	AE3F63D58F122E7A248AB7C9088F5DD0C4E825D2
SHA-256:	7551DFF631A6B1EFCF6033C4A3D71F6C89CD7C0DA40431D1C030613DD3F47CBE
SHA-512:	F73DC7CCB20AD652D6A7EF6A838ECE53229BF66888AEDB442B15CF896F005758193CAB845916FCF7030077383DC2465019F52720669F95833E83E2B05EA00A21
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1564..1565..8206..8208..8234..8239..8294..8298..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\BidiM\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.4973020808320765
Encrypted:	false
SSDEEP:	48:0z+XnEnSXM88VCc1qbvvzJXA3FHRGdhTOkqRu/Pcn:0zoEnSc5VCcwXUFHYdh2fn
MD5:	24307A0F7D6813262E0442270F8A8BCE
SHA1:	DACF3E4CA4BB4A6619AC1270D30B14BAB86344C1
SHA-256:	383401DF461AE76C4D8690E0C74076613103684CDCDED53452EB8E6A79AF0B01
SHA-512:	701F04ED7FFB60D237EFE5DF5593F472B4E2AD29DE3570D931374018C2F51745FC2ACE0F2A258A123889EFA108A659522DF6350854F827C1AC5CB3FDCB16906F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V222..40..42..60..61..62..63..91..92..93..94..123..124..125..126..171..172..187..188..3898..3902..5787..5789..8249..8251..8261..8263..8317..8319..8333..8335..8512..8513..8705..8709..8712..8718..8721..8722..8725..8727..8730..8734..8735..8739..8740..8741..8742..8743..8747..8756..8761..8762..8763..8781..8786..8790..8799..8801..8802..8803..8804..8812..8814..8845..8847..8851..8856..8857..8866..8868..8870..8889..8894..8896..8905..8910..8912..8914..8918..8942..8944..8960..8968..8972..8992..8994..9001..900

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Blk\NB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.956685009135785
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7QvITxjH1AnNmEnrcxr2Nh9mUQ:0z+XnEnkjOnNz4xqNLQ
MD5:	A991746565EC124FEB44BD1A1C57212E
SHA1:	92DD298AEE435433B96E3833BDFD4AA56E4EEF7E
SHA-256:	2E4C00DEBF07A15EC2C86449891FAE11F22C4BA948926CAD04640AA8169F5C10
SHA-512:	A2251BBB43ED543CCCCBD367BC209E8D17A6345AAEB5DA0FED6C2DAD6E71327DFFFAF2BFB7E92033D3E1C0C4DF7E29CA200DD86B0FBC92F03491BD5A9582FB94
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V85..2144..2208..7296..7360..12256..12272..66048..66176..66528..66560..66736..66816..66928..67072..67456..67584..67760..67808..67904..67968..68256..68288..68528..68608..68688..68736..68864..69216..69248..69632..70224..70272..70528..70784..70880..71040..71264..71296..71376..71424..71488..71840..71936..72384..72448..73728..75088..77824..78896..82944..83584..92160..92784..92880..93072..93952..94112..110592..110848..113664..113840..118784..119376..119552..119680..119808..121520..124928..125152..126464.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bpt\C.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.764306079010823
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7Y1Y34payRygdz8UFxtxmyyTI+Fe5:0z+XnEnV24payRyHWvjuFi
MD5:	8AAC6CDC7BF3923F848915768DF55750
SHA1:	9CF61F41ECE58F8FC205A96A09F714866F55337F
SHA-256:	8DB8F3C5370AD288A0CEC685BE76824F1C600A3D20F9A859CD5915E0FB364BEA
SHA-512:	EEE9B0ED41776F5DC809CE8F548D3F1DD4DAAFB0A7CE8A1115B0578086489A366DDB0E70BD3371AA6E06605A13EF01AC8CB0ED3DBCDE00654B254B5B4CF52724
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V120..41..42..93..94..125..126..3899..3900..3901..3902..5788..5789..8262..8263..8318..8319..8334..8335..8969..8970..8971..8972..9002..9003..10089..10090..10091..10092..10093..10094..10095..10096..10097..10098..10099..10100..10101..10102..10182..10183..10215..10216..10217..10218..10219..10220..10221..10222..10223..10224..10628..10629..10630..10631..10632..10633..10634..10635..10636..10637..10638..10639..10640..10641..10642..10643..10644..10645..10646..10647..10648..10649..10713..10714..10715..10716.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bpt\N.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	876
Entropy (8bit):	5.0924070533674435
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7kTDD1AR1TDvu469eEcH:0z+XnEnpDD1ARRu1PcH
MD5:	005DA5E8C95BDE82EB5A862A335AF623
SHA1:	F2D655CB6C7FD63E4EA545B3D580DCF8A754A090
SHA-256:	86483C8E3A157F63385F94C20007C3477F3AD634D9431B0D01094D2C718D7194
SHA-512:	154AB7CE9C816D865BD6CD07D02A2419FD986C111034F4F9B95971EB3A902707D76568EDC3873B4B9854C487B932DDB052F92AD2053E50521CC0FB7F5861F563
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V59..0..40..42..91..92..93..94..123..124..125..126..3898..3902..5787..5789..8261..8263..8317..8319..8333..8335..8968..8972..9001..9003..10088..10102..10181..10183..10214..10224..10627..10649..10712..10716..10748..10750..11810..11818..12296..12306..12308..12316..65113..65119..65288..65290..65339..65340..65341..65342..65371..65372..65373..65374..65375..65377..65378..65380..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Bpt\O.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.761871400853109
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7YwZlTe34ZrRBXgdzYU5ytxLIjSV9c/:0z+XnEnQZx84ZrRBX3n5ICc/
MD5:	045CE197DD13B0F9923B1F138A8F63AC
SHA1:	54C2DF2A0991B2FCE75416F5C644D633F251A10F
SHA-256:	3169E1F4E028E90FACEDF0EDF1CEBDD76C908E15DB9599E542BAB742B5C319CF
SHA-512:	DFA9A996C92BE0891CB79016A57200F3C36A014A32A80983EA9EDA0A3DDBD97200586C23A85C60264DCC8B5DBE38EDC5590E1ABBFB73A8893B639D7691D35AE2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V120..40..41..91..92..123..124..3898..3899..3900..3901..5787..5788..8261..8262..8317..8318..8333..8334..8968..8969..8970..8971..9001..9002..10088..10089..10090..10091..10092..10093..10094..10095..10096..10097..10098..10099..10100..10101..10181..10182..10214..10215..10216..10217..10218..10219..10220..10221..10222..10223..10627..10628..10629..10630..10631..10632..10633..10634..10635..10636..10637..10638..10639..10640..10641..10642..10643..10644..10645..10646..10647..10648..10712..10713..10714..10715.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CE\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	929
Entropy (8bit):	5.054242004336499
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7VEp1mDCWOjAWWHFEZO7v:002+XT731GRnXE72HAa+E5Py045f
MD5:	7FB3290A52B51787043D6BF657E02B76
SHA1:	8FF4A00CD82A0B9A3800E26C6453A1878B714242
SHA-256:	B58BED1D36E8AD1E27FA0BEF94C77BFCB2383BE827453995F15EAD3D6D1825DE
SHA-512:	C8151947D98A8D1B36D2F86190BB6B3D1209E5A28545CCB3E3C001E62E499E325FE74C39C02FD8D7712E901446D94993941CC93C0369D0CC361E681E7CEA4891
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V66..2392..2400..2524..2526..2527..2528..2611..2612..2614..2615..2649..2652..2654..2655..2908..2910..3907..3908..3917..3918..3922..3923..3927..3928..3932..3933..3945..3946..3958..3959..3960..3961..3987..3988..3997..3998..4002..4003..4007..4008..4012..4013..4025..4026..10972..10973..64285..64286..64287..64288..64298..64311..64312..64317..64318..64319..64320..64322..64323..64325..64326..64335..119134..119141..119227..119233..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CI\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4950
Entropy (8bit):	4.04218925698205
Encrypted:	false
SSDEEP:	96:0zoEnsta5T8cDiXmkF+iUfL7xlx4pRCglFL1An/X+e9x5YBdNyU09eJEeJ:iZstwT8cDi2I+i87xlx4p0cBAn/Xlvuh
MD5:	B0DFC866E456B43AD969EB9BD561499B
SHA1:	607B31C194874052469720ABAE9C5F93AF336138
SHA-256:	8348BF344486D2E3BA24BEB53F92CE1D6B0BC747DE8103E5B3D36CC29C5220A8
SHA-512:	54BAD9EDEBF3B553DE73AB4CEFD1598915836AFF0E6FA76481BD4670D01EE73C3432CB50279C82C4780FCE315B25061AEA5407E7BADD8768D6352E11039BD574
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V692..39..40..46..47..58..59..94..95..96..97..168..169..173..174..175..176..180..181..183..185..688..880..884..886..890..891..900..902..903..904..1155..1162..1369..1370..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1524..1525..1536..1542..1552..1563..1564..1565..1600..1601..1611..1632..1648..1649..1750..1758..1759..1769..1770..1774..1807..1808..1809..1810..1840..1867..1958..1969..2027..2038..2042..2043..2070..2094..2137..2140..2275..2307..2362..2363..2364..2365..2369..2377..2381..238

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CWCF\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7707
Entropy (8bit):	3.822787897866578
Encrypted:	false
SSDEEP:	192:iZC4lhZjEFnyQHKZ4+BkQp45rV6ze0thDiZ33Hr:iZC4V+u5KVIHDC3Xr
MD5:	0BAFC0678D219C8FCBC82CD941AD4931
SHA1:	8469DA7457513F68C5956D30097ACF444DBD5A0F
SHA-256:	E7246D31ADFB2E0BA850C9D880D44BB697D2496DD79C14371D2A7D884DF78F89
SHA-512:	4838A14D747F5CCAC915B492D1154A2B771B3DCB4E1B76CB1C5A047867D899979400961A1143AE44EDCB44C1D7852B8F32E6DCF0E005CCB218D49BE46AEA324D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1200..65..91..181..182..192..215..216..224..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..329..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CWCM\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1836
Entropy (8bit):	4.558526658094287
Encrypted:	false
SSDEEP:	48:0z+XnEn5Qfo0FEZ65Dhu7RNS/IaCX3x5E:0zoEnVgJorpHG
MD5:	FE077EC2D4A1DAA5C1E155A05B9A645C
SHA1:	3812E6FC19BE1B8B74CA1F0966257A75305E24FA
SHA-256:	4E5D8E5CF1950EAC732974A18D634BEA59BA77D73816B6D327965365DFE592B8
SHA-512:	5A8AE2BB1DC0BBD0079BB683E4ADA92FB3E1F044A0393AFF00AFC5B7045D9377D6EABD6FCD597A9C0C719FA3C0FF73EFB98917732C0944D8A35B29076846013C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V226..65..91..97..123..181..182..192..215..216..247..248..312..313..397..398..411..412..426..428..442..444..446..447..448..452..545..546..564..570..597..598..600..601..602..603..605..608..610..611..612..613..615..616..618..619..621..623..624..625..627..629..630..637..638..640..641..643..644..647..653..658..659..669..671..837..838..880..884..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..978..981..1014..1015..1020..1021..1154..1162..1328..1329..1367..1377..1416..4256..429

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CWKCF\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10635
Entropy (8bit):	3.7591543508253538
Encrypted:	false
SSDEEP:	192:iZn0dKlPgjEFnyQH3Z4+BkQp45rV8rw0VtvyDiZt3nUOcLMm:iZn0dKG+j5KV81yDCtHrm
MD5:	82973AA7F4ECFD3D9C986CC8BA5A1D29
SHA1:	01CECBDCD55815622483B04EC2E7CB326A92116E
SHA-256:	70D96B43DE000E7854D832EC4A042E22D58E49A333D851096B7BDCAEDB1EF3CC
SHA-512:	D801C0F1DDCE7C66A93E8BF772F18BFCF210E27209F33833530AE90B4B825B096E8E0C63770D2B132C2BB5BCD2E3247C058792FA973E36B10AF2C584B641BC28
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1624..65..91..160..161..168..169..170..171..173..174..175..176..178..182..184..187..188..191..192..215..216..224..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..309..310..311..313..314..315..316..317..318..319..322..323..324..325..326..327..328..329..331..332..333..334..335..336..337..338..339

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CWL\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	3.829250297610361
Encrypted:	false
SSDEEP:	192:iZYvl9jEFnyQH3Z4+BTp45rVmXge0thDiZ33M:iZYvv+TTKVZHDC38
MD5:	198FE5C466677B3D4F554D0574F62B00
SHA1:	1AF79752FA3F534BD722AF347A275BC9AA7BC3E3
SHA-256:	076BCBF541C4145D8DFE3443C3A5BC5710877ACB6087244B72881D89BC7A8C2F
SHA-512:	EA2949086AF533D158CB484D226B4D1EBFFFF27C54FEB53BD75E9FA9FDCE6AEA5B8B54E2946F2EE5EE44F97C28BAC88C1AFD6C0F841D208BC5EE5D7A83F7F7D5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1176..65..91..192..215..216..223..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..350..351

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CWT\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7761
Entropy (8bit):	3.8210380311055263
Encrypted:	false
SSDEEP:	192:iZCO3aPgIjEWnyQHRZ4+BP45rVBptNDiRn3yw:iZCOqPbJNIV3D+nCw
MD5:	3AC0931EEDE6F94DEC1348D953AE12FD
SHA1:	0CFBA8ED36CB554A56A71591C11470B492925817
SHA-256:	B876BD9A3582A43B19B6526951B413682C7ECC90F575E5149489917386FF49B6
SHA-512:	7A00137039A6794CD8E5BC8BFB0C3BF74BA19C2BCCA668ABEF15D4A79B5E2D2203987338902EC96B9B6CACD97633E877ED7005F0517202BD944716B2B80ACC48
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1212..97..123..181..182..223..247..248..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..312..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..35

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CWU\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7751
Entropy (8bit):	3.820628825975188
Encrypted:	false
SSDEEP:	192:iZrU/B3aPgIjEWnyQHRZ4+BP45rVU2tNDiRn3yw:iZI/BqPbJNIVxD+nCw
MD5:	CC29626A4D0B73F943523B5C77F751EC
SHA1:	E412534AB3DFE535585724D8FA553860787EF04D
SHA-256:	0ADCF0A5EA6FA7CCFA546A901A2D08B4FAAE60AB19A38625735F974DE2D254B2
SHA-512:	6EBAE701533C9E783190BF24EEED6B02419BF106A4536008AD08931EBD624CDF39D51912FBCF7C3E3C22D51F0970DD2673ED051538A7EA73C3C24509A8337967
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1210..97..123..181..182..223..247..248..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..312..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..35

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Cased\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2216
Entropy (8bit):	4.451935069400861
Encrypted:	false
SSDEEP:	48:0z+XnEns352Eu7RWSi1RBxqCXp5wzv3+H3r2:0zoEn2oFgxnOzvC3S
MD5:	6A6692FED1047E633B413A15BD589939
SHA1:	91101561FD564B1E11BFA1E86AC6930B373F35C5
SHA-256:	E59E2A6CB8A93DB011E6654C6EAB5A261529808CF315E387FA7F1FFE22997977
SHA-512:	D9C145022D8B04C799C1ED9287A79C2709E4ED0C011DCBB5572794354DDE2F2739D81C9971C6BA1F3685A078984CFFD4DC221E65705DBD33E7D4C56BA56C7F23
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V262..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..443..444..448..452..660..661..697..704..706..736..741..837..838..880..884..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1377..1416..4256..4294..4295..4296..4301..4302..5024..5110..5112..5118..7424..7616..7680..7958..7960..7966..7968..8006..8008..8014..8016..8024..8025..8026..8027..8028..8029..8030..8031..8062..8064..8117..8118..8125..8126..8127..8130.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\A.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	4.612088473993075
Encrypted:	false
SSDEEP:	48:0z+XnEnsWMqvD/TrTgFyt1dDYahBlwsrILKWFlhT:0zoEnQqTjddDFLwskLKWjF
MD5:	1AB831440D70692092CABB826D09A675
SHA1:	2DFC1138E0E7B46244D9C499944FEC34F319C5C3
SHA-256:	572B428B99D6693D2EEEB94D50AE066209131AE0BC4EE5A476394808173B4E66
SHA-512:	AD7066879420C4362D2CFFFE55774A6DF24FAE0DE8787F2F6CB566E26E76788CC3DC42017DC234F3CDF327A7EDE8CF14B6EA58BE77E24489B2600BA4C5885ECF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V204..768..789..829..837..838..839..842..845..848..851..855..856..859..860..867..880..1155..1160..1426..1430..1431..1434..1436..1442..1448..1450..1451..1453..1455..1456..1476..1477..1552..1560..1619..1621..1623..1628..1629..1631..1750..1757..1759..1763..1764..1765..1767..1769..1771..1773..1840..1841..1842..1844..1845..1847..1850..1851..1853..1854..1855..1858..1859..1860..1861..1862..1863..1864..1865..1867..2027..2034..2035..2036..2070..2074..2075..2084..2085..2088..2089..2094..2276..2278..2279..228

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\AR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	550
Entropy (8bit):	5.039378003345337
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7A/ev:002+XT731GRnXE7A/w
MD5:	7126136BCDB9F7322E0ACB6AFA5E5736
SHA1:	7F097720BAF249C012BC4140A0C360F883666E51
SHA-256:	08F750FB73D4832C3BC359D79FAEE6225005462C6690D7FE4EFB1BB5722A3FD2
SHA-512:	2F86D7530D001400E5BDF9F1766D25217C06917C8D34057A3EBBB4444EBC271E5440427B94B608C89BFDBD20FE22011CAF2E412E3D7A154A4C228718590E6B75
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..789..790..794..795..856..857..12332..12333..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\ATAR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.050645823777754
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7WGLth:002+XT731GRnXE7WGv
MD5:	C255B445C4F0AD7C3F2FDFA1802DB109
SHA1:	747363B340D27F5A9159566C3CF3B7F00ED4F710
SHA-256:	E914EAD824EBB61EA49CF7ACFC6409555E53129624BDBBDA517470A516E84876
SHA-512:	BD912BC10D8335C12A1B16B52BC5F7E6E73F78FCDB1B94D422C1F758B9F7ABA6910AE0CC33BFF5AFE86FE545AE9A91AB9EE4899AE8B6C2570B604F62FB69009C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..795..796..3897..3898..119141..119143..119150..119155..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\B.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	4.783863741440615
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7o99ym2oYCRZW8SEra+D3vTcH057wCCkRBABB5n9X3/qm8:0z+XnEnx9X2ohHWk3D/TcHIwCUn5n5v8
MD5:	7B477F0C1C35117805735472B003F818
SHA1:	0401D6D50098C1AC2BA4AF5A258FC47236463FB6
SHA-256:	09E346EB913AB2A496A5CA98ABAE9C37CC3E6B80113ADBB206867928F5CE5D16
SHA-512:	2A180AF77E9BB3E251EBB5335469D49A2AD91CFEA3F2C3FB7F0F94B50E406E74954A493E4751BD2CD8875C3D59B7DA276B164CFAA8F70BABFF8A3791182DC485
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V142..790..794..796..801..803..807..809..820..825..829..839..842..845..847..851..855..857..859..1425..1426..1430..1431..1435..1436..1442..1448..1450..1451..1477..1478..1621..1623..1628..1629..1631..1632..1763..1764..1770..1771..1773..1774..1841..1842..1844..1845..1847..1850..1851..1853..1854..1855..1858..1859..1860..1861..1862..1863..1864..1865..2034..2035..2137..2140..2275..2276..2278..2279..2281..2282..2285..2288..2294..2295..2297..2299..2386..2387..3864..3866..3893..3894..3895..3896..4038..4039.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\BR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.0425733805458375
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7FK:002+XT731GRnXE7FK
MD5:	5E8C725ADF3B00E7E7E4CC3E4B42CF4E
SHA1:	1D6F528E7D75884F53D0CE38359B7D36AFA29E18
SHA-256:	6C83D2C8C47E872361E63A60F9350D90E199C0F7C7898EEFFA3E8D85E8C36D35
SHA-512:	C20CB0E38DE0B2C3508BF0BB86DF011990D7499DF6019413D379148D6C8C8A1FD82B6335CDB9B9EC8CBBE75F35F305CA75F69CD86AC512380845B3CBFAAA4930
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1434..1435..1453..1454..6457..6458..12333..12334..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\DB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.985731440054977
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7J4:002+XT731GRnXE7W
MD5:	C53B2D585B9BFD96CD7F74CFB6A1777D
SHA1:	3606D342B743450188AACB31A0C7E7E946CEE46C
SHA-256:	0D647A9E4E0C4E3CD1D8CBCF67A2F7248545ED27CBD7D2101E1252BCBBC26D0D
SHA-512:	608FA8F9F0211C73BB1819691A8427CFCDAFD8881E19765E170D3CE779DF556E02C23AE4FD5EBF7961EBA99D75E7FB59B8DF010DD31D417207658E9CFDB84463
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..860..861..863..864..866..867..7676..7677..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\NK.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	767
Entropy (8bit):	5.154692166296188
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP75vcurZvTZQwpxuxoKkJs:002+XT731GRnXE7xcuFvTZQG4xzkhyRv
MD5:	2B7830654EEB54D2CD36A7B0918649D0
SHA1:	269247432A2E2915FA9733EE40F6EC0C2FF1135C
SHA-256:	5FA81BCC070A207AC2B7F27C676908AF5AEB91AC6FA1D9739F606EB8E7AB7D2A
SHA-512:	A09B6180370760245DD969F661089FD4E888924DF7E0BC5399DF8A05FDE71D0B244346518834464B067E9F4297FA9B0E1E5DE0920A1B095541B7E24A5DECE2CA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V40..2364..2365..2492..2493..2620..2621..2748..2749..2876..2877..3260..3261..4151..4152..6964..6965..7142..7143..7223..7224..43443..43444..69818..69819..70003..70004..70090..70091..70198..70199..70377..70378..70460..70461..70851..70852..71104..71105..71351..71352..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\NR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	4.404078678152127
Encrypted:	false
SSDEEP:	48:0z+XnEnEkOgFyl6NvdL9CX0SB05LEDW9bsDUvLUEsQ8QTpxwha8:0zoEnw7eKIAD4bsGLps4Tpuo8
MD5:	0C9FD9C23A2D8FDC49C00E3BBFA10378
SHA1:	210360BDB4094332ED9A4549624613D09702647A
SHA-256:	62B892570EFB9D4D77D13C7D1A3661C5785687B666CF14932900B577360D8BE7
SHA-512:	E2AB861CD470C31DC0D9557ED16F20F3AA4DA55982F529DCA09035514E70216B18E2A096962CED1D015D1D0909A574E9258EACB7C0E89DF7EE4B4C52D2989768
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V305..0..768..847..848..880..1155..1160..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2304..2364..2365..2381..2382..2385..2389..2492..2493..2509..2510..2620..2621..2637..2638..2748..2749..2765..2766..2876..2877..2893..2894..3021..3022..3149..3150..3157..3159..3260..3261..3277..3278..3405..3406..3530..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\OV.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	649
Entropy (8bit):	5.148007905998435
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7cqD9WyRaEz7fgw:002+XT731GRnXE7rhtAOV
MD5:	A545E3473D2F4AF3DCCBF6E04AB60B19
SHA1:	DF87FFBB5FE78E58A278F5244403CCF6F2057765
SHA-256:	A70A95780063D32622358C794CACC03CC1D72B139FCBC9F0F45BB869ADCC4330
SHA-512:	A51C9CA02FB6CF73D7D0F6E538A881F3338320CB4674B4C7A2E802C4C071E381636CF3DE74EDD18AABCF0F65A8347805ACBB2D75A3781436D1473111A775004D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V22..820..825..7380..7381..7394..7401..8402..8404..8408..8411..8421..8423..8426..8428..68153..68154..92912..92917..113822..113823..119143..119146..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ccc\VR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.011977204563393
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE76tQvd9S3DZCHev1hS65:0z+XnEnjqdeE+Nhd
MD5:	A7806F3D03C56AE5921005A876E7163A
SHA1:	A504B1CEE4990256CE9665B224072705310BAAB6
SHA-256:	DE7EAA8ECBF5063B7782B55ABE75D85C08D9B29EFEBC5433A7C7086815330710
SHA-512:	CEEF8EA353F75FED83A3BDF32F5A322DE266E78656D3286F5BE18239A7D3189058F07BE02683FF3A760DFC8FE85417A587A817C459D35ABE8320434C03A2ACA2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V82..2381..2382..2509..2510..2637..2638..2765..2766..2893..2894..3021..3022..3149..3150..3277..3278..3405..3406..3530..3531..3642..3643..3972..3973..4153..4155..5908..5909..5940..5941..6098..6099..6752..6753..6980..6981..7082..7084..7154..7156..11647..11648..43014..43015..43204..43205..43347..43348..43456..43457..43766..43767..44013..44014..68159..68160..69702..69703..69759..69760..69817..69818..69939..69941..70080..70081..70197..70198..70378..70379..70477..70478..70850..70851..71103..71104..71231.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\CompEx\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1422
Entropy (8bit):	4.772311897194472
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7hDnQHAa+oCm6JX3IkLLFYywZdPy045+:0z+XnEn7N6JIk1wZNc+
MD5:	ACC093842E9AE956909C70EBDF5C0365
SHA1:	8D1E6ED663A8E9CC9B5A02ED5190DED43DDF185B
SHA-256:	E4EF8682866C7E03497B2176062F5CF2C983BA0C6D01E71937A9B6CAD388DC50
SHA-512:	95BF4AAD34091083EE31567E168324F2CA198BC2B8FA788EEACC9C525F9B24F5BE3A89083F44DCD3116B7F6C33E5A7A223E797CEE36A84CC32AF76714965D9A0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V146..832..834..835..837..884..885..894..895..903..904..2392..2400..2524..2526..2527..2528..2611..2612..2614..2615..2649..2652..2654..2655..2908..2910..3907..3908..3917..3918..3922..3923..3927..3928..3932..3933..3945..3946..3955..3956..3957..3959..3960..3961..3969..3970..3987..3988..3997..3998..4002..4003..4007..4008..4012..4013..4025..4026..8049..8050..8051..8052..8053..8054..8055..8056..8057..8058..8059..8060..8061..8062..8123..8124..8126..8127..8137..8138..8139..8140..8147..8148..8155..8156..816

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\DI\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.167821396649825
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MbN37noPlYOHlemXMTUy:002+XT731GRnXE7aYlYOH8Gz6
MD5:	61622DD05E45C31BBF4C5E2AFFAC27EE
SHA1:	73A6C26C473E47AF8EFD7EE12343EC430E1AD684
SHA-256:	D82028457AAC556E606A35C643F8F1CE4E1A319DCA85F55EF9E1F53135EC6A3D
SHA-512:	76BEA193C65B33B9EC4B58D404BBDCC722259A13741568AEF5EF2D19789773CB12C2E2BD2F24A65A439CCEE09B97CE9212A625422040EAC09EBFEB862B90F750
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V34..173..174..847..848..1564..1565..4447..4449..6068..6070..6155..6159..8203..8208..8234..8239..8288..8304..12644..12645..65024..65040..65279..65280..65440..65441..65520..65529..113824..113828..119155..119163..917504..921600..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dash\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.122724418840475
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7jKHQioEoqk1EKoDWfzo+:002+XT731GRnXE7jeoEoqkF6W8vTU36G
MD5:	AEBB8770E84120281A6E7D1C6479C1CE
SHA1:	E538F67D013F6885C4AFC61F90E45F7156B2F27B
SHA-256:	E529ACFEDA164FB5987DD7C1EED95006BA021FE9098E575EC454777A05128F96
SHA-512:	CEB5EA55A504C8EF5756759FF33C5F087554648DD629A73A423B9E8D986E9FB74027175AA8A71F215C005C452CDBDB6D4C5A539CF9D8DDBC932AE0681216CADB
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V42..45..46..1418..1419..1470..1471..5120..5121..6150..6151..8208..8214..8275..8276..8315..8316..8331..8332..8722..8723..11799..11800..11802..11803..11834..11836..11840..11841..12316..12317..12336..12337..12448..12449..65073..65075..65112..65113..65123..65124..65293..65294..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dep\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.139108214704286
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7b+6OkxSwoM:002+XT731GRnXE7bqBM
MD5:	4DD7263C6C9CC06172FBA92C34ECD4AC
SHA1:	2FBC558A557D4F9CC6A4E1D0D0114846423A734B
SHA-256:	92C3EA774886217EA5DD58B1E11D1BCAA6B28872FCC5377C04E8D4D8FAFB4E3F
SHA-512:	7370BCE3E560AFB83D5F7BED40FB6D2C9081D68C57F65FFE35371AFD4FCF30E138E430B1ED063CAA96CE7CD250D7ED49CC8340B734234844867A6D742E7D9B12
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..329..330..1651..1652..3959..3960..3961..3962..6051..6053..8298..8304..9001..9003..917505..917506..917631..917632..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dia\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2372
Entropy (8bit):	4.426428545691218
Encrypted:	false
SSDEEP:	48:0z+XnEnjZljDizQ6Nhd8qCXXOxgT2qbm6nvwTZtwxwH8:0zoEnjLiMeSdwTZtwuH8
MD5:	50107FAEC8EF5F5C1E17760DE321C0FC
SHA1:	41E085200BD1B1B21A1FDEDF70C133D879E22D3A
SHA-256:	27A0BFF98B5B88D34454F44C181FE7C61A62F900D44446B51D567E5152E98721
SHA-512:	88599CD760F6A8991BB4170FB9FC4DF08E4D58C1BCCE55CFB9782AE598600354836C1849F5913A87956737694A8352F802D652CAEB57845C272F98E31989330F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V294..94..95..96..97..168..169..175..176..180..181..183..185..688..847..848..856..861..867..884..886..890..891..900..902..1155..1160..1369..1370..1425..1442..1443..1470..1471..1472..1473..1475..1476..1477..1611..1619..1623..1625..1759..1761..1765..1767..1770..1773..1840..1867..1958..1969..2027..2038..2072..2074..2275..2303..2364..2365..2381..2382..2385..2389..2417..2418..2492..2493..2509..2510..2620..2621..2637..2638..2748..2749..2765..2766..2876..2877..2893..2894..3021..3022..3149..3150..3260..326

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Com.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1414
Entropy (8bit):	4.758251196414642
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7V2P4uYpMlo9X6KlwX3GXvUddOe4mueAyOXQvS3yBUdNv:0z+XnEnDloZ+XW/UddOe4muAYv
MD5:	A78CC9C80168F67DBA3A927A556E37BB
SHA1:	B618BE9E7888EF7F2324109E45D0A5A03BDD6CBA
SHA-256:	F89C4B6AFAA58FCC4355024006435A348E925073C7C0843738F93BFD7B0266C5
SHA-512:	552CCA9A075A18DECDDE290610708792182041E5031598AE6B212AA1A97593B1B90F4924AF77ADBA376AFAB2CACEB5A28201396D2D9F08E9F7DFA89EAB231B9D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V148..168..169..175..176..180..182..184..185..306..308..319..321..329..330..383..384..452..461..497..500..728..734..890..891..900..901..976..979..981..983..1008..1011..1012..1014..1017..1018..1415..1416..1653..1657..3635..3636..3763..3764..3804..3806..3959..3960..3961..3962..7834..7835..8125..8126..8127..8129..8190..8191..8194..8199..8200..8203..8215..8216..8228..8231..8243..8245..8246..8248..8252..8253..8254..8255..8263..8266..8279..8280..8287..8288..8360..8361..8448..8450..8451..8452..8453..8456.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Enc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.138793979141278
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Q4LHg0COJ:002+XT731GRnXE7o0CO
MD5:	563278EEFFCE798C9C1A6890EEDE9985
SHA1:	3B6BFF26E855F72FDC0FC72178592B38DA11D0AF
SHA-256:	3C57B9EE0EFC140D63F18BCEFE32FEA524B4FCC81282A9D02C4B99B3E00C05EC
SHA-512:	34200020863AA19935FA1E7D7E9CFCB46CE37D29DAFC70BA61A97F7F94322342CEDE89DCA464ACCDED126E4B3E4D006C23E9BBD3EB9C49FB0FC7BD64D25A840A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..9312..9332..9398..9451..12868..12872..12881..12927..12928..12992..13008..13055..127275..127279..127568..127570..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Fin.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	4.409520507969353
Encrypted:	false
SSDEEP:	48:0z+XnEnewbOblttVA6eRIGwmBFUaDe/b+lXTC:0zoEnevTYwmTUJaXO
MD5:	D645A57D6F73CDFC3EFD17B0FAF3EBF1
SHA1:	F6ACAD5B0DE4EA50C13AAE7C351B3571CF49ADCD
SHA-256:	7DEE849D123A64290D3A1193930D47A0AFE0CAF35170AC68D99CAF9DE0D3584E
SHA-512:	A471AEA111226B65C152356DFEFCDE73796523A3A8B78F6E28DB4948589AFF74F9E4624A9BE6EBD7E37D6CF200B0BD112C6CF3C8395576A3805CF08A9FF614B1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V226..64337..64338..64339..64340..64343..64344..64347..64348..64351..64352..64355..64356..64359..64360..64363..64364..64367..64368..64371..64372..64375..64376..64379..64380..64383..64384..64387..64388..64389..64390..64391..64392..64393..64394..64395..64396..64397..64398..64399..64400..64403..64404..64407..64408..64411..64412..64415..64416..64417..64418..64421..64422..64423..64424..64427..64428..64431..64432..64433..64434..64468..64469..64472..64473..64474..64475..64476..64477..64479..64480..64481..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Font.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.697133387678846
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7D61qvpCv3u1Grnudasg0v5E3o440nHrsjRDQKJImivBl6Rk3:0z+XnEnCGqkv3+b5E3l40nLcQKJImEBP
MD5:	70C8DE68058AC44367B06944D4DE24FE
SHA1:	0167F3338491BBD748CD4B1F158BBEE4F2B4BE03
SHA-256:	2E8EA1FAC37BAAF6CCAAAF7F6B7FFFCCD36F60AACFA4C7C196BD8F9F5A2C3765
SHA-512:	3831B40D1AD85CC157B763437F8804844F0DBA3F2CFC9C046E05A82FD0771F5C1CE6635123E0AB3FE9A49348D17F3C3E7CE81CC96D1F7ED6E2058A0545ECFCB2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V134..8450..8451..8458..8468..8469..8470..8473..8478..8484..8485..8488..8489..8492..8494..8495..8498..8499..8501..8505..8506..8508..8513..8517..8522..64288..64298..119808..119893..119894..119965..119966..119968..119970..119971..119973..119975..119977..119981..119982..119994..119995..119996..119997..120004..120005..120070..120071..120075..120077..120085..120086..120093..120094..120122..120123..120127..120128..120133..120134..120135..120138..120145..120146..120486..120488..120780..120782..120832..126

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Init.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	4.624595061773947
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7XhcYwUCQcznkefGwQLoLb9XrAaQHcsvfwqxWw:0z+XnEnMPCQcz1Gwmo/9bAZHvfTxf
MD5:	5DDCD329481DDCFA96040E269A5903D9
SHA1:	A4CB01073742E8C2D5DB3E6D61219EBD58CC5350
SHA-256:	A7666E229EDA0BE9F029D2EC2C3446BCE192F26B7E6FF0E3908EC0EA5EB11110
SHA-512:	F256E9D4BC046A464F77C2014122C8F2437C1FDE890A38EE1BE5DEE439017E4A655E4F5E1C45CF4B16BEC339E0D40249C9B03F9DEAC0E69D94F0E090BEE6FE30
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V150..64340..64341..64344..64345..64348..64349..64352..64353..64356..64357..64360..64361..64364..64365..64368..64369..64372..64373..64376..64377..64380..64381..64384..64385..64400..64401..64404..64405..64408..64409..64412..64413..64418..64419..64424..64425..64428..64429..64469..64470..64486..64487..64488..64489..64504..64505..64507..64508..64510..64511..64663..64735..64813..64820..64848..64849..64850..64856..64857..64858..64860..64862..64864..64866..64867..64868..64869..64870..64872..64873..64875..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Iso.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.4802780195398
Encrypted:	false
SSDEEP:	48:0z+XnEn3wFf3lOqsTKPU9MFFGSQ//rWM8gQ:0zoEn3IIeP3/GS2TW4Q
MD5:	D7BD91B8D86600A4B9784080223613B2
SHA1:	DD0E645B855252C2288912DEF5D58343DEDE1426
SHA-256:	85EAFC7C8AB7F8B0E19D849422F0B9EC3734C14A6A4DDCF7195DE23CD6FEAB7D
SHA-512:	6006FFA51E0D6F24C357125B6C85EF5EC38B051DB0ADF74DE7DC546EA10B255A4DC12062BD22CAFDE80F9E5B79140FEA450843920DB7969241B9260A214BE821
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V196..64336..64337..64338..64339..64342..64343..64346..64347..64350..64351..64354..64355..64358..64359..64362..64363..64366..64367..64370..64371..64374..64375..64378..64379..64382..64383..64386..64387..64388..64389..64390..64391..64392..64393..64394..64395..64396..64397..64398..64399..64402..64403..64406..64407..64410..64411..64414..64415..64416..64417..64420..64421..64422..64423..64426..64427..64430..64431..64432..64433..64467..64468..64471..64472..64473..64474..64475..64476..64477..64479..64480..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Med.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	4.782733038602476
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7lqboscM4sdiiwDK19R1AGoK3rkDoRt:0z+XnEnZsOiiwDQdA6rkDut
MD5:	43BD50F3CD8FDAEED72B24AE22B931B0
SHA1:	AE0E8960D2054B9FBADD1686B77BA1F3FBBD5F07
SHA-256:	75CAF8B3C2F582DC627FBC32F9B70C8AEB77CD573AB6E6C967A9991589BBF3BA
SHA-512:	EB65C1D827131F3793B95F1520AA1D178A50AB0CAC30EB92A444DCB2704AA42CF25FC2429AACAF38F956A24867AC7988908AE6685565CD162C6740CDF35C1526
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V108..64341..64342..64345..64346..64349..64350..64353..64354..64357..64358..64361..64362..64365..64366..64369..64370..64373..64374..64377..64378..64381..64382..64385..64386..64401..64402..64405..64406..64409..64410..64413..64414..64419..64420..64425..64426..64429..64430..64470..64471..64487..64488..64489..64490..64511..64512..64735..64757..64820..64828..65137..65138..65143..65144..65145..65146..65147..65148..65149..65150..65151..65152..65164..65165..65170..65171..65176..65177..65180..65181..65184..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Nar.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.113973665831543
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7v/8zrQ:002+XT731GRnXE7MHQ
MD5:	1230310A5E4A59FD1CE9759CE27F4A2A
SHA1:	8A012DC04558BF0713A790E2B454D50C12825621
SHA-256:	FB95F8F5DC00FAF1D3C5AA697BF76940EB3216A6C773E39E14289F8BCE0331DD
SHA-512:	59763166AA60482ADBF2E43CE6FC065D14A9F0B0BB2F429C143F8F5CB2C07E0DBDC1224FF993899A32681DCB06CE735F5477A3081AD40915454E1D2F931D88DA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..65377..65471..65474..65480..65482..65488..65490..65496..65498..65501..65512..65519..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Nb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	565
Entropy (8bit):	5.0571544595927
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74ogtFV:002+XT731GRnXE74ogTV
MD5:	CFE9A1629D992708245AECC773083604
SHA1:	55684E46F99308FBC8A2EFE342AB2D3613ECFF76
SHA-256:	4C64906A89EA7B8F1BACE839C611D4DBA1064365D89D73B36B7A413CFAF0E558
SHA-512:	85231F0B879AA260896B0B6FC0F8399FA76CBE08A2191A21A6AEA6FCDBA3DE839F725BF389985BC24439D6A2A3DC5C845B9CBC09BB090C967297C0AEFE52AA14
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..160..161..3852..3853..8199..8200..8209..8210..8239..8240..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\NonCanon.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3046
Entropy (8bit):	4.273829593288916
Encrypted:	false
SSDEEP:	48:0z+XnEnl4gmAdKwZiUPWPjR5lpxetxmkKaY2phHsv3+b5E3l40nLcQKJImEBl6R8:0zoEnl3mwKwwU+detxpWvkLg/a8
MD5:	0118B0333E98593B40D38036B78F81BE
SHA1:	77B82190645B0FBDFA1213108EFC67A070FBBFFA
SHA-256:	A5345A8DC62CFE7A7F5CE3E057988BCF309053DE7000D6EEC42F552651CD1FBE
SHA-512:	0B6529CE5032EDA9F0441C4A054B9C3F27F545F38049B44CC543C29B70FB0E60DDEC89EF0109A1DE9E8BE562FC821694D12FD554A15F37CBC03849B7FF39B1EF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V372..160..161..168..169..170..171..175..176..178..182..184..187..188..191..306..308..319..321..329..330..383..384..452..461..497..500..688..697..728..734..736..741..890..891..900..901..976..979..981..983..1008..1011..1012..1014..1017..1018..1415..1416..1653..1657..3635..3636..3763..3764..3804..3806..3852..3853..3959..3960..3961..3962..4348..4349..7468..7471..7472..7483..7484..7502..7503..7531..7544..7545..7579..7616..7834..7835..8125..8126..8127..8129..8190..8191..8194..8203..8209..8210..8215..821

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Sqr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	5.143336910866335
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7ShiWVgR/r:002+XT731GRnXE7oiSgNr
MD5:	2924C14BCD653E35E59965B315883161
SHA1:	7F7426BACFE704E53BAE5A5989F4FCA09360D72D
SHA-256:	48DFB3AC2B83BF391690C3E80D2D23F56C63041EC0C42857DABD1102BD151EA7
SHA-512:	00228B23FF90AB73720167702F4B4988712CEA7C43FEA546AE927998E186E2F7B2FE995C2814E1CD176E913B71C7D8C57FDFF583571F21557E32643DCE21A510
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..12880..12881..13004..13008..13056..13144..13169..13280..13311..13312..127280..127312..127376..127377..127488..127491..127504..127547..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Sub.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.048815601745512
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7a8WR2:002+XT731GRnXE7a8WR2
MD5:	604F0BE97C842A35D5B9D926EDAF7EA6
SHA1:	E8F73046DB1BD2C9561EBF565A1FC87B74E6AAEB
SHA-256:	87D8584D645B0996D73F6FFDB9F344B394E1C50CAFF45DF9CA2CFC27D8CAB6C6
SHA-512:	A48A8DDD25DCAC8FA235D0F89C8A0D480570B2D52647C37330EAC46A6BA3A533D39ECBFAC0267775EDC06A46730C567AFA0BB6AA7348EAE1DBD85D40E5AB1CDD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..7522..7531..8320..8335..8336..8349..11388..11389..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Sup.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	803
Entropy (8bit):	5.120843409946566
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7IQzp3RcuIDUVLyoCAgmS:002+XT731GRnXE7XphqDUVLyoXgmlA
MD5:	4F4520B1F6FA44E083C361616F433EC5
SHA1:	1CDD8AAC86090DA2E9D02A55AAD75398EB0974D0
SHA-256:	A7939D004068EC632AB6DC99CEC98630FCDA04FFF8B4A7C8FC729A45D639F030
SHA-512:	A0096ACCC8F3B45964D6B2BD0C3684001C54DD2F5E4B8C884A4319F344B128F6B1E3475AE58EEE57109EB45485FAFA58D2A56CE9E1A90F580AE2B595FAC5A647
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V48..170..171..178..180..185..187..688..697..736..741..4348..4349..7468..7471..7472..7483..7484..7502..7503..7522..7544..7545..7579..7616..8304..8306..8308..8320..8480..8481..8482..8483..11389..11390..11631..11632..12690..12704..42652..42654..42864..42865..43000..43002..43868..43872..127338..127340..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Dt\Vert.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.104088033111924
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP743tqVhkAE1yv:002+XT731GRnXE743tuhNAyv
MD5:	B07FE63174E24E0AFFEB10B581AFF72E
SHA1:	07A5A4A1D73877D22EA94F566675E8C52ADC21C7
SHA-256:	1C0966C600E4629C6414BDD0CE15881FB1B45B2D512E5170635C1D3EFFD9610E
SHA-512:	0C71EC71B7EBADA9BCBC11130689547500E4E0B5C5A6E511C320FF1407F5E0368E61CBD0EFABE4B3D8D176D9D3EEF7C04955AFC2F674BF95AE7EBEA2DA3B2270
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..12447..12448..12543..12544..65040..65050..65072..65093..65095..65097..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ea\A.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	4.352084603081327
Encrypted:	false
SSDEEP:	48:0z+XnEnF8BBb4DmTT16XR6KyGlqsdcfRrUxB9cNSxf/0Uh4:0zoEnKBBboETmZqs8wf9mSd0
MD5:	904EE802B05FBAF00E4F15A63433A114
SHA1:	507CBEF5BDD055F28D1A288F5BBD5017C1ABBA09
SHA-256:	1D75435FFD64688273EB8E52B1780AD3D95F6C9AB2E432770201DE545CEF3A7E
SHA-512:	815D282A69EF3B8CFEED40FCE0368B4BCBF4BBA2229ADDF88064304F263B314E1706F713FA69F3CC25A0CE3DAA9E0F39099F7D81D34B05E64FFA864D32E63320
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V346..161..162..164..165..167..169..170..171..173..175..176..181..182..187..188..192..198..199..208..209..215..217..222..226..230..231..232..235..236..238..240..241..242..244..247..251..252..253..254..255..257..258..273..274..275..276..283..284..294..296..299..300..305..308..312..313..319..323..324..325..328..332..333..334..338..340..358..360..363..364..462..463..464..465..466..467..468..469..470..471..472..473..474..475..476..477..593..594..609..610..708..709..711..712..713..716..717..718..720..72

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ea\H.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.129697637053849
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78FZR/8zrQ:002+XT731GRnXE78FZiHQ
MD5:	5F4DC165E3EEC275DC3C0D74B24E5287
SHA1:	366A9A880F827B65F32A3A956C9E9C01962119F3
SHA-256:	81E92546440D76F4F7A0F6FC79515788D7E63E0CF7B9C00E34D7C75D0D54409F
SHA-512:	099F5816ACDCC579EF4715A26A484F6C0044BAA6800786CD0251DB4E28BA9AFA5018167763D79D1EF435CD93A38DA1C9DE1451075F2DA242AD891FCF6F4B1B6B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..8361..8362..65377..65471..65474..65480..65482..65488..65490..65496..65498..65501..65512..65519..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ea\N.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3051
Entropy (8bit):	4.260412729013811
Encrypted:	false
SSDEEP:	48:0z+XnEn9vtD8BBb4DUTT16iR6KyGlqsdcfRryxB9cNSxf8fC0/MrKrVxphHxKH4:0zoEn4BBbomTvZqs8ef9mSKC0/MrKFKY
MD5:	9A8C8D937416A5CE10203315CE48E26D
SHA1:	287B2DB53633401FACABC0BA26A809F110CFBB5E
SHA-256:	5C7C96925CFDAF92EB4500CA82380387203437C38D623E71ACCDA409458B7E32
SHA-512:	FF448D22C1BE2E99C08B9D360AF17E6129673D2380650082AFF951BEF27D42EEABA49D64061DDDA6CCD22FA36EA92023FADD5E28D2F4842E69A6A3CA81737898
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V421..0..32..127..161..169..170..171..172..181..182..187..188..192..198..199..208..209..215..217..222..226..230..231..232..235..236..238..240..241..242..244..247..251..252..253..254..255..257..258..273..274..275..276..283..284..294..296..299..300..305..308..312..313..319..323..324..325..328..332..333..334..338..340..358..360..363..364..462..463..464..465..466..467..468..469..470..471..472..473..474..475..476..477..593..594..609..610..708..709..711..712..713..716..717..718..720..721..728..732..733..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ea\Na.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.0737906072491485
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Yg7+KoIov:002+XT731GRnXE7v7+Kgv
MD5:	0BE36B47E3A9AB0DA067DF4CE7F7D460
SHA1:	4F4096F8F9E46845C5A5CE9288D150B195C77723
SHA-256:	868D67A59EF5445080352015E5BB3E83AC5EF66D623AE5AB1D4E28C0C11FBA42
SHA-512:	89BCD3F3DE8CEEC9F5BD323EABA1C0C9BBB7DF7AED4FD3175966DF74D1C311C9F69DA6A7395185470E126690492E6AA94F1737F83A6EA4FFBA74F6B6E3F1D7C6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..32..127..162..164..165..167..172..173..175..176..10214..10222..10629..10631..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ea\W.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	979
Entropy (8bit):	5.034543974540544
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7NSC7TWsMX+psFro8hRJCHic:0z+XnEnwSCfMCKroF
MD5:	C44135318C06DD6ADA0806BED9F7D2EC
SHA1:	6612523085942F18B1423CF9F4A7790DD29EBC13
SHA-256:	54C2733B2BC4D939E7F06E91C17B4AF496418C45959156029CDB471884E30AB5
SHA-512:	2F084BA53ACE0227B5651E0BC4D5F496F706A9989E9B76F5BD5B8FE9DEFF56E194AAF0893DDD363DDD99CB71E8EEBD7B7DB9F4B8E76ABAC1522A9A1B21E653A0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V66..4352..4448..9001..9003..11904..11930..11931..12020..12032..12246..12272..12284..12289..12351..12353..12439..12441..12544..12549..12590..12593..12687..12688..12731..12736..12772..12784..12831..12832..12872..12880..13055..13056..19904..19968..42125..42128..42183..43360..43389..44032..55204..63744..64256..65040..65050..65072..65107..65108..65127..65128..65132..110592..110594..127488..127491..127504..127547..127552..127561..127568..127570..131072..196606..196608..262142..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ext\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	845
Entropy (8bit):	5.10456085924426
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7+TPF1FlWZM/03JmnLyGBya:0z+XnEnLTPF1FMy6YLb4a
MD5:	8C9D3F416FEB63F6CFB05E857A51BAD6
SHA1:	EA4625287507541FBC40E8F1CE076077668CA4D3
SHA-256:	63AFA458E549DD6E5F805B85E576E9A4F896547FAE4CD41A54F3EDB3CB1A83DF
SHA-512:	5674E9688FB633898AE9A38AFB613C714D06BEDBDF4923FDE4EA6F065DC14CBEAD8F4AE85BCD68FFD25CC1E8B260AC70A12B7D8AA621CFB4020AA08BB1795D5F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V52..183..184..720..722..1600..1601..2042..2043..3654..3655..3782..3783..6154..6155..6211..6212..6823..6824..7222..7223..7291..7292..12293..12294..12337..12342..12445..12447..12540..12543..40981..40982..42508..42509..43471..43472..43494..43495..43632..43633..43741..43742..43763..43765..65392..65393..70493..70494..71110..71113..92994..92996..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GCB\CN.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	778
Entropy (8bit):	5.1413943247789495
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7sQNQ3goL2nIPlssYeYez:002+XT731GRnXE7soXoLhlWeHzjGz0UQ
MD5:	E902A2C30A37BEE21DEA46C11535F9CE
SHA1:	4FDFC0E4EA99851EF245949FB8B21A0F0685DC36
SHA-256:	285878676C6EB2A051D2D1FE856B794AA9061705B0D1954228992B47D7C1BADC
SHA-512:	15FE1A57C5968B3FDBFA9C13764CA41D321293FD5EB1121FB6E1AED912A59D2ECC03D487E608E848AC22BC51AE2DC895349321A54B94959DA6889B9F23A928BD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V44..0..10..11..13..14..32..127..160..173..174..1536..1542..1564..1565..1757..1758..1807..1808..6158..6159..8203..8204..8206..8208..8232..8239..8288..8304..55296..57344..65279..65280..65520..65532..69821..69822..113824..113828..119155..119163..917504..917760..918000..921600..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GCB\EX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4164
Entropy (8bit):	4.1148896043071845
Encrypted:	false
SSDEEP:	96:0zoEnBap8FDiXzpNm+hDuVspCKl0LnR5w85rYw8tUNyc99eJEc:iZBm8FDiDpg+SscfbR5w8Otm9w
MD5:	4DEAF0E49517210CF98F9ECC21550C63
SHA1:	8128932B179FEDABA1B2F5559CAA174644FF71E7
SHA-256:	2521774CE91FC80BE5699CAD465D7646012E3776A4BDCBF706A98F8B8BFB2A2A
SHA-512:	382AFF63219913FF2B6E6DCB357F7C67882FAAE1E754B5526CD9E7C4159D34EE01B23575A78AE664CF1012E1119FF5C30F02019A424DF27B321772C4625DE91A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V566..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2307..2362..2363..2364..2365..2369..2377..2381..2382..2385..2392..2402..2404..2433..2434..2492..2493..2494..2495..2497..2501..2509..2510..2519..2520..2530..2532..2561..2563..2620..2621..2625..2627..2631..2633..2635..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GCB\LV.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6094
Entropy (8bit):	3.9257054432669456
Encrypted:	false
SSDEEP:	96:0zoEnLKROqMRwJZjGzwPTYL7a75faPgsB5oAYcX+YbvrP4c6JS0dNz:iZLmOwV6OYkigsoYyJPB
MD5:	BBFE9D4EC99C795F6B1F0E821337E69A
SHA1:	BF5B794B5675884C551FD146CE917F63CFE5ECD5
SHA-256:	6CDEEC6445DE52362B02D2CFAF7DDBC7BD591F01B34DFF7AD68DC1487AB7E429
SHA-512:	7C88C1848B2E07A28485333A9D7DF317B40026234E6E05DD2F987692F561EB4868187933EB74F2BCF06E8F8C33EB4FA4977B33DECEA2B0A3102DA790AF316873
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V798..44032..44033..44060..44061..44088..44089..44116..44117..44144..44145..44172..44173..44200..44201..44228..44229..44256..44257..44284..44285..44312..44313..44340..44341..44368..44369..44396..44397..44424..44425..44452..44453..44480..44481..44508..44509..44536..44537..44564..44565..44592..44593..44620..44621..44648..44649..44676..44677..44704..44705..44732..44733..44760..44761..44788..44789..44816..44817..44844..44845..44872..44873..44900..44901..44928..44929..44956..44957..44984..44985..45012..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GCB\LVT.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6094
Entropy (8bit):	3.925552966387216
Encrypted:	false
SSDEEP:	96:0zoEnbKROqMRwJZjGzwPTYL7a75faPgsB5oAYcX+YbvrP4c6JS0dNu:iZbmOwV6OYkigsoYyJPg
MD5:	D4BAFBF7864E4C818CB9BB28A23CF0E1
SHA1:	A2E4B6B42E9EDB822B30B9C10B9A0DDE6DBA66AB
SHA-256:	D231FA852B0ACB9267C500C81E573F7C9C945C1DFA280D17AED211070AB52E06
SHA-512:	2EE9822FD56C0AF4D4A497021B9FF0F2B1D26794BC4A9A455EB26714D3CD0F74B9927E8995D94CAABC86E6610764498228E5794BDE68AF5C51021C0874188728
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V798..44033..44060..44061..44088..44089..44116..44117..44144..44145..44172..44173..44200..44201..44228..44229..44256..44257..44284..44285..44312..44313..44340..44341..44368..44369..44396..44397..44424..44425..44452..44453..44480..44481..44508..44509..44536..44537..44564..44565..44592..44593..44620..44621..44648..44649..44676..44677..44704..44705..44732..44733..44760..44761..44788..44789..44816..44817..44844..44845..44872..44873..44900..44901..44928..44929..44956..44957..44984..44985..45012..45013..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GCB\SM.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2210
Entropy (8bit):	4.4602512020321985
Encrypted:	false
SSDEEP:	48:0z+XnEnssJ2F5XaBIdP4Tm3lQuQvQ3pb7OhTtFoHQ:0zoEnHJ2FFa04YlQuQepuTtqHQ
MD5:	412925B5E8FF7A6AA9B1F97274C9CDDF
SHA1:	FBD93171649DBE9D78043B38EDA80D94F5B72C43
SHA-256:	B3AA26D4C11B475C3D77677A3ED4977D93989BCE1FA19A264ECD59F046D78877
SHA-512:	E6B8933770C5A5F5F67EC55BE12E924F6A63BE4BA1355C5BF0AEFD59F851C5EAF3EBDB4163E5533432CBF1793EF599E87A48B5367FBA91BE22B7467A8592E6AE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V264..2307..2308..2363..2364..2366..2369..2377..2381..2382..2384..2434..2436..2495..2497..2503..2505..2507..2509..2563..2564..2622..2625..2691..2692..2750..2753..2761..2762..2763..2765..2818..2820..2880..2881..2887..2889..2891..2893..3007..3008..3009..3011..3014..3017..3018..3021..3073..3076..3137..3141..3202..3204..3262..3263..3264..3266..3267..3269..3271..3273..3274..3276..3330..3332..3391..3393..3398..3401..3402..3405..3458..3460..3536..3538..3544..3551..3570..3572..3635..3636..3763..3764..3902.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GCB\XX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3828
Entropy (8bit):	4.159479391544316
Encrypted:	false
SSDEEP:	96:0zoEnlhUUjQviXMzlvoiMfdrDq8VspCQLY2ecs26whsvN9eJEK:iZlhdjQvi8zlvm1pscQ0djJ1NO
MD5:	6A94DD7EBABB1FF287CDD541BF982DF9
SHA1:	AE5D65DA25E20F6EC166672C813D961BCD6F4032
SHA-256:	E06E2920322EE200F9725C6AE09F79B1D92EB96B53ACA4003EF6F89B448B1DAA
SHA-512:	827A9F5B1BAC8E460F3BF94755F74029DE3A048291F78EF841AC9A5BDAF0D056D40A02CFBDB372586688D264A869DD95AAFE73F3AAD09B3E38AB8AF793B88CF5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V515..32..127..160..173..174..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1536..1542..1552..1563..1564..1565..1611..1632..1648..1649..1750..1758..1759..1765..1767..1769..1770..1774..1807..1808..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2308..2362..2365..2366..2384..2385..2392..2402..2404..2433..2436..2492..2493..2494..2501..2503..2505..2507..2510..2519..2520..2530..2532..2561..2564..2620..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\C.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8777
Entropy (8bit):	3.853363446710565
Encrypted:	false
SSDEEP:	192:iZa1jWErjvipBLaxabMftr+w//DvC0YuQPIeilGahBA8+ALMCd:iZa1K2j6pBLaxabMVr+w/u0z4Ieil/gI
MD5:	4DA9BF26EB30F721A6455D157140A186
SHA1:	4C4F3F53950F2E06C0A74E996814044093F51FD6
SHA-256:	CED821BC2FC4AB50CBF445A24DCCE4FA73B0B38F1A39A27DD7E775F85452F1EB
SHA-512:	F029F37FD1620D4EF72B62F6970B45125983BB1DAB2132DA6AB4B4CC68B26816C0A5C92360DB62D7C380CF41AC0192127E16E0792396688FC3781A800BC83608
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1231..0..32..127..160..173..174..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1542..1564..1566..1757..1758..1806..1808..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Cf.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.168718366590287
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MDnIPlYO/eQQC1hU6Gz4:002+XT731GRnXE77lYOjzjGzQaM
MD5:	315DDA0F66E6BA17979EE64AE50D8D78
SHA1:	963DDEC5514F3FEFA50BC3F3C7AAFA8F23B5CDB2
SHA-256:	96A0DAF2468E53EDFB13FF4E6382B0D44D6B6023B54738F6B43A4841F046B2F7
SHA-512:	87B8A2B73FA25A4CB720F3EB8FA4A2AFF919DE8BBA91824A4E2937DCD186A98DA78152D9E96DF9E778453BE5ADB48A4B099A9467A69071D5181E2D03E819C4A7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V34..173..174..1536..1542..1564..1565..1757..1758..1807..1808..6158..6159..8203..8208..8234..8239..8288..8293..8294..8304..65279..65280..65529..65532..69821..69822..113824..113828..119155..119163..917505..917506..917536..917632..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Cn.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8765
Entropy (8bit):	3.855444797125616
Encrypted:	false
SSDEEP:	192:iZ4VjWErjvipBLaxabMftr+wk/DvC0YuQCIeilFahBA8ZALMC3e:iZ8K2j6pBLaxabMVr+wku0zRIeili7nZ
MD5:	6ED17EFA2C0CE064E7654BB118DB9BE3
SHA1:	5E0DE8524EC2E5D27AD5B51C81A26AEC92FED7BC
SHA-256:	49E4577EC9C3BE0F4EA12ADE6A394280CE8EAE389B12A4EDC5DEC9B9EAD79D90
SHA-512:	F9F23E5104537DE14A83F501A5F60234C025FBAA1F05E186609F554D60FEEE3CB7E14872831786A1A5F09DC08BF051079C54B3373D93BCFF5623E314AFC547AC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1225..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602..26

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\L.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7841
Entropy (8bit):	3.8879486055023578
Encrypted:	false
SSDEEP:	192:iZzLpqTXlkKo+wtxx//Z8V0N9ZClWOc5TS5a/qbLMs:iZzlIXlkKfw5Y0vZClWOeg+Zs
MD5:	363205B65A71CFEDF6237692BC83F09F
SHA1:	1BC8491ADE9028F87DCBCEA034AC4C8A1521427C
SHA-256:	E0A622100DF1A8ADD2512F2D95B7C492D78CE461408C09C73C31F599DDA87B33
SHA-512:	36B0AAAAD67A5B0BAF27B7829E439DE5D704CC0596AFAC28DA5BC0E1D51CA476F1A5CA5A442FE6EEB9C04C139CB81D68C36EE06B80DFDAD887D82DD075C42A32
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1108..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..880..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1488..1515..1520..1523..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074..2075..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\LC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	4.48110522146375
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7NEtPYtfRfpr68vW44R56qgQuCXH0ACX9ZD+M1ScpCv3u1Grnh:0z+XnEnmYK57u7R5RBlCXr5wzv3+H3ro
MD5:	814A3B76BFCFF27EA94A83FD6CBE7DB7
SHA1:	E965837F5C90E3D682A62633DCC02D622F74D77A
SHA-256:	F511BCBF7A6942CF14392D752FD24675F00B0F58F70831650A47E365759DE928
SHA-512:	C37785CCD5F1A60FD28592C8D33363E8A95BEDB90F7DBDAA8EA8274B096D075AD3913138D8731810751D4AE20F9D73C85B8F655001CC43DCA19A3B9BE5F1A182
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V244..65..91..97..123..181..182..192..215..216..247..248..443..444..448..452..660..661..688..880..884..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1377..1416..4256..4294..4295..4296..4301..4302..5024..5110..5112..5118..7424..7468..7531..7544..7545..7579..7680..7958..7960..7966..7968..8006..8008..8014..8016..8024..8025..8026..8027..8028..8029..8030..8031..8062..8064..8117..8118..8125..8126..8127..8130..8133..8134..8141..8144..8

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Ll.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8205
Entropy (8bit):	3.810710036504924
Encrypted:	false
SSDEEP:	192:iZ11lYkjEWnyQH5Z4+BTp45rVB3VtkDiR13e0gpP:iZ11CgJtTKVSD+1uB
MD5:	01DE2B2B88382EBFAF990D834E5D5969
SHA1:	A4D2745AD0A1311233DC124275521064990A21BC
SHA-256:	A9EAE6B636B09C254A59478245BC83587490B22789BB6D5CDE8601C894C89864
SHA-512:	60256910C6D2963D7B18301BD12AC43706DD65E833030086C4B386B85DDD6957D5FA786B362542AF79034B15BACBE8CC73BC772CCBE6BA94E82E347526C98445
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1260..97..123..181..182..223..247..248..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..35

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Lm.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1220
Entropy (8bit):	4.880372402805872
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7fefZ0QFCyO8lWQZYVDUV9XiWRfgL+i03JhkN0nLyqmw:0z+XnEn3DFCyVMQGhM9SIG+LRmw
MD5:	9EA205C0CD7F0E3FCFC53F7D5135D62C
SHA1:	363B8D7063CFFBBB9B8BCCCBD3F9C97CE53335B4
SHA-256:	1F546075CC1BEE90F4F1F0610281782AADD250EE143927CF9579B83C6622BAE8
SHA-512:	1479E2806E7BA8C422829C18BDF2DED9CD108DE016EB9AFF69E007ADCE25982A0A7ECE1F5E454065D7858A66D4B5E26B60DA5F030561D3DEFBD5BDD741F2E4E8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V112..688..706..710..722..736..741..748..749..750..751..884..885..890..891..1369..1370..1600..1601..1765..1767..2036..2038..2042..2043..2074..2075..2084..2085..2088..2089..2417..2418..3654..3655..3782..3783..4348..4349..6103..6104..6211..6212..6823..6824..7288..7294..7468..7531..7544..7545..7579..7616..8305..8306..8319..8320..8336..8349..11388..11390..11631..11632..11823..11824..12293..12294..12337..12342..12347..12348..12445..12447..12540..12543..40981..40982..42232..42238..42508..42509..42623..42

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Lo.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6258
Entropy (8bit):	3.9596665110753646
Encrypted:	false
SSDEEP:	192:iZA5HqTXlk1DFvTtKS/jjzUY/jClWOy5TS5ELMs:iZ4HIXlk1DpTHrUMjClWOsgjs
MD5:	DB64629B1B72ECACFACA26B902170621
SHA1:	EB6B5A58B9C835B6EBF184FEF014E8253BECC4AA
SHA-256:	8027D616416EC99278DE812E50950DD585B20AE8D4BD3F61B55A69D7E773E73D
SHA-512:	709D8BA675BFBEC7DC02CE6B971B813BF1ABBE3A2BC9DC67AF7F5A71B54280BDFC801743CCC4D2772C3F67BA45D8AA673ADBB8514806766A51DEB303B873B27D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V866..170..171..186..187..443..444..448..452..660..661..1488..1515..1520..1523..1568..1600..1601..1611..1646..1648..1649..1748..1749..1750..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2048..2070..2112..2137..2208..2229..2308..2362..2365..2366..2384..2385..2392..2402..2418..2433..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2493..2494..2510..2511..2524..2526..2527..2530..2544..2546..2565..2571..2575..2577..2579..2601..260

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Lu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8133
Entropy (8bit):	3.813077947635104
Encrypted:	false
SSDEEP:	192:iZvmBlzvjEFnyQH3Z4+BTp45rVdL80thDiZ33fpE9u:iZvmB9L+TTKVHDC3B5
MD5:	9C8B8142CFE528056CF3C4B34B82A102
SHA1:	DC09A519A1CC0BCAC2DC34123277646ED1CC0DC2
SHA-256:	0AFEDD4A28DDFD09E056BCC22E9E92FA431179073EBFE2F0971D695DBC5835B0
SHA-512:	4B62B4B679877F27BE25F19372CEE524B7404BA2833DA6B3C57E85036DB7645F550E9356A9F403A19859C58D293CCE3844C9C5083A228A6076C13A3CB6BC1E0A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1250..65..91..192..215..216..223..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..350..351

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\M.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3554
Entropy (8bit):	4.19293824634552
Encrypted:	false
SSDEEP:	96:0zoEnbUUjQviXMzlvX+LJdrDAVspCtLwI26whsru9eJEc:iZbdjQvi8zlvXomsctsIJpuw
MD5:	7CA186C76AC96D67510E5F907C06429C
SHA1:	4D1A1E16D6B39A409644378D0C63BC1527C2C149
SHA-256:	7F8A06AB07950E7D8206A4E50B739FD17F54C38F6EB7574747750AE87A10D1EF
SHA-512:	5B1EF726F7D9893489263F3FDC94DC1FBE70500B70DFFD784F1B8470E04BE702D6245962D956D08DACD37A5236705D967D9368C9079655F3F764E3470425CAF1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V472..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2308..2362..2365..2366..2384..2385..2392..2402..2404..2433..2436..2492..2493..2494..2501..2503..2505..2507..2510..2519..2520..2530..2532..2561..2564..2620..2621..2622..2627..2631..2633..2635..2638..2641..2642..2672..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Mc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2396
Entropy (8bit):	4.407899143501473
Encrypted:	false
SSDEEP:	48:0z+XnEnTTJU0n2umTeIdP4Nm3lQmQvQ3mb7OEZroo4J:0zoEnnJUg2ZTZ4OlQmQemnZrP4J
MD5:	16F7F3896D63739875A0874AAA0BBF0F
SHA1:	7843AF714CE18E43129F2010357D14EF1438315F
SHA-256:	9028244CED33EDC365EA1B1E6702D4B34E890B19BE052CB4569F1250717530F8
SHA-512:	B60BDF9CD261CF2B241B0785D78BDE097833171A41324F26226988480858F6A9A22F947D976F1D99725C7094286CDEF6860B8652CCAB2FE64565F2097853FF77
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V294..2307..2308..2363..2364..2366..2369..2377..2381..2382..2384..2434..2436..2494..2497..2503..2505..2507..2509..2519..2520..2563..2564..2622..2625..2691..2692..2750..2753..2761..2762..2763..2765..2818..2820..2878..2879..2880..2881..2887..2889..2891..2893..2903..2904..3006..3008..3009..3011..3014..3017..3018..3021..3031..3032..3073..3076..3137..3141..3202..3204..3262..3263..3264..3269..3271..3273..3274..3276..3285..3287..3330..3332..3390..3393..3398..3401..3402..3405..3415..3416..3458..3460..3535.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Me.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	569
Entropy (8bit):	5.054280948777089
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74KEpRd6xPov:002+XT731GRnXE74tfd8Pov
MD5:	142D03BA72D549396BA1951C323F4888
SHA1:	6BEE87CDC8BAC27DDB7ADD2812AA4F103223DFB8
SHA-256:	113C3886C58895753CD74EA92B5427A897E0E55C063ACF65434AA055094BDB96
SHA-512:	B85A54651281750A6AD9E3F53D75CECEF124CC655EB733FF0A9F2BDC037E37551235B31A1C7A31E5342FA3F52454C1E776BB550F0D4E600FD449C202679310BE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..1160..1162..6846..6847..8413..8417..8418..8421..42608..42611..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Mn.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	4.1398086127948215
Encrypted:	false
SSDEEP:	96:0zoEnyV8cDiXmCNmlhD4RspCKl0LnRL85YBdNye9eJEc:iZyV8cDi2CglcscfbRL8uDw
MD5:	2159902C933367C3D34806EEA12F3D87
SHA1:	B3445BCF6A53DD6D6C886753F4318483FF26A853
SHA-256:	30064415C729539B88E983E3F77281E7CB74A4F29E30F74738AB08E48822F19A
SHA-512:	65D3DEE91EBAED0B7C4474F745697F54F3F6D94C7203D20E4EB23CAE14AA569C2B2AC38BD0B9358273C3FFA8794384C16077814464CA20B3E1161E374BB68553
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V532..768..880..1155..1160..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2307..2362..2363..2364..2365..2369..2377..2381..2382..2385..2392..2402..2404..2433..2434..2492..2493..2497..2501..2509..2510..2530..2532..2561..2563..2620..2621..2625..2627..2631..2633..2635..2638..2641..2642..2672..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\N.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.551579790805724
Encrypted:	false
SSDEEP:	48:0z+XnEnSic5Zt3FV51Kn4+Ci0pXvpnfrg5yF:0zoEnSXnmnR0pXhzg5yF
MD5:	92E3016686BD5D5B3BE94D434F8346A8
SHA1:	D3BF9BEE528A03945AD609170121422EE301761A
SHA-256:	1F3AAD9A4E5FC02DC636BE532041CCC64726EAF0D42F42A323EA99542337F641
SHA-512:	DA83D10E1CA5C2E13A25680F9847D2640ECBD2C727B002A9D3A355E072B5EDE98B09514A6754A9B253AD70546CB3CC566538E4936A41E11B0808C9C4B9301548
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V222..48..58..178..180..185..186..188..191..1632..1642..1776..1786..1984..1994..2406..2416..2534..2544..2548..2554..2662..2672..2790..2800..2918..2928..2930..2936..3046..3059..3174..3184..3192..3199..3302..3312..3430..3446..3558..3568..3664..3674..3792..3802..3872..3892..4160..4170..4240..4250..4969..4989..5870..5873..6112..6122..6128..6138..6160..6170..6470..6480..6608..6619..6784..6794..6800..6810..6992..7002..7088..7098..7232..7242..7248..7258..8304..8305..8308..8314..8320..8330..8528..8579..858

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Nd.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1162
Entropy (8bit):	4.916191042364303
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7Ouc3g7+dy3O2ezqa/mctVdg4Pa+7Q:0z+XnEnOcG53irg4vQ
MD5:	3C30E8624E0D64C6A57D42749B1AD371
SHA1:	032ACDDED9E0CCD2B769BACEC80975064AC00C4A
SHA-256:	E3CB5D75A6BF9E9D73BD9BFACBFB7EC787E05F3F13C9554C311735D34CA5B1EA
SHA-512:	A79CF5D4C521728110EB7034533F8B2E6A27DCBCF01CD9C7CF59E054817DFF08428CABA8BDC4E25F776BB3259242BD0C2DB1AF961A2A03975E85620AA9A1823A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V102..48..58..1632..1642..1776..1786..1984..1994..2406..2416..2534..2544..2662..2672..2790..2800..2918..2928..3046..3056..3174..3184..3302..3312..3430..3440..3558..3568..3664..3674..3792..3802..3872..3882..4160..4170..4240..4250..6112..6122..6160..6170..6470..6480..6608..6618..6784..6794..6800..6810..6992..7002..7088..7098..7232..7242..7248..7258..42528..42538..43216..43226..43264..43274..43472..43482..43504..43514..43600..43610..44016..44026..65296..65306..66720..66730..69734..69744..69872..69882.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Nl.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	669
Entropy (8bit):	5.181737419459536
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7DkCvQSBlRHGyF7xfW1pv:002+XT731GRnXE7iSvRHnF7GB
MD5:	5D34AFF94F77ED68A0A4E8A9F97F16ED
SHA1:	25FFB9FD5A2BB1239BC599FB9466BFC2F40B4B38
SHA-256:	DF8BF1859B56CC9824E1B83E477EEFD6D099B01EC20A5983BAE5573294885639
SHA-512:	E0E136A753DEC629A37476502BF800853F3185CC9DDFF89EEAACF341EE02853EA8C62A6A72438C1C62280DA0C2D7A4BCFB3A83B88B982DBF5753103816BDFB11
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V24..5870..5873..8544..8579..8581..8585..12295..12296..12321..12330..12344..12347..42726..42736..65856..65909..66369..66370..66378..66379..66513..66518..74752..74863..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\No.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	4.854642625631657
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7XtfwmhQ2JnGfHXrrmpH3igp4MoBo0U2w:0z+XnEnQfh5JncfmpXvpnoBoF
MD5:	CFEA34DEA659BC23AF188579C1FB43D2
SHA1:	6322267271A37A414D5B9CD10BCD97A5A6BED68F
SHA-256:	2D201A83692AE8A923066DC4931500780E21E68F0E672C55C257FF57C10468AF
SHA-512:	4268DCD5485ECBFB9D1E7445E95E3CD883031DC5F4E1B3EBF0EE9B30806D8AFFC6B602770C27002025BBE191253C3E5F106524654D3E4261D48E479C4FBE3EBB
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V116..178..180..185..186..188..191..2548..2554..2930..2936..3056..3059..3192..3199..3440..3446..3882..3892..4969..4989..6128..6138..6618..6619..8304..8305..8308..8314..8320..8330..8528..8544..8585..8586..9312..9372..9450..9472..10102..10132..11517..11518..12690..12694..12832..12842..12872..12880..12881..12896..12928..12938..12977..12992..43056..43062..65799..65844..65909..65913..65930..65932..66273..66300..66336..66340..67672..67680..67705..67712..67751..67760..67835..67840..67862..67868..68028..68

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\P.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	4.378820073370172
Encrypted:	false
SSDEEP:	48:0z+XnEnAhhewgKhoBYsFuPh/N3icWr1Avs9YbwZ0K10MjxGZiO:0zoEnAXwKW2PnicAb9YkZMM1Gf
MD5:	77B870627C6279022269A1D30005106C
SHA1:	EA6ED33D352D7EBE4DEAC182EEC198B5DE249164
SHA-256:	E86F1D714B42862AB3BF1C641FBA864B792A91C908DCA9CCC34AAEFB2F8B34BF
SHA-512:	EE402238EBFE0B6098A2E9987152D63C3DCEA6434919741F4DAF2E2A55F6D77B57733125C929CF85D686C13757299DD569D927F4BE6D32075C93703BBFBC2D0F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V322..33..36..37..43..44..48..58..60..63..65..91..94..95..96..123..124..125..126..161..162..167..168..171..172..182..184..187..188..191..192..894..895..903..904..1370..1376..1417..1419..1470..1471..1472..1473..1475..1476..1478..1479..1523..1525..1545..1547..1548..1550..1563..1564..1566..1568..1642..1646..1748..1749..1792..1806..2039..2042..2096..2111..2142..2143..2404..2406..2416..2417..2800..2801..3572..3573..3663..3664..3674..3676..3844..3859..3860..3861..3898..3902..3973..3974..4048..4053..4057.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Pd.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.136798222160988
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MwHQioEoqaoDWfzovTUP:002+XT731GRnXE79oEoqa6W8vTU36G
MD5:	DC8B0BB6F481DBD45A1E0CEB62F10F53
SHA1:	FD5B73EFF5BABBE2696B42231C8D0B4C4C59C619
SHA-256:	E98461F62F519ABC622BE44436E7D8CBDCC04E55CE046D7987388A9302DF580A
SHA-512:	44301C5693B7987B04990425AEB916DE43EB2CBBC380A7B67F1D429F73835F361BF3F00DB1F94D1A6ABF49A148617752E92A78001B105E17D7421F774B44A685
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V34..45..46..1418..1419..1470..1471..5120..5121..6150..6151..8208..8214..11799..11800..11802..11803..11834..11836..11840..11841..12316..12317..12336..12337..12448..12449..65073..65075..65112..65113..65123..65124..65293..65294..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Pe.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.700365175306364
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE70Y34payRygdz8UFxtxmyyl4HLW5yL+Fe5:0z+XnEnf24payRyHWvjW4uFi
MD5:	80B175404ECA6BA7554A962A6AD483EA
SHA1:	F82BA472FE91B94044C90865BF2107D7A958FF61
SHA-256:	507E1244FF22EF913D59846D6D7623CAC44EBA2C4B7ABA4617E0ADAC5CD3D2CC
SHA-512:	165887118CD17CA67D208834A72CF0134D9E4CF1B8C2AD8D82DB4B7AFDD14A3FAED49D45EAEC86D0FEA6CEEFDA595815759751E3AB92EC52692E7FC303A12CAA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V144..41..42..93..94..125..126..3899..3900..3901..3902..5788..5789..8262..8263..8318..8319..8334..8335..8969..8970..8971..8972..9002..9003..10089..10090..10091..10092..10093..10094..10095..10096..10097..10098..10099..10100..10101..10102..10182..10183..10215..10216..10217..10218..10219..10220..10221..10222..10223..10224..10628..10629..10630..10631..10632..10633..10634..10635..10636..10637..10638..10639..10640..10641..10642..10643..10644..10645..10646..10647..10648..10649..10713..10714..10715..10716.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Pf.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	5.065423623504478
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HwyUAMdbruyoNxB:002+XT731GRnXE7HwHAMx7uxB
MD5:	34779531AF9B32D9CA9298E688362190
SHA1:	A972C8984EC32D29A36F160869F0968FE97FA7EB
SHA-256:	D1D5042789D0A9ECD7B58E92E28739303F2E8F19E1D9A7B2B670131F1107CEE1
SHA-512:	3E08B3F56F97F63102B549B6D2C699AB151E3451DE081B915ADBFDE2E559BCDFB1C56B13AB63992A2F1C48AFDD3EF206988347070E998E2053AF80F40353E948
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..187..188..8217..8218..8221..8222..8250..8251..11779..11780..11781..11782..11786..11787..11789..11790..11805..11806..11809..11810..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Pi.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	649
Entropy (8bit):	5.091362781906525
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7c8tRUmdru2eGE/:002+XT731GRnXE7pgmd0GO
MD5:	91861CAB5C3798877E30D6DABF9F63BD
SHA1:	5C52B8B49BEB3DD13957C42C4D35606AD9669591
SHA-256:	595A26B1985C932A304932888EECF44680B0318EC91A4E300B914D207D52EB5F
SHA-512:	5CFCBFACD0B65A1B4E0CC3FC7EC64A8C6EC5CAEA6C7C0DCD709C7AD511AC3A9E993706B2AAA0A933283647385D0C5E6B2F44CB9841B532860C0CB916F044A891
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V22..171..172..8216..8217..8219..8221..8223..8224..8249..8250..11778..11779..11780..11781..11785..11786..11788..11789..11804..11805..11808..11809..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Po.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2528
Entropy (8bit):	4.389462437760917
Encrypted:	false
SSDEEP:	48:0z+XnEnR3IoSTYsFuP1M3Wopc7yqd9YbwfFFKcchMjxGZiO:0zoEnR22POxc7J9YktahM1Gf
MD5:	205C8DC5063C6D3E5037C2C00AD2E784
SHA1:	B867FCEE7E9EFD42CA15835B20D1AE5EF27F137E
SHA-256:	EA9B01D1C3FE75E8C0BFAFFF88CDF629632F4D193EEFBE3C07635D43B23FC8F8
SHA-512:	3E7C36ADE8B240D8621E8516B1963986E4D2BC16BAF48D9105A47A3752EA933791E1B88AB87BA80DD8227CC6FABBAFE5DC304A45B9FF111C023AF4B0E490CB69
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V314..33..36..37..40..42..43..44..45..46..48..58..60..63..65..92..93..161..162..167..168..182..184..191..192..894..895..903..904..1370..1376..1417..1418..1472..1473..1475..1476..1478..1479..1523..1525..1545..1547..1548..1550..1563..1564..1566..1568..1642..1646..1748..1749..1792..1806..2039..2042..2096..2111..2142..2143..2404..2406..2416..2417..2800..2801..3572..3573..3663..3664..3674..3676..3844..3859..3860..3861..3973..3974..4048..4053..4057..4059..4170..4176..4347..4348..4960..4969..5741..5743..5

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Ps.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	4.680818562805634
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7eZlbbe34ZrRBXgdzYUsytxLyCHLKvjSV9c/:0z+XnEn9ZF84ZrRBX3g5X2Cc/
MD5:	5AC8BD13A77D0FD0D09CD76B123CFF2A
SHA1:	4B2A07FA4FB33AF3EB101293D5F770A9D4DF19A4
SHA-256:	86545B5E2C1615820174CE0D764F2DA03D859D1B50BD52DE74D849DAA910C789
SHA-512:	F44CE048493E7AFE9BB630E86C97615B317B17489C7D419ADC3E2AE8CDB7C3E85974313D27E8527F2818E3C9F719DE301D252040DAEFB97895B145DC0BFF4F34
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V150..40..41..91..92..123..124..3898..3899..3900..3901..5787..5788..8218..8219..8222..8223..8261..8262..8317..8318..8333..8334..8968..8969..8970..8971..9001..9002..10088..10089..10090..10091..10092..10093..10094..10095..10096..10097..10098..10099..10100..10101..10181..10182..10214..10215..10216..10217..10218..10219..10220..10221..10222..10223..10627..10628..10629..10630..10631..10632..10633..10634..10635..10636..10637..10638..10639..10640..10641..10642..10643..10644..10645..10646..10647..10648..107

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\S.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	4.207652712397574
Encrypted:	false
SSDEEP:	48:0z+XnEnihmCGH8GVqNwSyMFqqs4eRxB+vCQYrm2FzxfKwAiphHscP++ICs+NIyON:0zoEnihGqJzCQim2FdKcCONCe32ubnI
MD5:	11D8D49453529B31E383A4D2B426C0EA
SHA1:	BDF7206433DB118CE26F2F2C68CDAF3A05571F0D
SHA-256:	A1EF0394879E219516BE2FAB6A86F1063D90B3BB8C32AAE9502FB55FC37ABF01
SHA-512:	A439EB7F9116271F957AADAFF3DAE7C66D4760A6796B745F2110A0C36EEB33D944AB85EDED069B94327537A739F9860C56661BC32C621A6647077E002CB597A2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V428..36..37..43..44..60..63..94..95..96..97..124..125..126..127..162..167..168..170..172..173..174..178..180..181..184..185..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..900..902..1014..1015..1154..1155..1421..1424..1542..1545..1547..1548..1550..1552..1758..1759..1769..1770..1789..1791..2038..2039..2546..2548..2554..2556..2801..2802..2928..2929..3059..3067..3199..3200..3449..3450..3647..3648..3841..3844..3859..3860..3861..3864..3866..3872..3892..3893..3894..3895.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Sc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	717
Entropy (8bit):	5.136725643433011
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MqpqbaKkWGKvP6tua3mm:002+XT731GRnXE7zqg5RjKAUyuov
MD5:	C0C19C0D4E045D9B4E8F0FCFE779FBF3
SHA1:	8CC9DB9B80C583D5FAE2E970A92E61D945646E04
SHA-256:	730C0ADA55A0172C6D8A894FA554A9B231DD1D39CDEA4309B6E75EA6D90193D6
SHA-512:	DF2377CFFDD6B6C73829DC4CC65839D6D9D2663583B174A4C4176E9B8BC7E5000E796A383EC91088D8BDA831E3EB921CB7495E0CE5C1F77C849EB431AB8E879E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V34..36..37..162..166..1423..1424..1547..1548..2546..2548..2555..2556..2801..2802..3065..3066..3647..3648..6107..6108..8352..8383..43064..43065..65020..65021..65129..65130..65284..65285..65504..65506..65509..65511..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Sk.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.097289762958154
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7gociyGW41eE5hgXoQXf4:002+XT731GRnXE7tcGWCeE5hgHPks8Ow
MD5:	8CCC672A55234C2D061E5ED253C2071C
SHA1:	592A18A54080A9AB137FF2DE32FDAA54F379A347
SHA-256:	11E11B7508D0F86FA6DA7D8E5423BE52CBE11C58F0238C396606C4D5353C5975
SHA-512:	4D4E9E509D0DCBD9A355E819F7CB9C7BBEA29BC5B757015B8B6BB550FD3281E9266870D1749CEA5E19369E2223B93EF052B27329B2E63F7BE232E1F0AC65FE08
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V58..94..95..96..97..168..169..175..176..180..181..184..185..706..710..722..736..741..748..749..750..751..768..885..886..900..902..8125..8126..8127..8130..8141..8144..8157..8160..8173..8176..8189..8191..12443..12445..42752..42775..42784..42786..42889..42891..43867..43868..64434..64450..65342..65343..65344..65345..65507..65508..127995..128000..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Sm.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	4.810788274657686
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7QChGHS44j2ddj5zX6+6pBauwHE/9es3coF7TL:0z+XnEnPwGHhTddV76DBau11T3rn
MD5:	CD90AF3CDAA0E4ED483D3E56CBE5CB02
SHA1:	991675544D07CD385AA84E067D9090E9E015F029
SHA-256:	CF55C54360D4090AAF91D4BBEF148C507ED523E07DA51DDF777A5F0E54D60AC3
SHA-512:	72AF91018A3898C6349AD1DF4399A59A0A71DEF253CA80757E1B69621D899B78C33A81EA1B4A6E141C4B93C3A966DC249764D5D7453441B26C044D6D02B4BF7E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V128..43..44..60..63..124..125..126..127..172..173..177..178..215..216..247..248..1014..1015..1542..1545..8260..8261..8274..8275..8314..8317..8330..8333..8472..8473..8512..8517..8523..8524..8592..8597..8602..8604..8608..8609..8611..8612..8614..8615..8622..8623..8654..8656..8658..8659..8660..8661..8692..8960..8992..8994..9084..9085..9115..9140..9180..9186..9655..9656..9665..9666..9720..9728..9839..9840..10176..10181..10183..10214..10224..10240..10496..10627..10649..10712..10716..10748..10750..11008.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\So.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2825
Entropy (8bit):	4.312209917800423
Encrypted:	false
SSDEEP:	48:0z+XnEnRCNwSyMGeep+76Kcs5CQYru2FwscP++ICs+NIyOx8vq98t9UWnI:0zoEnySKckCQiu2FtcCONCxSbnI
MD5:	FF816A3A0218ECC9173955C9D0A706E7
SHA1:	B2FFBC3BE017AF7DC6559AD63E3951826E4880F7
SHA-256:	69CE8D55751BB2CA94CB25F90B2BCFA35236F65DF0AEFC55D1AE73DA54B027A4
SHA-512:	0B2E8B6328C2A5ED0C24140352ED2B138E5868FA4FEB061A2D7E5EFA558855B79F26A082B267CA928BA904327D57BE7486450656FB46E068A7AD74C937825C48
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V340..166..167..169..170..174..175..176..177..1154..1155..1421..1423..1550..1552..1758..1759..1769..1770..1789..1791..2038..2039..2554..2555..2928..2929..3059..3065..3066..3067..3199..3200..3449..3450..3841..3844..3859..3860..3861..3864..3866..3872..3892..3893..3894..3895..3896..3897..4030..4038..4039..4045..4046..4048..4053..4057..4254..4256..5008..5018..6464..6465..6622..6656..7009..7019..7028..7037..8448..8450..8451..8455..8456..8458..8468..8469..8470..8472..8478..8484..8485..8486..8487..8488..8

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Z.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	599
Entropy (8bit):	5.102134636605526
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7QXoCMNn/v:002+XT731GRnXE7Q4CMNnn
MD5:	4CDA0132CA527804127842C2436196EC
SHA1:	E8CD272CD351D660CCC98DE56A5CB5CA69F26908
SHA-256:	87BF0770775067FA6FCEC900356F8FA7C2845B64556EBC5F34A9B066C886B974
SHA-512:	B4209DAA2A2DAB3F45DE6566E5D7B5D15939C22A82A421C0CFEA92E78271BCD10BC6B827869ACCD19B3332515FFA4FF1D9EBB254CB3ADC7B1AD1DFC47EBE3804
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..32..33..160..161..5760..5761..8192..8203..8232..8234..8239..8240..8287..8288..12288..12289..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Gc\Zs.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	587
Entropy (8bit):	5.095270614922665
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7YMPn/v:002+XT731GRnXE7YMPnn
MD5:	77D76C7A420F919090C0D66C84F38BC7
SHA1:	824C8C84BDEECDC924156D3A76F1B4A81DA620CE
SHA-256:	A86214725B1ABF6331A6E712A1FF911258C130DD069B3BE6F6A8B35880A5E713
SHA-512:	0A9436A3667EE279E2EA519DC6281F6AEDD0F31567C4AA8B42F729311E1DA01CB2322FD5AECE37DC8E94E2D13A50FB2D4A3F6AD6BEFEEDD9242C911B900DBB3D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..32..33..160..161..5760..5761..8192..8203..8239..8240..8287..8288..12288..12289..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\GrBase\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10450
Entropy (8bit):	3.80655938634702
Encrypted:	false
SSDEEP:	192:iZD3g0hJYZLbV8CflY1gdBsEM/UC0iwHscSaDcm5IefIKF1/xHpnIyytHLMCl:iZD3g4JOLbV8CNY1CBsH50jMc9x5Ief8
MD5:	E58D8D2FFB0E68F68DC70AB3E2E4DFDC
SHA1:	2FF7F47C61FF1D97B7D591BCF7DF8E781D5C7D62
SHA-256:	6AA7836B92CEFF1CCBDB9AD71C496492A5F396F3C3330B260E20DB3C6091EBF9
SHA-512:	BA85593E5079D2AAFE2FEF7433A0B0F9DF1BAB08C37AAA0A6247936E30B90EFD602D97D8674A8970CE35CC5D36DEF2FB27A64DF48E94075311D87AC38076C652
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1486..32..127..160..173..174..768..880..888..890..896..900..907..908..909..910..930..931..1155..1162..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1470..1471..1472..1473..1475..1476..1478..1479..1488..1515..1520..1525..1542..1552..1563..1564..1566..1611..1632..1648..1649..1750..1758..1759..1765..1767..1769..1770..1774..1806..1808..1809..1810..1840..1869..1958..1969..1970..1984..2027..2036..2043..2048..2070..2074..2075..2084..2085..2088..2089..2096..2111..2112..2137..2142..2143

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Hex\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	574
Entropy (8bit):	5.080091032241742
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7NtjQxvnv:002+XT731GRnXE7NpQVv
MD5:	FD12C9F629341EC025928DA690A49C7C
SHA1:	2A5E9EBD412C23E7E774B5ECAA951D189AC6B068
SHA-256:	5508B8410485611C98A241B91E877E13FE388941D510C1A3A1107E4AA839EF46
SHA-512:	82043C3CB7C976C791E7ADB0B9B428A294609126BDA23EAE3E73D2CB6E1BA945D17AAEC25F30AAEEC02888051613C5D4D92A98890A65BE2B06A9C68D91C5D35D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..48..58..65..71..97..103..65296..65306..65313..65319..65345..65351..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Hst\NA.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	578
Entropy (8bit):	5.090566842719295
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Kj1qiv:002+XT731GRnXE7wzv
MD5:	861E13ADD9DA32E85B3EA83097005AD8
SHA1:	2ABFCD60ABF268888B2A91BA4C65E6F7B7A11516
SHA-256:	87A0354081588C643A13E3C614D378E6929D5DE39456B1C58EB457E95E8262D3
SHA-512:	8B0C79427DC729CCF3D631215673B223372D9B237D5F661AFCB733F4FD38ECA8265E2E6BB69C8A3C25DF41F4267DDE6A4A1D2B26BB716723E12B7C3AF50DE05B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V11..0..4352..4608..43360..43389..44032..55204..55216..55239..55243..55292..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Hyphen\T.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.151565878202914
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HKyBQ3ooqwRiI2:002+XT731GRnXE7H9mooqwIr
MD5:	D01754A8DB0A2475A97739D1C49AE525
SHA1:	ED5A84F8EB469C337BF7B6971656AD1C08490749
SHA-256:	08465215A7FD3B3DBD130FCB6A45C241E8911990CAD358688C770DD46C7FD93F
SHA-512:	56B4BB35C2528F5234698B423A1A21EDBA5F14ECFD97CCDCB48A4860A558191294A929873C115713BF7FF649504E3395A0BAB0249DC9152088D52B6BB052AB90
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..45..46..173..174..1418..1419..6150..6151..8208..8210..11799..11800..12539..12540..65123..65124..65293..65294..65381..65382..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\IDC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9105
Entropy (8bit):	3.8422815898908094
Encrypted:	false
SSDEEP:	192:iZVjWEJjvimpLaxAbMftLRXx5/e88VfVzJliO3aoBJmuLqSLMM:iZVKIj6mpLaxAbMVLRHm1zJliO9ZkM
MD5:	9E85991DB4EDD1A2BDC62C28CA4FFD6F
SHA1:	E6CE6D4122CD962C3AD75CF0956ECB91E979E118
SHA-256:	4D711DAD9B142AC25839285915A99AE41A1E6616319478AC090F1C9D8EBB4A59
SHA-512:	E085E00ADA853B2BF8DC0FC660381E410F9B0A325AE455925785308F4593AB0B70177BDA8ED43D558784E6B0C2834E81A11C474D0EB825BEEEA8867BAF4E84F9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1302..48..58..65..91..95..96..97..123..170..171..181..182..183..184..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..888..890..894..895..896..902..907..908..909..910..930..931..1014..1015..1154..1155..1160..1162..1328..1329..1367..1369..1370..1377..1416..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1642..1646..1748..1749..1757..1759..1769..1770..1789..1791..1792..1808..1867..1869..1970..1984..20

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\IDS\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7857
Entropy (8bit):	3.8873482228009224
Encrypted:	false
SSDEEP:	192:iZWLpqTXlkKo+ttxxD//Y8VtN96ClWOc5TS5N/qbLMs:iZWlIXlkKftxnftv6ClWOeg5Zs
MD5:	A8E4E1451ACA9B41668B5A3AA279A89C
SHA1:	E3C3EB06C00563C6B5CBBB7D25E605632C66B35F
SHA-256:	6D8556DB9714EF131F2A0037B7B8D109D08066C4E1DEE79813A6429E938C7556
SHA-512:	1795862FF8E0E3DD25954F3A70A67F2CEFF08632C7ABCB825C57181E0FE8B672F7863EA8E0B2932983D5DFC3CBB65D94D823A22F73FFCF22B718296FF5EB8571
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1110..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..880..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1488..1515..1520..1523..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074..2075..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Ideo\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	685
Entropy (8bit):	5.171892218552609
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7DcaTRHGyRmpFRZSj:002+XT731GRnXE7waTRHnRiRu
MD5:	625D0882711A32F9D76BA2159B5A58AB
SHA1:	AA18C0647B94F6FE9C69F0EC08CA6D57E11E4B33
SHA-256:	98C0567D478E06266D2BFE2CABDD3704B735B30749242207C3362286E6DD1EC1
SHA-512:	8FAC29A6A859438B24C55536C31681D37C917BC6BD49646A6C66F047F46277F3C13F47014E580693C4178CC14EFAC37A170163DD1E9CD63058780EB61ADFD70F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V24..12294..12296..12321..12330..12344..12347..13312..19894..19968..40918..63744..64110..64112..64218..131072..173783..173824..177973..177984..178206..178208..183970..194560..195102..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\Bottom.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	4.557850739703183
Encrypted:	false
SSDEEP:	48:0z+XnEn8CnISWCEEdAXwOlKTvz57V1hhzto3wbf:0zoEn/ISmHGL5R1hhzto3wbf
MD5:	2CD4A68060185DF70E62CAAEAD54074B
SHA1:	26066A66A092ABD6F8CAE83EA6B6567F5AE3B064
SHA-256:	7AD9A2FFE4C4B7BE1B72A4294AC3CD680E9A6A01DEA81E5409140BAEDF186351
SHA-512:	361AB20BB53E35BCCA48DB4C05D44DD0794130680C48EA734147CFFFC7CB896802FF1C9932E4D60FDEB960434A1EB5A8DF1E9C71CB0339655EC07F062D253EE2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V226..2364..2365..2369..2373..2381..2382..2386..2387..2390..2392..2402..2404..2492..2493..2497..2501..2509..2510..2530..2532..2620..2621..2625..2627..2637..2638..2677..2678..2748..2749..2753..2757..2765..2766..2786..2788..2876..2877..2881..2885..2893..2894..2914..2916..3158..3159..3170..3172..3260..3261..3298..3300..3395..3397..3426..3428..3540..3541..3542..3543..3640..3643..3768..3770..3772..3773..3864..3866..3893..3894..3895..3896..3953..3954..3956..3958..3972..3973..3981..3992..3993..4029..4038.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\Left.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	995
Entropy (8bit):	5.0302137603599055
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7IFP6+2aBVV1WdmccJBvJXeD:0z+XnEnjFThF1WiXvpw
MD5:	42AF8058AD15EECEEA110A6DF09BEB36
SHA1:	CD57233A935A3AECADC6F1D26D283F2D24436D6F
SHA-256:	E26C129BC48D4A97595A5CA7BD23129FAF3EC48B01D0C4D71CE4A59B83085B34
SHA-512:	DFD341D8B2DF3830B72F37953C2FE1062EBD3FA0D16CDC4142A15DAAACCB86429A9E39A69417449F2513D2DFBE72FAABF9BE06E6BB164AA02B8C6015C72600A3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V76..2367..2368..2382..2383..2495..2496..2503..2505..2623..2624..2751..2752..2887..2888..3014..3017..3398..3401..3545..3546..3547..3548..3903..3904..4145..4146..4228..4229..6081..6084..6681..6682..6741..6742..6766..6771..6974..6976..7078..7079..7207..7209..7220..7222..43450..43452..43567..43569..43572..43573..43755..43756..43758..43759..69809..69810..69932..69933..70068..70069..70369..70370..70471..70473..70833..70834..70841..70842..71088..71089..71096..71097..71342..71343..71462..71463..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\LeftAndR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.170521166429662
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7mjvbb4Vc9cLOLqMGuUk:002+XT731GRnXE7gvnH+LOLqtur
MD5:	BECBB0A85B18C60033BE55FFA32637FD
SHA1:	6C9A03E576CD746C8710598B9D011C43DF908F81
SHA-256:	CABF6BC98E209D8DD1EDC6F05193EC29FAEDDF21B78496E2EA8233FBABD68D31
SHA-512:	C4180FDAD3F78CDD333A3616E525C12F0ED40D593598EC958280283D066A4B05C5C05ABBFE27BDA85F2C5E60641E1E4909D5157577FFAB94F22E214EFD2611EE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..2507..2509..2891..2892..3018..3021..3402..3405..3548..3549..3550..3551..6080..6081..6084..6086..6976..6978..70475..70477..70844..70845..70846..70847..71098..71099..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\NA.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	4.342807736495365
Encrypted:	false
SSDEEP:	48:0z+XnEneyUj6FcviXTYzpvv5E/9CXN+2Ee3/QWEOdM8Cuquy38OSb7OE6whsI:0zoEnvUjrviXMzlvO/Fhw/QVOdXCnPSn
MD5:	B665A21517ECAC8CA46603A8481227BA
SHA1:	6F37488FB9D0827DD1974DCEB035C853BA57C93E
SHA-256:	AC95CBFF1F6E8429D6DC63A1A03EB1CE660A0CA297345FA084B3C69A38F367D6
SHA-512:	297011E051AE95F45EA41B8E2813DF6BCC2BDB2EF24C0426D74082A6A02EDE0BDF99B34EF1DC4C1329D85B45539E515B7807DFD6114C0822404BB7D4F7410854
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V343..0..2304..2308..2362..2365..2366..2384..2385..2392..2402..2404..2433..2436..2492..2493..2494..2501..2503..2505..2507..2510..2519..2520..2530..2532..2561..2564..2620..2621..2622..2627..2631..2633..2635..2638..2672..2674..2677..2678..2689..2692..2748..2749..2750..2758..2759..2762..2763..2766..2786..2788..2817..2820..2876..2877..2878..2885..2887..2889..2891..2894..2902..2904..2914..2916..2946..2947..3006..3011..3014..3017..3018..3022..3031..3032..3072..3076..3134..3141..3142..3145..3146..3150..31

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\Overstru.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.054317258340915
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7OWTTov:002+XT731GRnXE7OWm
MD5:	14F0038AC874E4A39CF637FFCFB7FD79
SHA1:	0488D0F2DEA53CC6516A419434159262BA02EC9D
SHA-256:	8C5069A278E76F68FB348F86CAF66B55DDFD45680856A64D449D775564DE19E1
SHA-512:	AC8101E468A06CF9F056FE481D6789910ABB88789B11913DD02DFEFF70B5AB9CAED0D136A38F2B9E644E0F076D93BA8EB4CCF70C26E3DA66C6DC86632EA30B5A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..7380..7381..7394..7401..68097..68098..68102..68103..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\Right.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2274
Entropy (8bit):	4.437928491839885
Encrypted:	false
SSDEEP:	48:0z+XnEncCTJVbFuhLJLoeqrbtHv4KEEbbZnmov:0zoEnlJBFuBJLoBrpHlEE3ZnJv
MD5:	F4FFDA0364D0C63E14F560F37F9828A9
SHA1:	54C41716DCA20A2B5C410C911454373FE284D067
SHA-256:	90DDD0673BDB3F9D00522C76250C2E3ADB22B97C0B98EC51B27E588E3C524C8D
SHA-512:	7FC7D0AC6D06C772163EB01F1CF00D142017BBA9E6B2C60E21230904F580DA486016E7CECE94D705DF61497E70773B37EDBD3FD6E8D3283FE9D0EB5F4EA3A963
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V276..2307..2308..2363..2364..2366..2367..2368..2369..2377..2381..2383..2384..2434..2436..2494..2495..2496..2497..2519..2520..2563..2564..2622..2623..2624..2625..2691..2692..2750..2751..2752..2753..2763..2765..2818..2820..2878..2879..2880..2881..3006..3008..3009..3011..3031..3032..3073..3076..3137..3141..3202..3204..3262..3263..3265..3269..3285..3287..3330..3332..3390..3395..3415..3416..3458..3460..3535..3538..3544..3545..3551..3552..3570..3572..3632..3633..3634..3636..3653..3654..3760..3761..3762.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\Top.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	4.391254454753702
Encrypted:	false
SSDEEP:	48:0z+XnEnzUXPJYP2bw+yc53g7aCRdKmJILJ61X2/oQEx8E1kLG:0zoEnzUXnyI3maCpaLJ61soQEuESLG
MD5:	38A4701C3D0DD26A20B2F45E3A5DBDA8
SHA1:	8EC7843E4BD2E302DB722A99D9B42F7F971578CE
SHA-256:	A08A212F982B7BFB7FFB0ED5C009C33E820A7AA9EA8CF3A59BCD16034B3B60E3
SHA-512:	72DB34ED2310334B8B7104A030114CD20093468605C48BE7C43AD6ACBB833AEF9D136A1F3FA6CAC33435F4AD97DC7BFD273C3DF7C35EDF2D3A7A33F9DDFE15ED
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V302..2304..2307..2362..2363..2373..2377..2385..2386..2387..2390..2433..2434..2561..2563..2631..2633..2635..2637..2672..2674..2689..2691..2757..2758..2759..2761..2817..2818..2879..2880..2902..2903..2946..2947..3008..3009..3021..3022..3072..3073..3134..3137..3142..3144..3146..3150..3157..3158..3201..3202..3263..3264..3270..3271..3276..3278..3329..3330..3405..3406..3530..3531..3538..3540..3633..3634..3636..3640..3655..3663..3761..3762..3764..3768..3771..3772..3784..3790..3897..3898..3954..3955..3962.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\TopAndBo.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.094522860110025
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7LjCykWeAQ8:002+XT731GRnXE73CUDn
MD5:	29051EE483265906FCEB05D2597FD0E7
SHA1:	92E237B6B04745AAE4609FE2D1D577177CB232B4
SHA-256:	2F02FD5C2C16EA7986668269D710909B4F0E89ECEDC00C0187B0CA4489FD8603
SHA-512:	98173385C64BB8E04F40F422D50F52DE287A6E6E832B78939DD95553F56B276B50E8775F13E7E260219210DBA2AE1A7BB4AC28487F1A42669F368CC810A301CC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..3144..3145..3955..3956..3958..3962..3969..3970..6972..6973..69934..69936..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\TopAndL2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.058725269019482
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7fUJiVm3:002+XT731GRnXE7giVm3
MD5:	1B0E8445793CE51DA58A48736A432184
SHA1:	1C9979E5E8499F0B911B54FC777097110E1435B4
SHA-256:	62F6710C52B5F563ED4F241017D783A30B9F61CE76B8F5A76A68AEDF0F0B4DC6
SHA-512:	88A2697CA7D899113E25D6ACDB34C7B72BA76913D3CB4C458348657C195223E70F9D789565EA2B7EBEDAEA303F091DAB25D140A1936D7FA3C04DA56A8D56E79C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..2892..2893..3549..3550..6079..6080..71099..71100..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\TopAndLe.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	583
Entropy (8bit):	5.108001777738352
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7kTorXNmMHUv:002+XT731GRnXE7NgQ+
MD5:	1CDF0300C110A93FD08D694E3C5783C8
SHA1:	1DA7636179C3C252A5975D4E945665D60156E124
SHA-256:	D27143813768F2D6F878C0B6B7707F67F93D68AFE7BC118821EEEA66BD0BD459
SHA-512:	EBA9B875672AFDBE7FB5504F65055F533831DAB7E867754CD33B5A7F7EBA9C0313FEB4ADAB2926F62B98DA3EDFDE2B3F18481B1C13661FE2C7A5FDE7FA754CDF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..2888..2889..3546..3547..6078..6079..7209..7210..70843..70844..71097..71098..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\TopAndRi.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.139533670012611
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7ZNIw5B8SU:002+XT731GRnXE7Zxb4
MD5:	920A487B5DD948CCEF0C2B3432EEEC1E
SHA1:	7E3EB37BC158DA4B369DAF54A2D1C31F5BAA6B6A
SHA-256:	8C9E02873096927012449DB0C34A46C9644177A2BE14FA7299B38BD3DD35AC83
SHA-512:	C93B0EE3679F5D0BBF8276596C29C0A8EF5CECC0E9DCAD95D950AC8D66D69348120C3435C13263A8E09C640D1550441962759A020906F0530A4DEA5EB68DFB29
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..2761..2762..2903..2904..3264..3265..3271..3273..3274..3276..6437..6439..6979..6980..70079..70080..70194..70196..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InPC\VisualOr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	597
Entropy (8bit):	5.110453284463436
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7NuEPg/:002+XT731GRnXE7VPg/
MD5:	EF8BE46F3D94EDAFE4145513E963F244
SHA1:	E1E87849F4BB73DC77611C34CDDBB6543664E5CE
SHA-256:	2A59856049ADD4257A802C453A5F69A4692E04298B2075ADE158C0722C8A4679
SHA-512:	CFDDAD9901A60C75FBFF7085168EA8F2B2219201AE63695535C81CC508584E2CB80D0167FF0C2EB20E374607A886310DC697B148C94674B1FCB17D2A4923895F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..3648..3653..3776..3781..6581..6584..6586..6587..43701..43703..43705..43706..43707..43709..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Avagraha.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	669
Entropy (8bit):	5.166371079063974
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7nvxYm+xc+zcEDCv:002+XT731GRnXE7vx0Q
MD5:	1C090469EFDD7CE2369287CED7D615A0
SHA1:	0391F1DC148C7AD3ABE971D1D4AAD271CB443A25
SHA-256:	AAD3AE7EE6618F2CEA1C9F86D7B3DAC12690BEE1546D5DA3F5F55F520F2BEAD3
SHA-512:	346E01ABA9D6DCD92E8D8DD7B54ECD2CEC8A81F097884BA0EB21827BF7CF7D68612796B8CD5096C2CB01E37385773E8AC2201E62B8D7912BC8250A8E7D67E2ED
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..2365..2366..2493..2494..2749..2750..2877..2878..3133..3134..3261..3262..3389..3390..3973..3974..6108..6109..7098..7099..70081..70082..70461..70462..70852..70853..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Bindu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	983
Entropy (8bit):	5.026776158168949
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7IFZ8tcm94KYCjLYANFqAY0k0k:0z+XnEnjv694bCj0I91kJ
MD5:	B5932C794C2714FCCAEADF6046E497EE
SHA1:	E4417D0D01244CC182E7CEF939C1B3FEE91C54F0
SHA-256:	643663D5FFF8AECF1CD537E058616530F57DC4A5460F84B19A09A77F9C69D17A
SHA-512:	E7AB4B54F8EA0E9B409F5B4A88C2CA15E496BB581B9BC0B9D277B1933C0AD49C3E8CF343C36B4238F9D339AA79689061963420B331B7F132B57324EE87DE8A6E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V74..2304..2307..2433..2435..2561..2563..2672..2673..2689..2691..2817..2819..2946..2947..3072..3075..3201..3203..3329..3331..3458..3459..3661..3662..3789..3790..3966..3967..3970..3972..4150..4151..6086..6087..6450..6451..6912..6915..7040..7041..7220..7222..43019..43020..43123..43124..43136..43137..43392..43394..68110..68111..69632..69634..69760..69762..69888..69890..70016..70018..70196..70197..70367..70368..70400..70403..70847..70849..71100..71102..71229..71230..71339..71340..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Cantilla.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.137612088410452
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7oVWj86F6/qs:002+XT731GRnXE7HIv
MD5:	94EE958F2597ED19BCAD2D5FD4617A8A
SHA1:	6BE7FADDD53AE0FA9D01C4519E81D0C88E84D045
SHA-256:	B92A77E9806130F71CCE739364590C0A6C261A0A28B39D6A7864DC8B2FC875FE
SHA-512:	8406F5D03B02219E0B31E2FA90AFDFFB2432CF68F1458C432EF3489A704C74124B982938E1AACDBB0B0E75602A1B85241373995260ACFA5EDEF3C5C9153ECC5E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..2385..2387..7376..7379..7380..7394..7412..7413..7416..7418..43232..43250..70502..70509..70512..70517..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Consona2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.165897620056241
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7cJYyCm7E7BCBov:002+XT731GRnXE7Yn7aCw
MD5:	9CE41A21F76B1F09BADFBAE910526C26
SHA1:	EBA00BC299E4549928A846444B86F0D2A8C88510
SHA-256:	B27EAD82AA529D13262198BD1885AF6E80A07A2107F0CC2179C47C739CA79368
SHA-512:	3F01A94344255CA0088B3687344DBC3BA6579B61851BE27898E839EF93A450446E4B5B90D032D3A7E4A2FD924A0943804108A4E329EF000BBCB1DEE08A6B11F8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V22..6448..6450..6451..6458..6593..6600..6743..6751..7102..7104..7152..7154..7213..7220..43188..43189..43343..43347..43584..43598..43995..44003..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Consona3.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.136663630584838
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7a+F/UivgVwy2WY:002+XT731GRnXE7v/UivgVTY
MD5:	4E5B8E7C9F2243CD5F14BEFF5A53C0FC
SHA1:	64AE905E975C1E757D0B6AE9EF4504101A623D59
SHA-256:	63A831BA4D9756DCF48E8C9A578963BD646B47D1564EE7AD7E6F62D892DF2AA5
SHA-512:	80BB970515161D96A13135FDF0448780471D9445846CC00E0E3D016B5963F1029E20692C48D49A9766DA0516812763CC7EFDC4F0D68B3944F77C1099C4B5FDF2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..2677..2678..3772..3774..4155..4159..4190..4193..4226..4227..6741..6743..43454..43456..43571..43575..71453..71456..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Consona4.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.142542831007085
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7L4R3ySumA/Y1tvgM:002+XT731GRnXE7L4hySXWYbvv
MD5:	8578097E6A890FCA487F4E459FB5CBC3
SHA1:	BBD8E912B3562AAF16859211D7187538A5132410
SHA-256:	9D1D4FEDCA0B644EEFAE767947AB35A93D111005584B788D7731A21EEF8B5DE0
SHA-512:	15263949474C486D74CD72AE0E1A625C724FF6BB7F0E43D01DF57A4C65744933911D97F2E80A7FB8ED3A461B1C5C9332DE917F309F4F4E51098D0740A7DC059D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..3981..3992..3993..4029..6441..6444..7073..7076..7084..7086..7204..7206..43111..43113..43121..43122..43453..43454..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Consona5.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.100530930340936
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7voBa1k+/9:002+XT731GRnXE7QB7+F
MD5:	81266A261C491755DFDDC71B8FBDDDF0
SHA1:	34C73C50AE4529F63FB1B2402C2734D8463D92B6
SHA-256:	24AFD65CED1AE4B1017EE9786474D211959CBE41706ABAFD2AF7BD9EDC77786C
SHA-512:	70BB077AA4346EE42C23D94C26855BCC4F96BBBF6A2800C35E5505C01B53DF47A3CF0667457A6A223B66C07D314F4A05EEB127C6C5E4E6F95AF2F37F613BBADF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..45..46..160..161..215..216..2674..2676..4174..4175..6400..6401..8208..8213..9676..9677..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Consona6.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.063796886049039
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78Adhy:002+XT731GRnXE78A2
MD5:	B7DCF36043BB924D15BFC31F297401A0
SHA1:	BEDD5E2A1AF702EB2A747CD53245C84CFDFAE657
SHA-256:	AC9145624FCD8909FDF67D94F4888815DAC805D71A31538300B6486E27FFF5FC
SHA-512:	A702F14E6DFA35F14035E96FA149C56BF7B3FA6FB878A19A73B0EEF395A9E4008F5710F69F6377D3871E407F65255C353005433910D2E2F38B2439B2FAE3E12E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..6092..6093..6915..6916..7041..7042..43394..43395..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Consonan.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2322
Entropy (8bit):	4.438539430111784
Encrypted:	false
SSDEEP:	48:0z+XnEnqmhbhW4kOXc4/LGEbOEEe3Kq/dlOhC7aPXEFHGJO53P7Uyz:0zoEnqmphdPXZG2J7LdohC7afCP53D3z
MD5:	77D61F9B18801DC197A350D5B011FCF6
SHA1:	AE8A6269AA9CB234874F2694E4C20469E680F21F
SHA-256:	DD3775EB96772FEA1BAB36A56D50D77711CDD2BFB40435D95F4AE2C0AA30CAD5
SHA-512:	FAC926AE2749D6420D0FE36E14A6AD39FB865AE93BB02E427BA40647FAC01D7A358BAC0208E4C81D72F218D8441DB26BC5A958E0D30DBBBCCDB091A6C90D05AA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V286..2325..2362..2392..2400..2424..2432..2453..2473..2474..2481..2482..2483..2486..2490..2524..2526..2527..2528..2544..2546..2581..2601..2602..2609..2610..2612..2613..2615..2616..2618..2649..2653..2654..2655..2709..2729..2730..2737..2738..2740..2741..2746..2809..2810..2837..2857..2858..2865..2866..2868..2869..2874..2908..2910..2911..2912..2929..2930..2965..2966..2969..2971..2972..2973..2974..2976..2979..2981..2984..2987..2990..3002..3093..3113..3114..3130..3160..3163..3221..3241..3242..3252..3253.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Invisibl.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	597
Entropy (8bit):	5.130309259111327
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7CVyzw:002+XT731GRnXE7CKw
MD5:	F92AF01C90057EE1E9E17C4018CBB8E1
SHA1:	07E21F2BB388F72B2C824636D6E413FAECB23F2C
SHA-256:	3F79356153C31771FF99F36CF21541A47FEC0720B439538F3432098D253DFBED
SHA-512:	E263F48ACFD03335346BE9C07A85DFF69580842747E15A610031052BF3D0896637E64D5363359D7834B2349608E7570A54F9AA93A68CE8F016DBC25CE1B67736
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..4153..4154..6098..6099..6752..6753..7083..7084..43766..43767..68159..68160..69939..69940..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Nukta.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	781
Entropy (8bit):	5.157359077813453
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7jjvcurZvTBVFZCuxoKk2:002+XT731GRnXE7jTcuFvTBVdxzkhyRv
MD5:	ED824864BE889FF8C78A82870AA72F57
SHA1:	A08936D75116F92DD10CC5B23018BD55144EDC86
SHA-256:	F24723648BDA51132B12331EA9198333CB3ACF924D2F9A4371700F268C8D0E16
SHA-512:	07127E00BD492EA3CE143787F1454217D5C259C734855E2AD4B8257DA2F888C883E925D4FB82D47DE7E3784FA8BD2A869071760693D0DC7C2556708D1CDC5BA8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V42..2364..2365..2492..2493..2620..2621..2748..2749..2876..2877..3260..3261..3897..3898..6964..6965..7142..7143..7223..7224..43443..43444..68152..68155..69818..69819..70003..70004..70090..70091..70198..70199..70377..70378..70460..70461..70851..70852..71104..71105..71351..71352..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Number.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	4.997800991625856
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7PA3g7+dy3Oq0qa/RZtVdg8:0z+XnEnpG53U7rg8
MD5:	1969931C89934F9881CEBB750D5E54B9
SHA1:	6223ABF23005028F2035F9F5EF8A8748FE8B5A63
SHA-256:	38360118FD41D2A6F09625D7F63892CB2FACE41191E90D5A1BDA767A2B6472B6
SHA-512:	B2EE9C74C2A1E325EB7EDA493BAB74E533413DEFAD74B809264F5C172B14FFB33BAC383ECBBFB4D5E5571C502232C5A60D6D7E1B994A435390893130AA264318
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V80..48..58..2406..2416..2534..2544..2662..2672..2790..2800..2918..2928..3046..3056..3174..3184..3302..3312..3430..3440..3558..3568..3664..3674..3792..3802..3872..3892..4160..4170..4240..4250..6112..6122..6470..6480..6608..6618..6784..6794..6800..6810..6992..7002..7088..7098..7232..7242..43216..43226..43264..43274..43472..43482..43504..43514..43600..43610..44016..44026..68160..68168..69734..69744..69942..69952..70096..70106..70113..70133..70384..70394..70864..70874..71248..71258..71360..71370..7147

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Other.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4043
Entropy (8bit):	4.115382878809844
Encrypted:	false
SSDEEP:	96:0zoEnkPAj4bjviX22LaxAMaM4qtb62zNtpsBSDaVBmDz8:iZkYj4bjvim2LaxAbMftbB1sBUaQ8
MD5:	34CEA3445C7DBBC0B6F796F012E3C1DD
SHA1:	39E92D040C7D591B3115316FABC8D6508CC1C27C
SHA-256:	5A05820941280A505BFD5179A524F04BE67C2FCBC42A96D29EC89A84A01BBF06
SHA-512:	777F033FAB0121E286AD0DE09F5365A0D57EBB37FC57E3B695529132691EB230B948494921298607E6E7E819022090D91F8F7663B5642D7D413A14333939D08D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V567..0..45..46..48..58..160..161..178..180..215..216..2304..2384..2385..2387..2389..2404..2406..2416..2418..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2546..2561..2564..2565..2571..2575..2577..2579..2601..2602..2609..2610..2612..2613..2615..2616..2618..2620..2621..2622..2627..2631..2633..2635..2638..2649..2653..2654..2655..2662..2676..2677..2678..2689..2692..2693..2702..2703

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\PureKill.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.165189839324614
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7M7/gJkwv8wzQocO:002+XT731GRnXE79dUwczO
MD5:	FDB1F5C32577651EB131EA92B546DC4E
SHA1:	96791F336761E415C9C627300B80DA6EBD7E7931
SHA-256:	0B8BAF216AD3AA88076C73FD7E17AB2656D88A6086B074CBD4D204B50DEC3557
SHA-512:	43D8979961E55E6AB90D7D4F7746A12FF221C90DB1D97F48B4F19AFA9868A80660C864F4504711561C127E65471FE667E4951D98465820F58366FE52873BD13F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V30..3642..3643..3662..3663..3972..3973..4154..4155..5908..5909..5940..5941..6097..6098..7082..7083..7154..7156..43014..43015..43347..43348..44013..44014..69940..69941..70378..70379..71467..71468..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Syllable.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	5.153278469886115
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7R4CnTydZwJyM:002+XT731GRnXE7R4Cnbh
MD5:	527E3C504673310201CD36830F4FC89D
SHA1:	D5BA44356F51BBB277FB8596C44E294DC7A30B34
SHA-256:	0B65AC9E25192794EFACBF0689CC1FE5F724CD06246F5A94886989543E4DDBC7
SHA-512:	B291D047C67D764777571337D8E21F1E1DF8C15EEF3AF8EA25B9326C8007C2D79F58215D5E909718339D625B641B1F0BF364B3467D707567F060A947CEDEEFC1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..178..180..3893..3894..3895..3896..4038..4039..6091..6092..6094..6097..6099..6100..6459..6460..6778..6781..6783..6784..7222..7223..8308..8309..8322..8325..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\ToneMark.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.145631581624512
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MyVDQe3pRm1BH5B6V+v:002+XT731GRnXE7hDQp1JPkQ
MD5:	0A70009A9A7B35A294EDA7E622F808C4
SHA1:	4BB77A199FC078D6F067F5ABC0ED958C858E6E63
SHA-256:	76A308485FEF7F47BDED891411AFBCAAEA95C3C336DCEB5CBDC4FC3255316CC0
SHA-512:	EAC3A5E3803FD3A12C1D6DC918BA3A5CC3AF33389D4834F5642F23E33FE963F73A742FD3ED4EFD6723F92C8CE07A952272A12901DA01DC1F3356E4AD2875DE47
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V30..3656..3660..3784..3788..4151..4152..4195..4197..4201..4206..4231..4238..4239..4240..4250..4252..6600..6602..6773..6778..43307..43310..43643..43646..43711..43712..43713..43714..44012..44013..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Virama.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	793
Entropy (8bit):	5.147950653188842
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7r3VOtQv8B7vF3FUA4Sfl:002+XT731GRnXE7wtQvG136ev
MD5:	726B5C81A842CF00B4670B15820913FB
SHA1:	0C4F74952C376DAEB0DEE84A249948993AF4C5FC
SHA-256:	7827550EDC23F5B00F54BA5E5F53FFA080FA318F4F6365F0520F0B5024121136
SHA-512:	63FB846CC2EE2E3EB472FE6D8BD75FF11FC8CF193B9E562144E4E0037AF9FA35716FE0ADF0227AB958746CBDAC1CC12385ED6C2A215BD198DC6C7B22627B6D0D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V44..2381..2382..2509..2510..2637..2638..2765..2766..2893..2894..3021..3022..3149..3150..3277..3278..3405..3406..3530..3531..6980..6981..43204..43205..43456..43457..69702..69703..69817..69818..70080..70081..70197..70198..70477..70478..70850..70851..71103..71104..71231..71232..71350..71351..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Visarga.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	5.105420541153118
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7GXzTx2n/KOc3KCsxGRZc:002+XT731GRnXE7F/qHXtCNHv
MD5:	3F1B7CCDF2B7D60B95B25CEED068ADAB
SHA1:	6123C95AA8C13174A357E8E1593C7F8679190B80
SHA-256:	9AF5A113473C07CF24CB186FD46E168C0EB51A2E7765AEED14129253D8F3756A
SHA-512:	3A90F725105DDDADE0C4BBB5F44A83FB3F70E108648EAE17540606489BFC41361238B60575A9823FC5902D5CF7678FB6778502A599754DD26582943ECB927069
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V56..2307..2308..2435..2436..2563..2564..2691..2692..2819..2820..3075..3076..3203..3204..3331..3332..3459..3460..3967..3968..4152..4153..6087..6088..6916..6917..7042..7043..7410..7412..43137..43138..43395..43396..43765..43766..68111..68112..69634..69635..69762..69763..69890..69891..70018..70019..70403..70404..70849..70850..71102..71103..71230..71231..71340..71341..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\Vowel.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	575
Entropy (8bit):	5.097823408266993
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PCt7Sv:002+XT731GRnXE7Ph
MD5:	0ECCB772432A1B448BA6F54667427F48
SHA1:	6533562145252E3EE92B10EED447FB5DCEE1D3A6
SHA-256:	D7239315297666EAE6E5A04AD0655B84CD01B9D8EEC482295D11C1EE2851E640
SHA-512:	D49D2D2AD04E8B3856D4D3564C322042398F1CB5AC3F57A0A2D2CC86D52386F6BF0A8BAA97448664575140A5F0E4395474B3507B65178A94EA57777476BFD23C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..6499..6510..43102..43106..43110..43111..43298..43307..69968..69973..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\VowelDep.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1856
Entropy (8bit):	4.584617360491353
Encrypted:	false
SSDEEP:	48:0z+XnEnmdMpXZaaG5HEimyGbeC9nG57ObZ3e:0zoEnAMpXMaGREimymVo2Z3e
MD5:	01FCA966CB3C94DEC1B8886CFE91DA92
SHA1:	48AA969F0677F720AA3D73FAFDF2BB4690A39749
SHA-256:	68ABFE0E11908EBCFBA11D8CFE2E2698EFC86911C4FD06C33430D2E9292E326F
SHA-512:	8DDF1D89492A426DFB1350AB293453823478F9D18EF246B4D2D702B62B3CF5108C0BA3A6CB82D0E59E192CA6FBDDF3C819FAE8F7969D2762F2F81B03419531C3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V214..2362..2364..2366..2381..2382..2384..2389..2392..2402..2404..2494..2501..2503..2505..2507..2509..2519..2520..2530..2532..2622..2627..2631..2633..2635..2637..2750..2758..2759..2762..2763..2765..2786..2788..2878..2885..2887..2889..2891..2893..2902..2904..2914..2916..3006..3011..3014..3017..3018..3021..3031..3032..3134..3141..3142..3145..3146..3149..3157..3159..3170..3172..3262..3269..3270..3273..3274..3277..3285..3287..3298..3300..3390..3397..3398..3401..3402..3405..3415..3416..3426..3428..3535.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\InSC\VowelInd.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	4.79041294734381
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7qtRe/ExyvAN7GWLuLFnXXGx0rbDlZaXs/ucTb8Z:0z+XnEnxtR7xyvlWLW/Ms/ucTbA
MD5:	D3CDBE4F8BAB69E0AB5562515DFB3BF3
SHA1:	CA1DA3A6966BAEF5C29D44A629A4A815619ACCCF
SHA-256:	C6F5AD34F3F09A273F1F4CFD818DAEA3EAD0976AD66AD96A2845927CC6AE21ED
SHA-512:	71EC22A8E075BC88F67A4FF9DEFF29AB22F8AE8E261512843168E52EE1494AFA68874C497B1C15D6C3AAE1B6E03E699F55C7E1BC501363BDC44E1649AAD3FE0A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V140..2308..2325..2400..2402..2418..2424..2437..2445..2447..2449..2451..2453..2528..2530..2565..2571..2575..2577..2579..2581..2693..2702..2703..2706..2707..2709..2784..2786..2821..2829..2831..2833..2835..2837..2912..2914..2949..2955..2958..2961..2962..2965..3077..3085..3086..3089..3090..3093..3168..3170..3205..3213..3214..3217..3218..3221..3296..3298..3333..3341..3342..3345..3346..3349..3423..3426..3461..3479..4129..4139..4178..4182..5888..5891..5920..5923..5952..5955..5984..5987..6051..6068..6733.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\2_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4387
Entropy (8bit):	4.084519866979798
Encrypted:	false
SSDEEP:	96:0zoEn83fnW50fvaRjyhdiXPALFbcc67ZADj+XHYZlEXb5TP:iZmfNfCjyhdi/ALFbc3eDj+XH4lElTP
MD5:	84B80287040FB7131FDC4140C043C0A7
SHA1:	B78215B39CD39F01764142AAB9F508DD115C1BF5
SHA-256:	3C8FAEB62BB643F7536EA907BFBCC6CC35C3339A57850DBCAF839561735A5315
SHA-512:	1378D66993216014CDDB50608044499E2778EA9E05E7822CB4F4357D309E82E954D282F2F0F3F36CEEAE6E28B80061B64FE5A13FF4581A34416EB56FA26BBA1C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V624..0..502..506..536..592..681..688..735..736..746..768..838..864..866..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..983..986..987..988..989..990..991..992..993..994..1012..1025..1037..1038..1104..1105..1117..1118..1159..1168..1221..1223..1225..1227..1229..1232..1260..1262..1270..1272..1274..1329..1367..1369..1376..1377..1416..1417..1418..1425..1442..1443..1466..1467..1477..1488..1515..1520..1525..1548..1549..1563..1564..1567..1568..1569..1595..1600..1619..1632..1646

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\2_1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4387
Entropy (8bit):	4.0845054081728325
Encrypted:	false
SSDEEP:	96:0zoEn83fnW50fvaRjyhdiXPALFbcc67ZADc+XHYZlEXb0ckP:iZmfNfCjyhdi/ALFbc3eDc+XH4lEMP
MD5:	2BEA93F04658D7EED834F536CE191A55
SHA1:	105F734BB59A36AAE24FDBF077007F58ECC3F022
SHA-256:	9479659F43D15AA5337796ACDB992D622063C96E2A6C962179BA1B449850B081
SHA-512:	A45789B3F73C8EC08D5A9570EBAEA72435832946DE2A00E5175966CFD8E0C72477A281A658CEFF191A52F4A64EC2A4EAF5960639A53E0297FF1AE7AB5BBB61C0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V624..0..502..506..536..592..681..688..735..736..746..768..838..864..866..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..983..986..987..988..989..990..991..992..993..994..1012..1025..1037..1038..1104..1105..1117..1118..1159..1168..1221..1223..1225..1227..1229..1232..1260..1262..1270..1272..1274..1329..1367..1369..1376..1377..1416..1417..1418..1425..1442..1443..1466..1467..1477..1488..1515..1520..1525..1548..1549..1563..1564..1567..1568..1569..1595..1600..1619..1632..1646

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\3_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5105
Entropy (8bit):	4.021723496183828
Encrypted:	false
SSDEEP:	96:0zoEnW8WDNfvaRjyhdiXPALFbcuqtcj65gfdR2DrDYH03/XHYZ9C00pbXvLbP:iZWLNfCjyhdi/ALFbc1tc+G1cDC0PXH3
MD5:	814D56D893B9FA83845AEA1ACDCD6B33
SHA1:	FBA8985D7D52961D82E219FDFB05F4F7CBFE891E
SHA-256:	B7DD0137F03AE000692EC855DD24374A4D1BCCD77BA996315726C2FBA8815A9F
SHA-512:	A23BCF9365066AE0F917A0BEC2F056B6F9442A180966344FE753108E165265FB537C6E07207CDCF9EDC3C68A0676B9DADDDA4D141AC5E7F634E38CD4E013C44C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V738..0..544..546..564..592..686..688..751..768..847..864..867..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..984..986..1012..1024..1159..1160..1162..1164..1221..1223..1225..1227..1229..1232..1270..1272..1274..1329..1367..1369..1376..1377..1416..1417..1419..1425..1442..1443..1466..1467..1477..1488..1515..1520..1525..1548..1549..1563..1564..1567..1568..1569..1595..1600..1622..1632..1646..1648..1774..1776..1791..1792..1806..1807..1837..1840..1867..1920..1969..2305..2308..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\3_1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5623
Entropy (8bit):	3.990300347621832
Encrypted:	false
SSDEEP:	96:0zoEn28WDNfvaRjyhdiXPALFbcuqtcj65gfdR2DrDYH03/XHYZ9C00pbXvLqASY9:iZ2LNfCjyhdi/ALFbc1tc+G1cDC0PXHN
MD5:	8201595B059BE7B60924DC941EBC83BE
SHA1:	6E525C45EBBFE7EC20A4AFE9D434AEAE0D6BDC14
SHA-256:	C8D977A2A789A673A965C2E814F85DB1F7DF5B6C8E8BF53556A1783E9A5FF235
SHA-512:	6505FA3334C7B8C56125C67B4614D643D9CAFA5B5850B19D19F4738069720CD96B64B39AE24973EAEEAF9549AA0BEADC2655CE292ABB21F6BB407273055240F2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V804..0..544..546..564..592..686..688..751..768..847..864..867..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..984..986..1014..1024..1159..1160..1162..1164..1221..1223..1225..1227..1229..1232..1270..1272..1274..1329..1367..1369..1376..1377..1416..1417..1419..1425..1442..1443..1466..1467..1477..1488..1515..1520..1525..1548..1549..1563..1564..1567..1568..1569..1595..1600..1622..1632..1646..1648..1774..1776..1791..1792..1806..1807..1837..1840..1867..1920..1969..2305..2308..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\3_2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5551
Entropy (8bit):	3.9982783033296143
Encrypted:	false
SSDEEP:	96:0zoEn8uvW9jfvaRjyhdiXPALFbcuqtcj65ifdR2Tj5ZONlXHYupC0YBYXRLSYvxb:iZh4jfCjyhdi/ALFbc1tc+81c5sHXHjf
MD5:	1AAEFB8144D00886AA4B6A316D1BE813
SHA1:	6F519A9ED7A44BB0720387760B15B411F546945D
SHA-256:	97A1F02422000AF830E3ED8933223AAAE938B24BF709EEBCED951961C89FD585
SHA-512:	618A4F834EB4463BBFB4884C699638A0FBC085706D443357DA9FE6496386AFF228207C4EE48F8DBA14A02A07E77D8B2EF10533171707FBA2D35167CB04668E55
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V794..0..545..546..564..592..686..688..751..768..848..864..880..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..1015..1024..1159..1160..1231..1232..1270..1272..1274..1280..1296..1329..1367..1369..1376..1377..1416..1417..1419..1425..1442..1443..1466..1467..1477..1488..1515..1520..1525..1548..1549..1563..1564..1567..1568..1569..1595..1600..1622..1632..1774..1776..1791..1792..1806..1807..1837..1840..1867..1920..1970..2305..2308..2309..2362..2364..2382..2384..2389..2392..2417

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\4_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5765
Entropy (8bit):	3.9874890589928325
Encrypted:	false
SSDEEP:	96:0zoEnPdvvyfvpNjyEtiXdJLFRcuqtcj65ifdR2gOV5JDDXHYu9C0YqzRAAmtJuvS:iZPdXyf7jyEtiNJLFRc1tc+81+5JDDXy
MD5:	5607E4D58E1DD9EFB2AEC2F1E63C745D
SHA1:	4B3288440835DBEA5E85D996096C9073A6EEDBD6
SHA-256:	C14CA744BFED8E63903FD13CA01D29DBC60D92AEEC09D0890090C11F8A582BB1
SHA-512:	72B20BF760AE1ACD948FD484E04126F044606E241974398AAF24E085C41E2EA1CF0C636F901CCB4E5541680B6CD3E5A9841B6E25B7A0F3C131AD32BA4373270A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V824..0..567..592..856..861..880..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..1020..1024..1159..1160..1231..1232..1270..1272..1274..1280..1296..1329..1367..1369..1376..1377..1416..1417..1419..1425..1442..1443..1466..1467..1477..1488..1515..1520..1525..1536..1540..1548..1558..1563..1564..1567..1568..1569..1595..1600..1625..1632..1806..1807..1867..1869..1872..1920..1970..2305..2362..2364..2382..2384..2389..2392..2417..2433..2436..2437..2445..2447..2449..2451..2473..2474

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\4_1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6047
Entropy (8bit):	3.965845348108139
Encrypted:	false
SSDEEP:	96:0zoEnkiC1cjyEtiXdpLFRcuqtcj6UIAwzgV85WDXHYuiTX/tC0YsGQVcR0tkR50Y:iZvCmjyEtiNpLFRc1tc+Wc5WDXHjiL/C
MD5:	24E2972F775FD519CDB79A1E4DE78CC9
SHA1:	AD38723EB676DB21393EB72D131CA6760471335E
SHA-256:	5FECAEE60148832276814422ACFE0B98E5D274459F4CF4DBC06556439E7C44D4
SHA-512:	0ABAB9373D5A26365201D043F7FB5C54CC097353E70F7074D6D4AC9F8295057D77C21C0E6A3DBBB8D2AE08C8CEFDB89FFF1349E4FF81D36DF4670E58F067ACE9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V860..0..578..592..880..884..886..890..891..894..895..900..907..908..909..910..930..931..975..976..1159..1160..1231..1232..1274..1280..1296..1329..1367..1369..1376..1377..1416..1417..1419..1425..1466..1467..1480..1488..1515..1520..1525..1536..1540..1547..1558..1563..1564..1566..1568..1569..1595..1600..1631..1632..1806..1807..1867..1869..1902..1920..1970..2305..2362..2364..2382..2384..2389..2392..2417..2429..2430..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..24

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\5_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6195
Entropy (8bit):	3.9588284642691187
Encrypted:	false
SSDEEP:	192:iZDrqjyEtiNpLFZc1tc+W+5rKXHjiX/tC0Yh4JBQ5ktbP:iZaujNpLFZc7c+Wh3eXE0E4JBQ5ktz
MD5:	E1CE35B1AAC4B6583D3ABE3AFAEEEB79
SHA1:	1B178C78F2E920179EA0FE600E6C3E6DC87CB06E
SHA-256:	B2DC6B00D15099786B49E4538FF997ACF26DD5C0B9F9EDC12F0E6DE0406BDA30
SHA-512:	26A7B1D478B2B84855C62EBB4C2C61B9D2F7DAA498B883D5C6BC79C2531F0C6B04482646A101F434229063F318B3A1C6B00FECD8F60E2065532962C78E86601E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V880..0..880..884..886..890..895..900..907..908..909..910..930..931..975..976..1159..1160..1300..1329..1367..1369..1376..1377..1416..1417..1419..1425..1480..1488..1515..1520..1525..1536..1540..1547..1558..1563..1564..1566..1568..1569..1595..1600..1631..1632..1806..1807..1867..1869..1902..1920..1970..1984..2043..2305..2362..2364..2382..2384..2389..2392..2417..2427..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\5_1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6417
Entropy (8bit):	3.9474320025928193
Encrypted:	false
SSDEEP:	192:iZ5bAjWE0vifWL3x86Oftc+tK5lOXHji9/D/C0YhbaLxeeVk/bP:iZmKb6fWL3x86OVc+tL3e9O0gQeeVk/z
MD5:	40DEDB8CD3327B53BBA5B833552C7411
SHA1:	91DCA4AFFA83E76E3194D30F446129028DB2DDDF
SHA-256:	AF4E12A07913CAED453C29F8D6C473CCFDCF26304DDA1C99033862D4898DB1E0
SHA-512:	7E01B22D33B3487929755A14F90CB99BD41CAAC7C673C5FA276EC55F703CDB332A3F80FEE9B32F8C1BC68BABB0B77B8191788D83CAD364BF17326692280EC204
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V910..0..888..890..895..900..907..908..909..910..930..931..1316..1329..1367..1369..1376..1377..1416..1417..1419..1425..1480..1488..1515..1520..1525..1536..1540..1542..1564..1566..1568..1569..1631..1632..1806..1807..1867..1869..1970..1984..2043..2305..2362..2364..2382..2384..2389..2392..2419..2427..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2555..2561..2564..2565..2571..2575..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\5_2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7009
Entropy (8bit):	3.920577658403098
Encrypted:	false
SSDEEP:	192:iZDCTjWE0vifWL3x86Oftc+IY5x4XHQi+/DGC0Yn43eD7/edHd6kubP:iZqKb6fWL3x86OVc+Ia43F+D0iCI/edQ
MD5:	7C319579697830E4A80B302623F42BC7
SHA1:	BEFC4FB06004B5D27FAC3FF680319DA72AF3A8A0
SHA-256:	652B1F2270C9F95BF135539E969AD086D09530F94C6AD3EB0B63A16DE78BB0FA
SHA-512:	125B141F9EE9C9B8E4CD344882978B06B6FEF5E4D39B9BBA27FB6B8DDF0567E75A7D3F08CEE1960B48C730F40C177BDCACFFEB5341B700FDD6996D2522E656F5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V990..0..888..890..895..900..907..908..909..910..930..931..1318..1329..1367..1369..1376..1377..1416..1417..1419..1425..1480..1488..1515..1520..1525..1536..1540..1542..1564..1566..1568..1569..1631..1632..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2304..2362..2364..2383..2384..2390..2392..2419..2425..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\6_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7300
Entropy (8bit):	3.9085270184542753
Encrypted:	false
SSDEEP:	192:iZfrjWE0vipWL3x8phftc+mS51/DGC0Y1o3mDN/edHdBk7eYKyeKdSbP:iZjKb6pWL3x8phVc+mMD0kym/edHdBkk
MD5:	438B1D2061EED65BF72812A01297DCBC
SHA1:	E9CAE834CC9DF63E53E4626416386C0252175053
SHA-256:	90E55C4A45B97C63946A699F26669472717B2564330E77864A9E7D8514B6318B
SHA-512:	9188F1036BA9A478211562206897CAB5412B878DA1508C6B3209442270D10BB3346AB9BA812B813E8DA94A4A5BCCA8F0DB0B532705D84134DF911821264601AC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1022..0..888..890..895..900..907..908..909..910..930..931..1320..1329..1367..1369..1376..1377..1416..1417..1419..1425..1480..1488..1515..1520..1525..1536..1540..1542..1564..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2304..2424..2425..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\6_1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7874
Entropy (8bit):	3.8823316317637593
Encrypted:	false
SSDEEP:	192:iZgvjWEZvipWL3x8phftc+w15//DDC0YUIDo/6dHddVkcLMceXbP:iZ6Km6pWL3x8phVc+wjK0Fx/6dHdfkrB
MD5:	EE392D4F8F83B8E2D0F19D9622B7651C
SHA1:	F74158FD63B814D7649D9B80306FFE466EC9D0F8
SHA-256:	645BB0CE87BB79E5C2E5C2FEC74905701412B40748D1773843FE4C00EB6B9A88
SHA-512:	BAF0EC25D1DD95ED7987C47BBCBB8108B6BFC4ABD7B4E7ED798E590F68B44CC1437CE70B0CF25F8D39D78CA40F78BB35FC91B8806449B04D6402CFCAAB2F4CE3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1098..0..888..890..895..900..907..908..909..910..930..931..1320..1329..1367..1369..1376..1377..1416..1417..1419..1423..1424..1425..1480..1488..1515..1520..1525..1536..1541..1542..1564..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2209..2210..2221..2276..2303..2304..2424..2425..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\6_2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7874
Entropy (8bit):	3.882355593371279
Encrypted:	false
SSDEEP:	192:iZgvjWEZvipWL3x8phftc+w150/DDC0YUIDo/6dHddVkcLMceXbP:iZ6Km6pWL3x8phVc+woK0Fx/6dHdfkrB
MD5:	B38A218326135468CF046876CC26F474
SHA1:	AB9757BEC36FBBA749DCE7B47815062F19A31118
SHA-256:	0C8C46F3EBE68AACF17C6705E8ADFBC2629E5BDBBFCFE491895B82C45CA44D95
SHA-512:	D6EB3C036DE8B4A97552FE04DE505ED32C65B0297FE9A73BB4FE7F80B27E6030BFBBE22E2FF269D32EF0D8A3005A5805B72E90A0829EF07FF99EC36725BFB689
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1098..0..888..890..895..900..907..908..909..910..930..931..1320..1329..1367..1369..1376..1377..1416..1417..1419..1423..1424..1425..1480..1488..1515..1520..1525..1536..1541..1542..1564..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2209..2210..2221..2276..2303..2304..2424..2425..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\6_3.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7874
Entropy (8bit):	3.8823531089574224
Encrypted:	false
SSDEEP:	192:iZ1vjWEZvipWL3x8phftc+w0/DDC0YUIDo/6dHddVkcLMceXbP:iZVKm6pWL3x8phVc+w0K0Fx/6dHdfkrB
MD5:	2345B82067113A317E11B7119750B7A5
SHA1:	D20AAC0FB476D6074145C9CD8AD62FA6A4B9D65B
SHA-256:	2AA9C6E7A78CF732B018DB071939D3B9C5608A301079962EDD8E590E123FAFB6
SHA-512:	F6267E6C3DEEEFC01565531B9587F021E17CA76F2A18838353DA062B3E96CAF52F9062BE96EB45CFB29A2A4EACA4AE83C4F1C0757A461550539F18B8BA33C808
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1098..0..888..890..895..900..907..908..909..910..930..931..1320..1329..1367..1369..1376..1377..1416..1417..1419..1423..1424..1425..1480..1488..1515..1520..1525..1536..1541..1542..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2209..2210..2221..2276..2303..2304..2424..2425..2432..2433..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\7_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8752
Entropy (8bit):	3.8564031680821853
Encrypted:	false
SSDEEP:	192:iZMajWEZvipBLaxRbhftr+wD/DvC0YUyuRf6dlPvAm8YkYLMERxbP:iZ7Km6pBLaxRbhVr+wDu0FhRf6dlQ2ky
MD5:	5BA8DE74DEC1EC5B9126058C77983B69
SHA1:	D574AB235A5725B66E91837C029519D70DB6BE39
SHA-256:	30A44942790757E164650A3F413E760C3379D733F90EF1971AD9AD17AC56A419
SHA-512:	6449A5D54746D13EA62328BE2325F7231CE7B403CAE3D3D63ECA28FD56710D2ECC2876C4095CA039C182BB7EC2614133AA271667733BFB1182DF5FD19D58162A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1220..0..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2227..2276..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\In\8_0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8928
Entropy (8bit):	3.8512598195844747
Encrypted:	false
SSDEEP:	192:iZsVjWErjvipBLaxabMftr+wk/DvC0YuQLpIeilFahBA8ZALMC5bP:iZIK2j6pBLaxabMVr+wku0zipIeili7m
MD5:	65BA9AA60E429568DCCE6F4EAE304CD0
SHA1:	D90A6A4E6E49DFE43E4A13F695BD882B941BD88F
SHA-256:	8FA3242D7AF0A9F6235EA96941D5D56ABC485842C6B3E9BC350C2A629080F955
SHA-512:	D1DF03585312D2471CE961DEE9AE14DBE124C894783376F3128940F224F12DE377E6D98A561259E111C85533AFCC205B5BD70364DEE8AC0A516569787ADD2AA0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1246..0..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Ain.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.065550931791618
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74IUGyXO:002+XT731GRnXE74st
MD5:	41243D446A10531FA128DD9E1F0941DE
SHA1:	18D2206E4C38722B33E72E2EADDA24A3D3C4F172
SHA-256:	531575BD5462E29D44D25DD3B5A39047CDF0355CA65A9A118BBB402F3029DE5E
SHA-512:	DF60ABDD28F8BCA10E741C44E20B8580EC5E0DBA0C336144605359DD37A6F345D30F0FFB6193F3F2FB6518E16A238F99D373C7ECC60015560923348331468A2A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..1593..1595..1696..1697..1788..1789..1885..1888..2227..2228..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Alef.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.087660953062666
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7I+0TsmwM:002+XT731GRnXE7LE
MD5:	4A1C0696BC5CC774DF7B041D3A36FA1D
SHA1:	BFA04B8265F34A126C5DF01F4D9C8AF2CF96F41D
SHA-256:	C736C3041569DD1CB6C646B87611CC2596946EDEC5FF577BFFA00D637AD499D1
SHA-512:	9A89520D2B0CEE019AD2D05FA43E0BD1D3BC67344B0AA2958C51A51877DDABA543E8ABDD3C03CB1F74FB152F0BEB7F32BB4DAC273D346ABC156410BDE4710270
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..1570..1572..1573..1574..1575..1576..1649..1652..1653..1654..1907..1909..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Beh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.0822991875045265
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Wivd:002+XT731GRnXE71vd
MD5:	094FE6A632308DA4A0DB33FF499193E3
SHA1:	8C1389AAA9A007EC59C311F770127918E926E3A0
SHA-256:	1BF1D72031A2AEF007F04A9E974C61FBEF481ED959F68EB0945E7C8F33E5A76D
SHA-512:	BE94C29392989222B2406D20CE0B5948096A4D7A6C1EC075FE95C7D5798ACF702A5387953FFEB32626C6E74DC79355F7313E5082D5A876BF82F866A3BC4EC978
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..1576..1577..1578..1580..1646..1647..1657..1665..1872..1879..2208..2210..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Dal.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.06062083154677
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP748RgcM/3euov:002+XT731GRnXE748Rg3/Ny
MD5:	D04E098D9A375F4ACD7CA3104DBC6F36
SHA1:	46E6AB18AEE7ECA6AD15AF21FC5E6E06D7711914
SHA-256:	348F02A9DA8142CDAC8D435652AF8CF969B44B0E616E5888D9DAC628461F474B
SHA-512:	7DFBA84C99E8DB2CD47FE4AC30D4979CD87FDCF458721E5208FD0357B5F493572B44D6850B2801368BF007A25BE60C39AC437925D750D0399BB044E20EDA1FCD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..1583..1585..1672..1681..1774..1775..1881..1883..2222..2223..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\FarsiYeh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.035709725362094
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7AgsUov:002+XT731GRnXE7tzov
MD5:	85CC82EE58A308531F766056D65E9102
SHA1:	8EA6DB802FD0A7C0A7A8FE59CEB1A72FDB4BF73F
SHA-256:	F43B5F3A264BE02171481AB598D455800231FA209CEE6058FE5BB911D946CC37
SHA-512:	7B47C35C8BDDC8A34D438CAB259DB9F50E187E50DB20F50E9B1C58AF2BA3C2F028A545E12B57D1275F0C3DA27BE3260F11499476E2EDAC8B89E714E697926C8C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1597..1600..1740..1741..1742..1743..1909..1911..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Feh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.030943706870485
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7hAxWv:002+XT731GRnXE76xo
MD5:	022E1B233A50F9F1370EFDD541454F97
SHA1:	310CFA635C6D63B021568D8522F0CEC2134BEC74
SHA-256:	92D6D7515D8A736505618B34CE062B20CDB7AE54E022690E2D237FC7D9BB73EB
SHA-512:	541DD304A3F7242F8C787EAB4E63849B1E14D2F4792EC7C0F2C553069F933E432BFA88448EC0825CF3EF05F485658D2954200783EDF69E7E78C8183E7A8B2097
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1601..1602..1697..1703..1888..1890..2212..2213..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Gaf.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.078957385510474
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7oUJ25Ux:002+XT731GRnXE7H22x
MD5:	46BDD6E2CD24BC8F0402DEF5DBC4F96E
SHA1:	CB95A30D3E4EE0DB414E6A5B3D5B3C9BC0E885E4
SHA-256:	EDFB7C861E79797402DD1026BAA51F003FE3D94D2626826EA0D93D4606E836BD
SHA-512:	84E7D7D3D3C429F175396459EEF43472E53ADAF983F7AD201BA29D6D35A5D7D75266F5BE62CD5F2122E681D1E23452F82DF8A8693BFC513A600FCF9E4CFF5109
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..1595..1597..1705..1706..1707..1708..1711..1717..1890..1893..2224..2225..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Hah.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.100503354219488
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7hadvTgwGsov:002+XT731GRnXE7sv8wnov
MD5:	DF03242B6EE275F2116938CE23C0909E
SHA1:	1ED803C1FB4EA98827781FF119D8B48BBFA51BE0
SHA-256:	9FB8185D99820FBBF6E3B968149DC2F535F67008FFB735BB731872826006FB22
SHA-512:	A6B75FD54C8B917CE8A5E226B77F1EC54B1EE0F3904EFD8E217715D1192F949D5FA00B3FEC699B24712F0E231A968E5BBB7D35FA61B67432F681BDBEC8958252
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..1580..1583..1665..1672..1727..1728..1879..1881..1902..1904..1906..1907..1916..1917..2210..2211..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Kaf.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.034775752098669
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7o5OTl9wv:002+XT731GRnXE7EUwv
MD5:	7FBDAD5C627844D7038890098111F21C
SHA1:	4C447DAC5105C9123253210AB494A3AF4ED2E0C8
SHA-256:	85B7E1EA09F638FE96B612BD854FEDC1E34EEA14B7212B23AD19DEE1B85833AF
SHA-512:	A01395B572689B0D1DA6BB1DD48935B6A84E96F7ACB188087F540794A10D17D21A638B033EFE9AC86CDF55AE08F7E7F33DEB97F7E9FE240EA5736AD6B359DFF7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1603..1604..1708..1711..1919..1920..2228..2229..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Lam.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.041530711610649
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7wULccRuh:002+XT731GRnXE7xccRuh
MD5:	CF6F44D9B5AF53B150D9439DD9D75B2C
SHA1:	236C9594054E310522C00F00C9DBCFCF654C1F9D
SHA-256:	8EAA02B60063A400B074526BC9AB095F8A1FB22569205FF8482B25D15BE3FD12
SHA-512:	6F840185EA483DA17A1E0643E13D4517394035DC318CC2E8F2C9A607F9318E0D78830470A2C8604AA2B67A2A1783E7E9123E6A6F228C6B5619B0E9974EDD4A4C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1604..1605..1717..1721..1898..1899..2214..2215..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\NoJoinin.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	774
Entropy (8bit):	5.128493427795274
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7bG+/IR8YchoN/RmovZHR:002+XT731GRnXE7H//Yd/Tv5w7ov2v8
MD5:	D3E249F3E623EA913F3BC8FEEE7EB399
SHA1:	A1C0763566B959823C4947FE055C177A4A752A89
SHA-256:	678ED74A4632A29E61C2E2B8EBF58E27CC4FC5B8B9024CDB7EDE12A32C8B4F23
SHA-512:	16BD36940B39A200FDFD2C87CB71E2B43BAE1353F5235AA5A2414ACCE4A32CE7091B6148640248B359C33F5E96B9C39E5D80C94AD1EE4B1A1DB1D7B58B31A0A7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V43..0..1568..1569..1570..1600..1601..1611..1646..1648..1649..1652..1653..1748..1749..1750..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1920..2208..2221..2222..2229..68288..68294..68295..68296..68297..68299..68301..68322..68324..68325..68331..68336..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Qaf.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.044796724994507
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7ah0J:002+XT731GRnXE7YW
MD5:	8FC52F47980408AE02438AC1EE66AFAE
SHA1:	C0093CD96CDCD55332009E985BAA586051832CEB
SHA-256:	CD2261DCB3BD1351027CF7FB7E2408786609620505B4097F1CB9EC8AE878740A
SHA-512:	E851018366A79D44B5A07A89F47239E31CBF2512D873BF0BE76CEA803EE68F26A90C59402C0924B8956DB348CE1A901537A0D8FDA20FF51C7DB19900203739A0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1602..1603..1647..1648..1703..1705..2213..2214..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Reh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.110025579107101
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7hGwutEUJWiczQ:002+XT731GRnXE7UDELip
MD5:	0454B8B696AD636A614C11DDA6513FB0
SHA1:	52AF16B558EBF17D3EBD572030108A346C7B0914
SHA-256:	17464C06667424E5655B58452CA9F04D2E2458FBB0F16718C1D4FADE5D375C56
SHA-512:	7BDAEE5C79F0D6167DB16CBF9A67114D1A6FB1D08C1602006FF0692E89167896F2FD208080D4A661CAD32EF4588D0FEEC41BC97172366E138B17C4BE2990314B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..1585..1587..1681..1690..1775..1776..1883..1884..1899..1901..1905..1906..2218..2219..2226..2227..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Sad.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.051941410951246
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Icwc43HD3FM:002+XT731GRnXE7mxHrFM
MD5:	F94B8219AA1997211BDFFBECFC3BD371
SHA1:	B980560C5A7CF9386C6E113638B0AB7347908BCD
SHA-256:	63395D629FF91AC0F0E02008B9955D4C911D845C03B7FA8F05AAC25AE416719D
SHA-512:	F4D845D0BFF1664410A7446878C8A6700DEE217EAB0F27F2301FB796FD783BB7AFC8D9B3B71804DAAB16BC353215D3DDD6D643A728435FC90FCF2367333595D4
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1589..1591..1693..1695..1787..1788..2223..2224..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Seen.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.087501884994715
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7fXgpYcxyzM:002+XT731GRnXE7/gy6+M
MD5:	9ADABEE511F4581325CB94CF29364533
SHA1:	458E3F5A949C80D5558C365820FAA6B6D25B54F5
SHA-256:	A8E0E19DC682AB43C47D04BC396E5085F9D120810A2FDE5E9F4489C4A93E62EE
SHA-512:	AE6C0B3F58099C95E30BDDA28AED936F8A819ED6EF88699F902ABB252EBEE310CF76E15AA1A23591A1F475A353C091F1ECF72062CCD8120A13E4388D4B07E7AE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..1587..1589..1690..1693..1786..1787..1884..1885..1901..1902..1904..1905..1917..1919..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Waw.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.108724547399666
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7c+n5HE8:002+XT731GRnXE7c+5k8
MD5:	1D3583AF379C09EC739BE193DAF6BBCA
SHA1:	67A2FB4E2FF9F47777DB6325D2DC262F4C862F17
SHA-256:	F54E9B102BBA9E2D6FD8DB8762A069E9F76397208FFA076C385678E091DF8A3C
SHA-512:	4B9B7C74D7ECF0E5EF1F1A5D30289321291C92D30E44054ABA4A4CA2F52F5469190F83E9B82BDE4114D917D3B23C88DA6D82045E2DA946E891F0C974345F2502
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..1572..1573..1608..1609..1654..1656..1732..1740..1743..1744..1912..1914..2219..2220..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jg\Yeh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.085167008731119
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7rg+RjxHM:002+XT731GRnXE7nRjlM
MD5:	F275C3CB82517EB8A8E4836DF0927047
SHA1:	D4838078BDDF770F77BA79259616DD354CCDA81E
SHA-256:	843299177073712397E06ADC92CA3C65EF2BED059353D84E8FA85CE45CD3C79A
SHA-512:	30D59A6F86BDE55CE7F42232987BAA24A579B9BCE84E279FF72927BB395B2890127F39591A8124D87B33D764BB97A3B500166FC6EA976E9A32B558118AA9FB37
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..1568..1569..1574..1575..1609..1611..1656..1657..1744..1746..1911..1912..2216..2218..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jt\C.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.034013027429457
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78PF6NdK:002+XT731GRnXE78PFuE
MD5:	E2FE82146A9857A26E6E9C621B4B03E9
SHA1:	9A298E4DB84A9E371F827562BB76A2360CD98E65
SHA-256:	14F86B324DE86DB44FEBF2F4A201D2B15F616460063B4218417C7A44D05C8348
SHA-512:	297063D892F3B6C6DE7BAF153C22A82780364E244C02E623493FC06273047AC95AEA8001CEB5DC8FC2B5D12B192247C0BC264095B6D9BC7C91B246B03AB8CE86
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1600..1601..2042..2043..6154..6155..8205..8206..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jt\D.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	4.8730783420071235
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE74YWRBA3nB8yEMF+AiYiv9PPq36qD5J9gpN7H:0z+XnEnrFRB4tZ+AiYY3w6qlJ9gpN
MD5:	255236202B4134E97A5276F5FC74643A
SHA1:	06720CFAA315A06309744948A0EF1E1C79CE6C90
SHA-256:	2C38E625B3B05F65D56C1E737C08BA17A3093575AEB7C90D34BCD2BE18177E4C
SHA-512:	222FC12A5D3FE4FE1733B159494DBD5AD7E63F38DE6E3EB546157B88B370133BE376EC4B421859B40547FE26DF314BBEB62911F9BEEA61A33A572096B611B9FF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V106..1568..1569..1574..1575..1576..1577..1578..1583..1587..1600..1601..1608..1609..1611..1646..1648..1656..1672..1690..1728..1729..1731..1740..1741..1742..1743..1744..1746..1786..1789..1791..1792..1810..1813..1818..1822..1823..1832..1833..1834..1835..1836..1837..1839..1870..1881..1884..1899..1901..1905..1906..1907..1909..1912..1914..1920..1994..2027..2113..2118..2120..2121..2122..2132..2133..2134..2208..2218..2223..2225..2227..2229..6151..6152..6176..6264..6279..6313..6314..6315..43072..43122..682

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jt\R.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.903866101816208
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7WWRpakBSEXZMF8UAiU+sWgov/FUPc7MO:0z+XnEnuRSiGzAiUfWt+PY
MD5:	B194536FB2A91827A432DD09B0B74E3E
SHA1:	7E8E55C1AC4EAD019A02592D7A58A35B7E1EC857
SHA-256:	B3A79484ECA0B257F2426D5BAFD40767F256ADDA168CAA4026BE0D5DD69B4973
SHA-512:	B2ECF58CA35051DD0CA6104C368990559787CB364CC301F831ABF27008BA7F91377E237C627ADFD555D052FAEC25FBA59E68DEC6ADE7C63A5ADB01A1E896DE64
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V100..1570..1574..1575..1576..1577..1578..1583..1587..1608..1609..1649..1652..1653..1656..1672..1690..1728..1729..1731..1740..1741..1742..1743..1744..1746..1748..1749..1750..1774..1776..1808..1809..1813..1818..1822..1823..1832..1833..1834..1835..1836..1837..1839..1840..1869..1870..1881..1884..1899..1901..1905..1906..1907..1909..1912..1914..2112..2113..2118..2120..2121..2122..2132..2133..2218..2221..2222..2223..2225..2227..68293..68294..68295..68296..68297..68299..68302..68307..68317..68318..68321..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jt\T.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4100
Entropy (8bit):	4.125721920018035
Encrypted:	false
SSDEEP:	96:0zoEnxV8cDiXmCNm+hDMC8TspCKl0LnRUe9x5YBdNyZ9eJEgJ:iZxV8cDi2Cg+i/scfbRDvuMMJ
MD5:	C8FD8656027DC25BECF4E41E59423971
SHA1:	85259AD18CE672121A1A83AACA3D6C0DBA85E883
SHA-256:	46D71BF399E33BBF53E919396112239CFCC7375392EADBAB9CC41358C4D3986A
SHA-512:	6328764D76471FD340C9B9EF84CB6FBCBFF37D356B58A7AB47FEC30ACE440A4596E40429A8B2F1BED2395968EA220D3F605793C7814D7F6E1E4E873A5AA3E590
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V556..173..174..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1564..1565..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1807..1808..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2307..2362..2363..2364..2365..2369..2377..2381..2382..2385..2392..2402..2404..2433..2434..2492..2493..2497..2501..2509..2510..2530..2532..2561..2563..2620..2621..2625..2627..2631..263

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Jt\U.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4323
Entropy (8bit):	4.102196774598386
Encrypted:	false
SSDEEP:	96:0zoEn+x8cDiXmCNu+hDXC8TspCxl0LnRUvrWx5YBdNyZ9eJEgJ:iZ+x8cDi2C8+p/scYbRi4uMMJ
MD5:	AD8E9F3ADCAA4424A9BBE7A56D32BC4B
SHA1:	4F3C679EA631EA8BFC8F2C8358BE6B8AA4BBD36F
SHA-256:	EBE142372AF34DA61BA03325820BE28D27E9D78FCF3ED5F6B14D6CECF714CEC7
SHA-512:	DDF914CBB67A0286B523788DDD54FDD516111D09299C6CA554FFF1DAC845C5447A095120259CBCEC96122F72F6AC33E2E9263A9EC4C82A3EC738658A2F421C98
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V591..0..173..174..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1564..1565..1568..1569..1570..1632..1646..1652..1653..1748..1749..1757..1759..1765..1767..1769..1770..1776..1786..1789..1791..1792..1807..1867..1869..1920..1958..1969..1994..2036..2042..2043..2070..2074..2075..2084..2085..2088..2089..2094..2112..2134..2137..2140..2208..2221..2222..2229..2275..2307..2362..2363..2364..2365..2369..2377..2381..2382..2385..2392..2402..2404..2433..2434..2492..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\AI.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1816
Entropy (8bit):	4.548779784595187
Encrypted:	false
SSDEEP:	48:0z+XnEnjqmxK9qsdcfRrxxB8ciBkp+2EEy:0zoEnjzsqs8Nf8rBkpiEy
MD5:	2C1612B7ACBC08FF5DCA38467FD03BDA
SHA1:	4EEE3D61A7BF5AFC034CE2F49027F1293FA12A0E
SHA-256:	3484814CF72B1C0F7FBD301503A2A17810A24240C9BFA26AD98D5CC407110619
SHA-512:	D17054C403DE392553B88424B29B77931B02DE41F7E29169802491D1E8242388888EA04CBEE0FC72847EE91E4555F249A704824086C8966C62640485F87F985B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V218..167..169..170..171..178..180..182..187..188..191..215..216..247..248..711..712..713..716..717..718..720..721..728..732..733..734..8213..8215..8224..8226..8251..8252..8308..8309..8319..8320..8321..8325..8453..8454..8467..8468..8481..8483..8491..8492..8532..8534..8539..8540..8542..8543..8544..8556..8560..8570..8585..8586..8592..8602..8658..8659..8660..8661..8704..8705..8706..8708..8711..8713..8715..8716..8719..8720..8721..8722..8725..8726..8730..8731..8733..8737..8739..8740..8741..8742..8743..8

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\AL.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	3.8241312425197402
Encrypted:	false
SSDEEP:	192:iZQmgqE4ukR7ihCg/l8+8KC5/LK2sI20nnyI2KSC029Nt2LMX3w:iZLgf4ukR7i7e5z2I20nnyIX/VQ
MD5:	B784533BBDFB900E2499EBD34FA46FA6
SHA1:	5D4B709C3389794F23507AFC16898AE64034A20D
SHA-256:	C3574603D06D003EAB1E8B275F70145BFAC3D6A3B2D03AD946720A3651C46373
SHA-512:	21D18742CA909746D23F2BB37CCF71A751E593FC7CCB50D006E1083780541CDB9BA609403E9F19704B895C061F1A7E9C87D3FCEAF86F1C3579B519FB594A67C1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1396..35..36..38..39..42..43..60..63..64..91..94..123..126..127..166..167..169..170..172..173..174..176..181..182..192..215..216..247..248..711..718..720..721..728..732..733..734..735..736..768..880..888..890..894..895..896..900..907..908..909..910..930..931..1155..1162..1328..1329..1367..1369..1376..1377..1416..1421..1423..1472..1473..1475..1476..1523..1525..1536..1545..1550..1552..1568..1611..1645..1648..1649..1748..1749..1750..1757..1759..1765..1767..1769..1770..1774..1776..1786..1806..1807..18

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\BA.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1623
Entropy (8bit):	4.679501002393826
Encrypted:	false
SSDEEP:	48:0z+XnEng7o3yq6sYuT4vBqseC7e48jVbiB:0zoEng7k886eCq48g
MD5:	A5F7661D160639B35BE51F696681D3BB
SHA1:	D4F4A26E4484321E3F2D5DFF3C18D43B8A29B288
SHA-256:	705E58309A730CE5409F795DC6381AC60F18F400FA2C48CBEC32FA9D566AF8CE
SHA-512:	82F7774FA4B1AB9D861DBDD7874C48BEED3FB47BA854C8F13E5A0C42814D8F13D1084930B83AF0991AC57DBBB0153A6B079DA3C990C3E8267992763E376A5515
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V170..9..10..124..125..173..174..1418..1419..1470..1471..2404..2406..3674..3676..3851..3852..3892..3893..3967..3968..3973..3974..4030..4032..4050..4051..4170..4172..4961..4962..5120..5121..5760..5761..5867..5870..5941..5943..6100..6102..6104..6105..6106..6107..6148..6150..7002..7004..7005..7009..7227..7232..7294..7296..8192..8199..8200..8203..8208..8209..8210..8212..8231..8232..8278..8279..8280..8284..8285..8288..11514..11517..11519..11520..11632..11633..11790..11798..11799..11800..11801..11802..11

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\BB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	701
Entropy (8bit):	5.149778291441607
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MXSluzoue3rqvd6:002+XT731GRnXE7+Sl0o57Ud6
MD5:	12218F6F6AB22F9DA51ACD0BF2C4D143
SHA1:	6A6CFA4A08FAC59816A9F76DA5514EA71165EA5D
SHA-256:	CDC1D98EB5F9F2116253F03992302756441D8F153E03C5A41B0E3163659B4655
SHA-512:	97D80B89BC1E9BC2D68F9477EFDEAFDBBE6FBD54706D60A4C7CB42B6EC93EE73780CA7452D3DD8E4A4CABFC8B58809FD04FC420CBB45C6BA0D797391583FF51D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..180..181..712..713..716..717..735..736..3841..3845..3846..3848..3849..3851..4048..4050..4051..4052..6150..6151..8189..8190..43124..43126..43260..43261..70005..70006..70107..70108..71105..71106..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\CJ.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	857
Entropy (8bit):	5.0268489836496615
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7xbOpcQsAdHJvYsouh0M:0z+XnEnySRNzgi
MD5:	DF487DFA08F519AF7EB3C36C9D842054
SHA1:	A00B0CF81342D0C747EA20AFB79AD69160F79110
SHA-256:	901BA5D5D4FB8CF903222C2877A426FD575B7974607C0D71A0E89F7940A37A47
SHA-512:	69164657344052A02B36D79AD2EC3DC364924414B9FAAF33D0EFFB60ED3BCC2C9BB72F7D6ECFBEDEA8795B4DA414F64B0C76E4939778AB8D498B9C484E521D0A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V50..12353..12354..12355..12356..12357..12358..12359..12360..12361..12362..12387..12388..12419..12420..12421..12422..12423..12424..12430..12431..12437..12439..12449..12450..12451..12452..12453..12454..12455..12456..12457..12458..12483..12484..12515..12516..12517..12518..12519..12520..12526..12527..12533..12535..12540..12541..12784..12800..65383..65393..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\CL.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	4.6563039159049
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7Au34payRygdz8UFCtxmyy14HLW5yb+tyqQqe8cedxCX:0z+XnEnE4payRyHWkjS4+J1ceWX
MD5:	362E1489CC11905B93A30A2129A1B7E4
SHA1:	047FF185DAA48FF01F0BB191E11DC8C515337085
SHA-256:	149930853AA5DD2636C36E75292139BE256938AE226C1344597F040C6BBFC654
SHA-512:	522DB5C756DBE4EC672C319D1BCDEF77C409725789182D8F2051AD930FE88E87A42D80DB65B2A41E2FD0031412988B64B38BBE79E9D5E069323BD030EEB17F07
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V164..125..126..3899..3900..3901..3902..5788..5789..8262..8263..8318..8319..8334..8335..8969..8970..8971..8972..9002..9003..10089..10090..10091..10092..10093..10094..10095..10096..10097..10098..10099..10100..10101..10102..10182..10183..10215..10216..10217..10218..10219..10220..10221..10222..10223..10224..10628..10629..10630..10631..10632..10633..10634..10635..10636..10637..10638..10639..10640..10641..10642..10643..10644..10645..10646..10647..10648..10649..10713..10714..10715..10716..10749..10750..1

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\CM.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	4.2247862310180215
Encrypted:	false
SSDEEP:	96:0zoEnghUUjQviXMzlv5GqdrDo8YspCseI26whQN9eJEgJ:iZghdjQvi8zlvj2scbIJJNMJ
MD5:	EB9EB5202B911E971D0E00E5C3DA8553
SHA1:	D07AE1D6D76AC88F1D92A8701AD3BC60AC1650FE
SHA-256:	C83F55B91E6032506BA0849742E34D4ABCEDB74472957B8F3870C242DB379615
SHA-512:	5A427B6972FF3E31440CC60E74352FF3B40B738B5FD359C6348B6F602DA482D7D48906DF63749BF97E841B7098C97FD8285A8A8F24D2666F42CBC47DE21BF16F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V446..0..9..14..32..127..133..134..160..768..847..848..860..867..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1564..1565..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2308..2362..2365..2366..2384..2385..2392..2402..2404..2433..2436..2492..2493..2494..2501..2503..2505..2507..2510..2519..2520..2530..2532..2561..2564..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\EX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	797
Entropy (8bit):	5.096393719715944
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7nlc5yeMBVHYVv66vJl5J:002+XT731GRnXE7lc5yeI96vNS5I
MD5:	600D9D142DE782232BA0BB0DB4DBA08C
SHA1:	2D7411CAD2C68092C91DE0C04A29764C10FB2400
SHA-256:	CF00A9EDA8B3A09FB0B906B83F55FAE91E055EC6ECE9EA689A0BBBB64B6CF924
SHA-512:	845700FC16E95F915264A6CDD941740BEA4C631291EF0DF486A8AB303BBDDC8E6B017CCE0695CE21AECC755D26B24A9F160C3D0DF48798FA505495C2050BE43B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V46..33..34..63..64..1478..1479..1563..1564..1566..1568..1748..1749..2041..2042..3853..3858..3860..3861..6146..6148..6152..6154..6468..6470..10082..10084..11513..11514..11518..11519..11822..11823..42510..42511..43126..43128..65045..65047..65110..65112..65281..65282..65311..65312..71108..71110..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\GL.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.13870550800758
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7cPMED35lUQeQltFV:002+XT731GRnXE7uXD35GQlTV
MD5:	4082757BAD07CE6745E26BB3D3DB51AB
SHA1:	2B05E7D6339271E0C364574F3A9EEAE435E4691C
SHA-256:	CBAE288472087B24296B9569CB8E1C0D4F1F6B641DD0D62F41C335D35D0353EE
SHA-512:	F878ECD760B07D6BE22636F690FCCB78F64123A3961C5740B906F1BC199E9A7DDA08E5033694890CEBC81DCA7819614CB568E3696A04B7EB6E70CBDD1EC08378
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V22..160..161..847..848..860..867..3848..3849..3852..3853..3858..3859..4057..4059..6158..6159..8199..8200..8209..8210..8239..8240..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\ID.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2260
Entropy (8bit):	4.437305028222601
Encrypted:	false
SSDEEP:	48:0z+XnEnaOCkjC7XRNIcJId+sucQ6fav7bXHiNnlpth:0zoEn9CkjC7XRXJ+/Yb3iN3P
MD5:	77E895FE87CA880AF694FEF3459453BF
SHA1:	6A3DFDA50429897FB5A2DA10CD37F5A80C152821
SHA-256:	813C4920CFFC7971716FB3C3BC4F2EFCC45ABEDD643E7EFCD3AE38BFF918B882
SHA-512:	B91817A10F80FEA7A256727F931D02EE9D7DEBEBCAB017F8E2B45A33A4BB53D9964690D3BF714A08C48380C532650DB667605F456DD8FF9AFA487D8A6B3147E3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V246..8986..8988..9200..9204..9728..9732..9748..9750..9752..9753..9754..9760..9785..9788..9832..9833..9855..9856..9917..9929..9933..9934..9935..9938..9939..9941..9944..9946..9948..9949..9951..9954..9962..9963..9969..9974..9975..9979..9981..9989..9992..9998..11904..11930..11931..12020..12032..12246..12272..12284..12291..12293..12294..12296..12306..12308..12320..12330..12336..12341..12342..12347..12349..12352..12354..12355..12356..12357..12358..12359..12360..12361..12362..12387..12388..12419..12420..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\IN.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.058126751206636
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7cnvnv:002+XT731GRnXE7E3
MD5:	74CA1B74BD5E423B95F19805090EE137
SHA1:	20847C73303490AFACA63F65F7305108A880960D
SHA-256:	C16A304FFB148FB81E2548CA2B306FBA7D258BF78EDCA01C070E3336DEAC91A9
SHA-512:	62F5ABEB232C262FD76EB73E6B432C06046A4A59316543875E4639BD33968772517529DFB3C48AD60C087C09574D99A18555758A80D92F7CCB13F216B9A42309
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..8228..8231..8943..8944..65049..65050..68342..68343..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\IS.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.107233110304652
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HxeEVoA:002+XT731GRnXE7Hxp3
MD5:	4F9847056A8E39C16CFC4829215E8D75
SHA1:	7793386B9620957D63CB1E14A40FC0F481310BA1
SHA-256:	DB0D87CB6367324C9F5D36D2B602F06B8C32677FA8A68E92CDCB8846FCC548B8
SHA-512:	5796E498FDDD6D05F8CC1DE07A0B40E5D9B6930838B2DB183629C40065EABD41782D0989B416ED75BFEF485230EC6510AF3788D45C83EA0836CFC4FBE710AF64
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..44..45..46..47..58..60..894..895..1417..1418..1548..1550..2040..2041..8260..8261..65040..65041..65043..65045..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\NS.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	727
Entropy (8bit):	5.158984872610853
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7M3RAOVyK38ovz3JEGrJq:002+XT731GRnXE7QsKpvz3JE48P
MD5:	970D159AAED9DF81FF110DDFD2DE27B3
SHA1:	2C4E445A168D26B2EDC89AA0091A446F8EF8780E
SHA-256:	236A907B4D6CFF08AE4961D8A8F64464DB484D6899E945F3CC7E60396E0D162E
SHA-512:	C8B2D8AE11DF3E2F7CA8D908421414F7FF2576739B6DD1C31FB754E25A3EDCDE8A4D4FBF49234CD287811E344C1243BC8D9CC09F70C4F162EE93A705853FD62A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..6102..6103..8252..8254..8263..8266..12293..12294..12316..12317..12347..12349..12443..12447..12448..12449..12539..12540..12541..12543..40981..40982..65108..65110..65306..65308..65381..65382..65438..65440..128633..128636..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\OP.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	4.642521710770191
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7Jayhlbbe34ZrRBXgdz3UsytxLyCHLKvjSV9ca:0z+XnEneayhF84ZrRBXsg5X2Cca
MD5:	C880D64E80323DA1F218361E9719443F
SHA1:	08C42409916DC28BEAD4889CDAD878C0DBF7CD92
SHA-256:	EFA944257916132452179CDFB9B9942E2888483C7A7E4DD948C1B8D6F90480A7
SHA-512:	D8CA0E24AC00A1960E18E065430BD1AC29E2E62BEB7A7CE8CA5CA708A7AA773281D6013945F0473B64D70ACC45B501B70E23436A31E023806E36C5B21011F5E1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V166..40..41..91..92..123..124..161..162..191..192..3898..3899..3900..3901..5787..5788..8218..8219..8222..8223..8261..8262..8317..8318..8333..8334..8968..8969..8970..8971..9001..9002..10088..10089..10090..10091..10092..10093..10094..10095..10096..10097..10098..10099..10100..10101..10181..10182..10214..10215..10216..10217..10218..10219..10220..10221..10222..10223..10627..10628..10629..10630..10631..10632..10633..10634..10635..10636..10637..10638..10639..10640..10641..10642..10643..10644..10645..1064

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\PO.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	749
Entropy (8bit):	5.133976567085964
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7W4lygkNse5SaDzsjJFm4:002+XT731GRnXE7WXNse5SOqd5
MD5:	FCEF8C32DECBA53DD4AACB4573C8A7A5
SHA1:	5743E39D4102DC6E883BDA54DD44B93713DAB453
SHA-256:	39C746F42BFC8A855810958F625465C0028A70816822FC9121AE55C22791DDAF
SHA-512:	D3A45D920872D0FE590C56CB3BBB82C92F226EFBCD1FE813F689A7D9FD51883325672565614F2061A0BF1AFA1DFE2FE0EE0A4B65CD638E3B9C9EBD848A509990
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V40..37..38..162..163..176..177..1545..1548..1642..1643..2546..2548..2553..2554..3449..3450..8240..8248..8359..8360..8374..8375..8379..8380..8382..8383..8451..8452..8457..8458..43064..43065..65020..65021..65130..65131..65285..65286..65504..65505..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\PR.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	763
Entropy (8bit):	5.140077342714072
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Evwhm5LOMGKvP6tuF5Sb:002+XT731GRnXE7GwhyOv45SO5OyHK4w
MD5:	4BB2548F440BF99483F2AA5F0E1F4FBF
SHA1:	6839F0AE205BF19F4A2C34CE8F4544646A626551
SHA-256:	E4A4C620CDB0660F6E5B578508398111CF6DB4C5072E41BCBC6FEF794CCE1582
SHA-512:	76D1311E55ED8C2FA65962E8E133C71CF1414E5729D951F6178EC70AA5B8E9825EEF83B96635A43E56839DB119F56CB0EC34BE4A4BF10E2A10A5512A6FB8B9F0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V44..36..37..43..44..92..93..163..166..177..178..1423..1424..2555..2556..2801..2802..3065..3066..3647..3648..6107..6108..8352..8359..8360..8374..8375..8379..8380..8382..8383..8400..8470..8471..8722..8724..65129..65130..65284..65285..65505..65506..65509..65511..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\QU.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.123242613822754
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7fMYUAFpRUfEnL+v:002+XT731GRnXE7fSA+fgQ
MD5:	D1AD9319F062F6C147D4F4C86FF3F2EC
SHA1:	324DF1EB1F17CDFD955EBA6C02A87CE2507CB63F
SHA-256:	5B7597E7E78756489D36F3ED15BBF97717BA32D958D177477AF50205F664ACDE
SHA-512:	AAAC8A68E9A2CAABEAF97143E41DE919D2230BCB577C5BC96EB438C0D906DC04E10C1060D9471CE02C973F6DFFCD7E303622D29C032BB4A2056F3905AF56E172
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..34..35..39..40..171..172..187..188..8216..8218..8219..8222..8223..8224..8249..8251..10075..10081..11776..11790..11804..11806..11808..11810..128630..128633..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\SA.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	4.965673580997459
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7nvV+O6vb2BWivvjZjSLKQElM:0z+XnEnDb6gOvjULKQH
MD5:	37AAB474636CA5EC1A61680B3EC597D1
SHA1:	F0430D6FB609461200980231FF8349AC0446207A
SHA-256:	58F0C210075625E7AB8334385817B0D15475450359A03BF506AB5EEFEC0929E7
SHA-512:	824615F35553850CB258F8DCAB6F5AD7FF7BF7AA10B80A162C791941FDF7206584A454FCAADD8C96ECD27F5A404DC680D597BAB3BD1D41350B13CA58F55AB23E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V84..3585..3643..3648..3663..3713..3715..3716..3717..3719..3721..3722..3723..3725..3726..3732..3736..3737..3744..3745..3748..3749..3750..3751..3752..3754..3756..3757..3770..3771..3774..3776..3781..3782..3783..3784..3790..3804..3808..4096..4160..4176..4240..4250..4256..6016..6100..6103..6104..6108..6110..6480..6510..6512..6517..6528..6572..6576..6602..6618..6619..6622..6624..6688..6751..6752..6781..6816..6830..43488..43504..43514..43519..43616..43715..43739..43744..71424..71450..71453..71468..71482.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lb\XX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8628
Entropy (8bit):	3.85884963702136
Encrypted:	false
SSDEEP:	192:iZwVjWErjvipBLaxabMftr+wc/DvC0Y9Q/IeilFahBA8ZALMCbJ:iZ0K2j6pBLaxabMVr+wcu0I0Ieili7nM
MD5:	5BD4D0C869FE17AF644B08BC1B75B501
SHA1:	DBAA7802617629249E9DF14AFCD9A6A6F1ADE189
SHA-256:	F4C7C01B007F6926A927AEF402BBE7079985410E029DFF91469DE37320450597
SHA-512:	83158E71BDA2833F925DCEED1F172CF925922C69DFF53FBB56BE7EC21747415310BE19F8460B64D2116AC3497294D476F6B9F558EAD822A41B81EA0F4B12ABA5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1207..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602..26

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Lower\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8277
Entropy (8bit):	3.8088702542513966
Encrypted:	false
SSDEEP:	192:iZR21lEkjEWnyQHxZ4+BTp45rVBSxP0tkDiR73u0gpP:iZR21SgJtTKVID+7+B
MD5:	BA48E61F8B11DF4CE64C1AD4B35C0D65
SHA1:	9692BFFDEF9FBD6FDAB198F289D252099C65A2C4
SHA-256:	05059779F7E0B516ECB81EFE4FFF889945B85228AD2A68A87E816E3219C83411
SHA-512:	74257B6FF22450A3AA129508B730E1197E1D6F88B4BFD237B0575C6F260F178640885873BA86595ED523DB76F2133E7F82A5EF692BDA82DA77E21CEFB7B4BEA0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1274..97..123..170..171..181..182..186..187..223..247..248..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..34

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Math\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	4.413379095843735
Encrypted:	false
SSDEEP:	48:0z+XnEnip9Hh4q1MjRvJTks8X/hvr/clF9v3+b5E3l40nLcQKJImEBl6RkJ:0zoEnkCKMt94/hvr/QvkLg/a+
MD5:	4E19892742FFC89E9AB97711B2059BCC
SHA1:	37BCE6E34681764BE645C761D0B7F59E0C775C42
SHA-256:	4DFF7D1778833DC517F256A07FF329D7252F1EF1DE2E423963D7453676D7C8A5
SHA-512:	BFBF88326D1C90008016C88D7395525FB9421413AA8A7E35EE8D5F85E6F8F77E3CEC34C53AB38829064AA906B0DAC31E9C0ADEB45D361CA23FBA06E3CEA23B23
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V276..43..44..60..63..94..95..124..125..126..127..172..173..177..178..215..216..247..248..976..979..981..982..1008..1010..1012..1015..1542..1545..8214..8215..8242..8245..8256..8257..8260..8261..8274..8275..8289..8293..8314..8319..8330..8335..8400..8413..8417..8418..8421..8423..8427..8432..8450..8451..8455..8456..8458..8468..8469..8470..8472..8478..8484..8485..8488..8490..8492..8494..8495..8498..8499..8505..8508..8522..8523..8524..8592..8616..8617..8623..8624..8626..8630..8632..8636..8668..8669..867

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFCQC\M.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	993
Entropy (8bit):	5.019222057494439
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7obgqFU/jXkoQTonfspLolf:0z+XnEnRVSXRuEU+lf
MD5:	783DC96CBDCA96ED2B5848ED74025C3C
SHA1:	B01873725F3480108AAC6FBA074552B10ED1BEC5
SHA-256:	0A6A9B6C9959BB4AFD897F9EC6B643109C6CD5BC2B71C94425CE8C9FCF927668
SHA-512:	1661ACE58D245DE8AF7607C45B722ED17D9E8707923DF74DF31153D58E8DDF89293B68B9350533D76B3F96FEA5C3632A42794830883D05B8FBE9C602EC5C37C7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V82..768..773..774..781..783..784..785..786..787..789..795..796..803..809..813..815..816..818..824..825..834..835..837..838..1619..1622..2364..2365..2494..2495..2519..2520..2878..2879..2902..2904..3006..3007..3031..3032..3158..3159..3266..3267..3285..3287..3390..3391..3415..3416..3530..3531..3535..3536..3551..3552..4142..4143..4449..4470..4520..4547..6965..6966..12441..12443..69818..69819..69927..69928..70462..70463..70487..70488..70832..70833..70842..70843..70845..70846..71087..71088..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFCQC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.577348290833217
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7cbgeAU/0THOXk/QToCa+oCmFfsYJX3IkLLFYrywZdPy0eolkQ:0z+XnEndIjTuXiuQFUYJIkhwZN7ly+
MD5:	9EBBD2B2FF7F0A4AB511C5340F964033
SHA1:	741FFFFB99CBC052E6622D432F1B4E8C4E84D6ED
SHA-256:	9670593F3887A48E377791028E28B1516AE87852A9FC2B75BEA793D7DBA42EBE
SHA-512:	C5EEDBE3AA502D385E983385E2AF7BB022A07851D0306D6E4BCC9271486C9043B9C9DC604E2550DEA21D3044D1E84D8EDEB69C1671A7875FA1F7B06B2DAB0851
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V223..0..768..773..774..781..783..784..785..786..787..789..795..796..803..809..813..815..816..818..824..825..832..838..884..885..894..895..903..904..1619..1622..2364..2365..2392..2400..2494..2495..2519..2520..2524..2526..2527..2528..2611..2612..2614..2615..2649..2652..2654..2655..2878..2879..2902..2904..2908..2910..3006..3007..3031..3032..3158..3159..3266..3267..3285..3287..3390..3391..3415..3416..3530..3531..3535..3536..3551..3552..3907..3908..3917..3918..3922..3923..3927..3928..3932..3933..3945..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFDQC\N.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3364
Entropy (8bit):	4.20030592304336
Encrypted:	false
SSDEEP:	48:0z+XnEnsea+08VaNW5npaZZur5jpLGc+uuj6KxIrgrJjrwZNMxOBt7E+:0zoEnseab8smvFMKSnfKt7E+
MD5:	3953A08FE3678B58725DD3C01B7DC826
SHA1:	CF7395C56A547D340F568EBCF1C0A5DDC73ED6B2
SHA-256:	9FD343E1C2DDC2B6A80E9FA7CF21B63C3974D114D8FA57700AFFD41847A51B4D
SHA-512:	5D8DA7DCC498C29F661D5B73C924AE0A36BF9CC0B3899180337552415F9D9302FE07994E3C65066E07758C14A4676746C27FF6F46989B7D8739B1521F3607E75
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V462..192..198..199..208..209..215..217..222..224..230..231..240..241..247..249..254..255..272..274..294..296..305..308..312..313..319..323..329..332..338..340..358..360..383..416..418..431..433..461..477..478..484..486..497..500..502..504..540..542..544..550..564..832..834..835..837..884..885..894..895..901..907..908..909..910..913..938..945..970..975..979..981..1024..1026..1027..1028..1031..1032..1036..1039..1049..1050..1081..1082..1104..1106..1107..1108..1111..1112..1116..1119..1142..1144..1217.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFDQC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3367
Entropy (8bit):	4.199657477300339
Encrypted:	false
SSDEEP:	48:0z+XnEnMea+08VaNW5npaZZur5jpLGc+uuj6KxIrgrJjrwZNMxOBt7E+:0zoEnMeab8smvFMKSnfKt7E+
MD5:	9E904B32AA47E31DC91DC0E0F51EA42E
SHA1:	7D897A26D55B9599FB9E3C23B6E1E61B26E71845
SHA-256:	4140E1883221DE777BBD73EC28DBBB3145FE675FED23739AE7D9B7A352A45A19
SHA-512:	D55523FF0B1210EBF807D80696F49E046F9C27004F1703FA34C939CE8158774F52CD0310A413EF2DD3BF0C09B8B929322D7727FB802B04B567A7DE10DF13F857
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V463..0..192..198..199..208..209..215..217..222..224..230..231..240..241..247..249..254..255..272..274..294..296..305..308..312..313..319..323..329..332..338..340..358..360..383..416..418..431..433..461..477..478..484..486..497..500..502..504..540..542..544..550..564..832..834..835..837..884..885..894..895..901..907..908..909..910..913..938..945..970..975..979..981..1024..1026..1027..1028..1031..1032..1036..1039..1049..1050..1081..1082..1104..1106..1107..1108..1111..1112..1116..1119..1142..1144..12

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFKCQC\N.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3836
Entropy (8bit):	4.1555267984191335
Encrypted:	false
SSDEEP:	48:0z+XnEnU4gm6lmI5KwSJqRnUPWPj+d5lLxeAxmkK68wZkQ2phHR9v3+b5E3l40ns:0zoEnU3m6JKwGyUlLeAxpr8J9vkLg/aR
MD5:	6D6948BCCD9F70D998E773DF3CA2B619
SHA1:	629DF9589A1BFF0DF913745651F37BB193E1EF4D
SHA-256:	DE2FF7C26295558F3877C8FF814C295FC581CC7FBE9B1F94E7D73A91E9AC2661
SHA-512:	149D8D1494E02E77C6F6B5EE70B2868CA8540B353B89179A2C8A5F8CC11F22A65689F21F9BE86D7046BC35E5AD86F19D59EFD2AF87BF96327CA609CAEC7AEA49
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V498..160..161..168..169..170..171..175..176..178..182..184..187..188..191..306..308..319..321..329..330..383..384..452..461..497..500..688..697..728..734..736..741..832..834..835..837..884..885..890..891..894..895..900..902..903..904..976..983..1008..1011..1012..1014..1017..1018..1415..1416..1653..1657..2392..2400..2524..2526..2527..2528..2611..2612..2614..2615..2649..2652..2654..2655..2908..2910..3635..3636..3763..3764..3804..3806..3852..3853..3907..3908..3917..3918..3922..3923..3927..3928..3932.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFKCQC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4281
Entropy (8bit):	4.107035973885893
Encrypted:	false
SSDEEP:	96:0zoEnH3mUfqXJiMKwGyUlLeAxzr8Gly9vkLg/aR:iZH31y5iUGJeKy9cLMo
MD5:	0911E428B3EB763BBD353F11D5D7E7ED
SHA1:	FDD554D3C614197B4F3B1A0F808F9B6EA7CDCC76
SHA-256:	71C0817D53D95C338AAA461EC60E6A82F8767049457F7E1B116A9C6DBB41C279
SHA-512:	62D2F52E3BD2019A34FC58395997D58ED755C95C7B85E5DC986457C82D15BFA6FC9D4754662B535CF1F2206879E389A90755AB47DF3A98834A142552BCFC0B8C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V573..0..160..161..168..169..170..171..175..176..178..182..184..187..188..191..306..308..319..321..329..330..383..384..452..461..497..500..688..697..728..734..736..741..768..773..774..781..783..784..785..786..787..789..795..796..803..809..813..815..816..818..824..825..832..838..884..885..890..891..894..895..900..902..903..904..976..983..1008..1011..1012..1014..1017..1018..1415..1416..1619..1622..1653..1657..2364..2365..2392..2400..2494..2495..2519..2520..2524..2526..2527..2528..2611..2612..2614..26

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFKDQC\N.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5588
Entropy (8bit):	3.9816204094054597
Encrypted:	false
SSDEEP:	96:0zoEn03qaob88mKXFUl5eAx5FMKNBLPKt7E9vkLg/aR:iZ03qV88W3lTPKG9cLMo
MD5:	A051BFCC0EA439EB9CD9C1453427A12C
SHA1:	1A8035C794B19BFFDD21696DF6EDFB341FD6D91C
SHA-256:	37D154B60C270616A0F5778822C6E02B4EFFB547842D3FDD197A994479DF4C7A
SHA-512:	36946AA771D5B9C27E27334EDC4F08A5A5DC78825B386F9FFBFEF00A774A28F8BB141BEDFD49DED64B790F83370A87ED974700FE9B01036A42DC8C417BF569B9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V780..160..161..168..169..170..171..175..176..178..182..184..187..188..191..192..198..199..208..209..215..217..222..224..230..231..240..241..247..249..254..255..272..274..294..296..305..306..312..313..321..323..330..332..338..340..358..360..384..416..418..431..433..452..477..478..484..486..502..504..540..542..544..550..564..688..697..728..734..736..741..832..834..835..837..884..885..890..891..894..895..900..907..908..909..910..913..938..945..970..975..976..983..1008..1011..1012..1014..1017..1018..1

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\NFKDQC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5591
Entropy (8bit):	3.981084239181625
Encrypted:	false
SSDEEP:	96:0zoEnq3qaob88mKXFUl5eAx5FMKNBLPKt7E9vkLg/aR:iZq3qV88W3lTPKG9cLMo
MD5:	D719746B94BBD550575B08F978D5F52D
SHA1:	73DE8C007AD9261BD23F9B764D2E7FBA64F368F7
SHA-256:	DEA87BEE3D597971ADA50831EFF7286DE1FEDB27CCF287A75F4FF743384F892A
SHA-512:	F29A432BBAAB4CE4A30C9BA864BB9BD5012BA04CC19E4AA88113CEAF609E6203551827098A9F099DE6D6E43D0528D8E772A2CBBD5B2F77E55F47F4DB28475D89
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V781..0..160..161..168..169..170..171..175..176..178..182..184..187..188..191..192..198..199..208..209..215..217..222..224..230..231..240..241..247..249..254..255..272..274..294..296..305..306..312..313..321..323..330..332..338..340..358..360..384..416..418..431..433..452..477..478..484..486..502..504..540..542..544..550..564..688..697..728..734..736..741..832..834..835..837..884..885..890..891..894..895..900..907..908..909..910..913..938..945..970..975..976..983..1008..1011..1012..1014..1017..1018

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nt\Di.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	759
Entropy (8bit):	5.142534249027671
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7r/S7hvIGFWiNdKcaRTwT:002+XT731GRnXE7jmhQyccaRrUB
MD5:	A67E5DD6ED019EFF2E08804AF9D50EA1
SHA1:	CB88AA94A438C178AEC3472BE5CFA33CCFF0B6A7
SHA-256:	2873AF355FB959862A180242D411C3079AF59454CAD65FAE5A6FDD489D910F4F
SHA-512:	DEA34A285626E76AC2F2EAC7AC9EBD0713647FDF65D69DC16E6DF8755766EA4FE5B5BC4F8D13AB4EC7DA0C41CB487082B791733F9DE08BC00B2B0F69C8F353BF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V40..178..180..185..186..4969..4978..6618..6619..8304..8305..8308..8314..8320..8330..9312..9321..9332..9341..9352..9361..9450..9451..9461..9470..9471..9472..10102..10111..10112..10121..10122..10131..68160..68164..69216..69225..69714..69723..127232..127243..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nt\None.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3013
Entropy (8bit):	4.293269294427571
Encrypted:	false
SSDEEP:	48:0z+XnEnNyc5Zt3FV51KncGqyALrCsyln+9/D5M8Vv4dS+Ci0pXvpnfrg5ytxcwU:0zoEnNHnmnFqyAHFEnY7y8E0pXhzg5yo
MD5:	8E2502BA46B56E625A5A4CEFDEDDED35
SHA1:	762DF486AF73C2F8BFF2C47B6D76D691E50DABBD
SHA-256:	51535860E0A6769115B54DBAACD2B77B3BA18F907F42DC27BAF2CB234CF93FC2
SHA-512:	E548901C575E2F4A6428064A4A56211896EFE645696DB2A82DC3AC07C67927F77F3B751A4EBCBDE83384FD95E86DE5646B9B83AD96D0B97AD7B6F5681CAA9975
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V367..0..48..58..178..180..185..186..188..191..1632..1642..1776..1786..1984..1994..2406..2416..2534..2544..2548..2554..2662..2672..2790..2800..2918..2928..2930..2936..3046..3059..3174..3184..3192..3199..3302..3312..3430..3446..3558..3568..3664..3674..3792..3802..3872..3892..4160..4170..4240..4250..4969..4989..5870..5873..6112..6122..6128..6138..6160..6170..6470..6480..6608..6619..6784..6794..6800..6810..6992..7002..7088..7098..7232..7242..7248..7258..8304..8305..8308..8314..8320..8330..8528..8579..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nt\Nu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	4.416104100329199
Encrypted:	false
SSDEEP:	48:0z+XnEn9MfXCncGqyALrCsyln+9/D5M8Vv4aO+CibpbvpnYiohxcwU:0zoEnjnFqyAHFEnY7y8TbpbhfohxU
MD5:	99BAA705D3F3A30D590D0A1A4ED38E69
SHA1:	1FE53FFED01031358F71DFE4DBE2241038123AE7
SHA-256:	F2A3EB3E210AC041534908D448F94163CCA711706F785E56A38B01BF18FC6A3A
SHA-512:	504D12946432D44BEA0FDE640097F452207087374A0FCF33C74008F4BA03F0FA31DA74409FE4F8170C7F64011089B8371B8DE3249BA81133813E384053E30663
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V276..188..191..2548..2554..2930..2936..3056..3059..3192..3199..3440..3446..3882..3892..4978..4989..5870..5873..6128..6138..8528..8579..8581..8586..9321..9332..9341..9352..9361..9372..9451..9461..9470..9471..10111..10112..10121..10122..10131..10132..11517..11518..12295..12296..12321..12330..12344..12347..12690..12694..12832..12842..12872..12880..12881..12896..12928..12938..12977..12992..13317..13318..13443..13444..14378..14379..15181..15182..19968..19969..19971..19972..19975..19976..19977..19978..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\0.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	4.79511896371525
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7t24TCYg+m1A5yjXUCNhrbRB6cDNDKdR+kJOUnyU0UAw:0z+XnEnbP1Z+yL/hjVI+mLnyc
MD5:	5F802D1E21B65BDFAD78B1A2C931C5FB
SHA1:	8EFA0D0790EC197F6FE53BEE14AA172C7A92AACA
SHA-256:	E7F7C7C88398BC25D64C9AB93D2944BC0DC5A316954D5CC29E4A826DBF65FBEA
SHA-512:	FA5C114DBB818D38D415586EA7D496E7F8622DC77315CCEC0931F31FE698F94686CB6FADE305A0B28FC6E8F621C201C7A66FBF44391506A0B02FCA5F701AEBDD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V138..48..49..1632..1633..1776..1777..1984..1985..2406..2407..2534..2535..2662..2663..2790..2791..2918..2919..3046..3047..3174..3175..3192..3193..3302..3303..3430..3431..3558..3559..3664..3665..3792..3793..3872..3873..4160..4161..4240..4241..6112..6113..6128..6129..6160..6161..6470..6471..6608..6609..6784..6785..6800..6801..6992..6993..7088..7089..7232..7233..7248..7249..8304..8305..8320..8321..8585..8586..9450..9451..9471..9472..12295..12296..38646..38647..42528..42529..42735..42736..43216..43217.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\1.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2032
Entropy (8bit):	4.537553788817783
Encrypted:	false
SSDEEP:	48:0z+XnEnsoQv2s4E/GsMY5dCaMwakIpyVcv:0zoEns/Bt/GsMYrCabuIVG
MD5:	44505F7DF540794B226B93D3C5D0369A
SHA1:	AEB60028E4677E04AF099B02628E99568AD2CDE2
SHA-256:	C4C45A84F3CF66AE76250D133296E87CB0542F1960D54E2DCC02EE8B6E04BCED
SHA-512:	D58ACB0DD4330BDFAC9218826319E01B222B8C88939CD95D31E2C6B9C485FD00ADD98F7D4586C1E45B3B91A56C33FD61E8AFCCA1E45048F64ABC4C7C957F4D6F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V228..49..50..185..186..1633..1634..1777..1778..1985..1986..2407..2408..2535..2536..2663..2664..2791..2792..2919..2920..3047..3048..3175..3176..3193..3194..3196..3197..3303..3304..3431..3432..3559..3560..3665..3666..3793..3794..3873..3874..4161..4162..4241..4242..4969..4970..6113..6114..6129..6130..6161..6162..6471..6472..6609..6610..6618..6619..6785..6786..6801..6802..6993..6994..7089..7090..7233..7234..7249..7250..8321..8322..8543..8545..8560..8561..9312..9313..9332..9333..9352..9353..9461..9462.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\10.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.926163606509179
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE77lZcfoK/AYU/L5GvdQHNdUXUVb:0z+XnEnXwK/AYUDMvde+EVb
MD5:	0EC276BEA437C793716C6E7A7F58DBBD
SHA1:	0D1D7341F49E36EDA3D62B9C4763B062C9A67BAC
SHA-256:	6FBC849F7F5021956F36FA03881726204B26896A8E33200513633F6E97BD593B
SHA-512:	9373C506ABE382CEB4561933AE52A4F6CCCC748B71FDC7B8AEBAE124BB713A64A67908FBBE6CB69BD3478B6A304494D097CA3958C9256C5060378B6B1F91C6A0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V98..3056..3057..3440..3441..4978..4979..8553..8554..8569..8570..9321..9322..9341..9342..9361..9362..9470..9471..10111..10112..10121..10122..10131..10132..12344..12345..12841..12842..12872..12873..12937..12938..20160..20161..21313..21314..25342..25343..63859..63860..63997..63998..65808..65809..65865..65866..65872..65873..65879..65880..65888..65893..66282..66283..66338..66339..66515..66516..67675..67676..67710..67711..67757..67758..67837..67838..67863..67864..68041..68042..68164..68165..68254..68255

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\100.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	903
Entropy (8bit):	5.0600636229366
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7jsF4qSO5nSsoAk/AzSLI:002+XT731GRnXE7jtO5SGFSCEPPpWM4v
MD5:	70D6A2B3F5D45C85EFD34DC8136FFAD5
SHA1:	DBF1B7591F322FB94B3398DA1B549436262D3E0D
SHA-256:	7A09F4D2F95144464055FDF72C49B108153A185FB840A6375BB16D2F48B85AC2
SHA-512:	822D6F524D7C0C3BEC4AC64D7B96C9B1357D21C587443F9C02C0B38529B1876F4C0BD0517D5EC6611B5A94EEB2173AAD95F92D2556A0B56552212989AD94234D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V58..3057..3058..3441..3442..4987..4988..8557..8558..8573..8574..20336..20337..30334..30335..38476..38477..65817..65818..65867..65868..65874..65875..65898..65899..66291..66292..66517..66518..67677..67678..67759..67760..67839..67840..67865..67866..68050..68051..68166..68167..68335..68336..68446..68447..68478..68479..68527..68528..68862..68863..69234..69235..69732..69733..70131..70132..93020..93021..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\1000.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.153357337961781
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MLDOA/Aw40jRWtTAjvPS:002+XT731GRnXE7YT/NjeGX6Zv4ppUxR
MD5:	6597EBCA4C727C2193507EF7FBF6430E
SHA1:	248CB9FB61730CAE410F2E1990C0BEC4AE3E8DD2
SHA-256:	FDD45E02F6DE88208DD2FBDB9FB35F11964E9C4236223B40727F5B2D41C78648
SHA-512:	93C9E50A7A9F537E1753F822B2DD72FF095F647A1026E588D83762EFFF753D0239ACCEAB199BE110B6FD6A7E3343D1199C2321026E6011B198130CDED9235E1B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V38..3058..3059..3442..3443..8559..8560..8575..8577..20191..20192..21315..21316..38433..38434..65826..65827..65869..65870..65876..65877..65905..65906..67678..67679..68059..68060..68167..68168..68447..68448..68479..68480..68863..68864..69733..69734..70132..70133..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\10000.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	629
Entropy (8bit):	5.144523917458788
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7qIsc0IeLz40vnw:002+XT731GRnXE7qc2Lvw
MD5:	9A0260CF477DBAE753A7576E9AABDCE2
SHA1:	DC9D48462E817B59F0008EEB290497DB7108AE9A
SHA-256:	A35D82BDD54A2A8A6996E69E5849E720098F5896D238FC06B93CE2A6EC613F92
SHA-512:	0F95E7AB7B3771A942459099D4F912186E092007F41C7C23736D8EB2ED99768B2E689E05405E99644FA366877CC38219C8C69C55CB318932CA554D4E12A8AA6A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..4988..4989..8578..8579..19975..19976..33836..33837..65835..65836..65877..65878..67679..67680..68068..68069..93021..93022..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\11.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.0984836598998795
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7SW0Ml7:002+XT731GRnXE7f0M9
MD5:	111CA3F6BF454F279C6DEFCC9097E93D
SHA1:	87980A0047894440B04D15167A0288C5D0E1151D
SHA-256:	D33F89B50C4A362272EC4604E05674184F87AD365B0862837D3B542AD0004DAC
SHA-512:	13DC63A7B1B82D1D3A4B6216691FCFB9986255372D3CB4211077A1BB725DBC79347805676C2DFC80905C891CB899B7BB7CEC650D7B75278062DF0AA75DC1EFE5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..8554..8555..8570..8571..9322..9323..9342..9343..9362..9363..9451..9452..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\12.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.095141572794993
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP73rapWlv:002+XT731GRnXE73qa
MD5:	3C4F1C27B75134F6A82447CAE673E1C1
SHA1:	C55C337435AFA8CBD5275F21EBB8636A97F5D6A0
SHA-256:	4A887A8EF0AA92A362967FCA3059634C18C79977DE51FC1E7951EDA8C03138E8
SHA-512:	D69640CB5CEEA11E89B2D0FDCC186ABBD37B62BDADC9A4F1048E74A1AE9FA2B68167E281B73FB07186987A338C8018226FC305D8EB1DA6282954BB23CC6C817F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..8555..8556..8571..8572..9323..9324..9343..9344..9363..9364..9452..9453..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\13.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.028330733222985
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP79XJ+:002+XT731GRnXE7n+
MD5:	1DEE7E81880EF0FECA3028AB21E8BEA7
SHA1:	21E36868BE447B71571359E12DAC019A5CBE687E
SHA-256:	D754A9A0EBD10DFCD83AFFD7329FA2BA000E69E8BD969584046E67A81E90324B
SHA-512:	189FEC9F77054A979C0836D7B00AC55B96A9DC60A0B1267FDF0553A504A7367B04659C16730765D8ECD910AC91E9CE30128FD07A440E8328C092604334EF36EB
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..9324..9325..9344..9345..9364..9365..9453..9454..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\14.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.033786137503332
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7O+PRcv:002+XT731GRnXE7O+pG
MD5:	AC2B94A0A524CFC4C6D981DB49904A88
SHA1:	5BC48E43167B2F13179E0085880E229E4A42D6C9
SHA-256:	7E1EA28C54716DD3701F3B3A9533ECC05696005EFB8AC803A42946317B957377
SHA-512:	CD718D9FA830BFCA2CD1D4C3DC403066638EDB21EB40BE51128974C784433FA9FF0B3F092AD7CCC0224B80D37DC4DEE9AB9CEA2D33CC59D78DB9A74284FBAF5E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..9325..9326..9345..9346..9365..9366..9454..9455..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\15.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.044092104912262
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7TIoz75w:002+XT731GRnXE7TIClw
MD5:	EBA23DB2B83E9AFEE1622015D37FDD55
SHA1:	8EFCE2C367CF93EF184CC6E5031310289E0FEC8D
SHA-256:	F48942EF551932826D1CAB8F43A9EE283EB6C16B2D43F961551BAD2FBCC69D18
SHA-512:	F56ACCF38C0E6ABABFEF2BEE3909191E33998BD20BDBD21CD46222053AFCBA41386671B86719B4A0F5DDBCECFF75DA2FDDC2A06F353A16B6F928717EEEE2E948
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..9326..9327..9346..9347..9366..9367..9455..9456..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\16.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.083358906231568
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7E/qu:002+XT731GRnXE7Eyu
MD5:	432D099268FCE3C053B29F7ACD9A32AA
SHA1:	1BC32CF388B9C2407B2D01582FA8419C0C1070C9
SHA-256:	4BEB83A04D14E2313E1879E0345A4C75A8947E775D2F64BA8CDDE93874237E98
SHA-512:	B9D17CD7C1B59E458EC968966519E9DE7F0F7199FBA5064F67D382A05C9A0CCAC622FC8A6F4BDD178D476E1DD72FB2D4D063D44C2C4458B3491D83B4C9C2151E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..2553..2554..9327..9328..9347..9348..9367..9368..9456..9457..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\17.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.076852345687635
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78dfvQdT+5:002+XT731GRnXE7MwU
MD5:	49A4D557C5FBF7AB3CDC699B086EEC55
SHA1:	9E58B760742D1A287D2F9262FCAFEB0A30531245
SHA-256:	22621976A7CCBE7653C60C6EEFC67BD83FCF73A8673D8174270E9D566EF213A5
SHA-512:	6FAE00056708DF0D6A47BC7AD2568368BA17A747A1134A636F09FA90173A869639DFDBDC506D228E6BEBA0BDED760F5CAEA406142F93CF5BAAF46EE72BF92AF8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..5870..5871..9328..9329..9348..9349..9368..9369..9457..9458..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\18.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.070978747486146
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78d5/Srwy:002+XT731GRnXE7MQrwy
MD5:	B8C8861B1E8699A85A29A6BA7CDD7CAE
SHA1:	5F249D35D7104EA6006071A2ADCBE7DDC6CF5144
SHA-256:	EF722DE902B034A6B71E3AD45C605FE15A25F5A890D1081A1E86DCE8717B8745
SHA-512:	B10815DFD63F9E5ADCD36EBC357338972D0D35E83248A0948A4757AA78989D69A6763698A162F694DBF83251C6AE04E90986BE2FF0966767B6C687D88A0D6782
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..5871..5872..9329..9330..9349..9350..9369..9370..9458..9459..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\19.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.071376564927386
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78dzq:002+XT731GRnXE7Mzq
MD5:	59FEF23054FEE77AF9EEFCE7E6C15484
SHA1:	D8A3AA6B7EE293C3A6B10AADF1A4B8CAD1EE01DD
SHA-256:	2CC3F07ABB397AE9FF80487B615CB2F440468B37EEF36E9AC4DE12792AD47E04
SHA-512:	ACC70E48EE1660AFE12BA6A2868272BFA6C56A59F97038E1F93FE7F143D8D2D0B759191C000DFC80E2C476E18992A9F6F940F8DC2CCCDC09A5789026567D4809
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..5872..5873..9330..9331..9350..9351..9370..9371..9459..9460..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\1_2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.1824087110883585
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7DLY8TQxCXQ33v:002+XT731GRnXE7oT1
MD5:	61B647D3D36245EF7C41BEC5C1613196
SHA1:	103F9790CF336441D91B02BBD1C1C4F7D91E161C
SHA-256:	8D43417CDDEB2133CFB634310E14FD27B6382AE32123A824014C53181D61E38C
SHA-512:	AD93FAFF3956805E872315822330E1843256C40C6BD3E788A9308B498CA895AE62E0646E043A79FBC3C85C2CE415FA1FB94838166C75E242AEED0CBFD814590A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V24..189..190..2931..2932..3444..3445..3882..3883..11517..11518..43057..43058..65857..65858..65909..65911..68029..68030..68091..68092..69243..69244..74852..74853..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\1_3.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.122092320797328
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74oCPShrARV:002+XT731GRnXE74oCPsyV
MD5:	4DC78EE4423CE7D32B49D7441D1C3D3B
SHA1:	6DD88504AE464247FE81D50BA5DD339AB44F20E5
SHA-256:	961806B0EF2F2C3A924522B982CD3CD628DD03D655AA01A4B998871720BC38E7
SHA-512:	4845FB532EB5F8FD139CA290BB81B1D7B69850B9A0386B07D15149421C6D663A2E35ED2B279D86A107EDC63A9F5C4B1C60F2BAFFDAD63EF0C6218E721310C679
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..8531..8532..68089..68090..69245..69246..74842..74843..74845..74846..74853..74854..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\1_4.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	5.17119749517267
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7c9F4wu+RTQnycCt9QA:002+XT731GRnXE7UFu+aPCwA
MD5:	6CE8E24FB457575BA13EBB36DF9F3046
SHA1:	20CDD08DFEBE84C50976C1E7818C8B40E0B4E346
SHA-256:	53A1F7DC2852CBA42C52887627FA5C5FCED9B069061F9352F2947CFF57025C88
SHA-512:	05253412207EAB32600FE647479CF671965750773AACD1D1A20820B8AE589F4AFB707368A98BBE906C063BD92D0C18CA550383E61D7A034C21976AA9BCB840BA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V22..188..189..2551..2552..2930..2931..3443..3444..43056..43057..65856..65857..65931..65932..68088..68089..69244..69245..74848..74849..74850..74852..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\1_8.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	571
Entropy (8bit):	5.094591382526265
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7IgE4FnS:002+XT731GRnXE7hE8S
MD5:	222B2CEDD0337C5A2EE6FC25FA7B8C2E
SHA1:	A74EC586EB341515F225F4D15BE03E1233369D9F
SHA-256:	118CED3DC3BA131DF1FB02E55F3D0455C1B0B069E43D64849283DF0129F8787E
SHA-512:	016E59A79CF56E778F71D9D966FC0EE26447F5340E44EBB9FF5BFEE0943633F9D4BA5F9EF5D1D26F1D459585026AE06C419FCAB5D5B95E036CA2D68921D08E28
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..2549..2550..2934..2935..8539..8540..43060..43061..74847..74848..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2034
Entropy (8bit):	4.5392795321906405
Encrypted:	false
SSDEEP:	48:0z+XnEn6Dh0L6Wk8VvlrEKfzxG8SjvwbEhA:0zoEn0qLRk8r7A8dbEG
MD5:	A823B7FEE49C35ED6CE5F9CDE898015D
SHA1:	AD66D31E6117255F152D01594624C813AD5EDEA5
SHA-256:	00448BA96F4DE72DD33D95805557F8DF3A353AD921D8D57CB5BF05825EFCDF02
SHA-512:	DDD15681C608C860051E07B08C77AF4FFF32CD85B0FDD3663A346C0D25801FB15B144323299AFAB84E4A28208880A7E358671985A2307B2ADBA2A0D484890DAA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V228..50..51..178..179..1634..1635..1778..1779..1986..1987..2408..2409..2536..2537..2664..2665..2792..2793..2920..2921..3048..3049..3176..3177..3194..3195..3197..3198..3304..3305..3432..3433..3560..3561..3666..3667..3794..3795..3874..3875..4162..4163..4242..4243..4970..4971..6114..6115..6130..6131..6162..6163..6472..6473..6610..6611..6786..6787..6802..6803..6994..6995..7090..7091..7234..7235..7250..7251..8322..8323..8545..8546..8561..8562..9313..9314..9333..9334..9353..9354..9462..9463..10103..1010

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\20.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	919
Entropy (8bit):	5.074501541961832
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7b3owdOn23rfVcI2SUiH/:002+XT731GRnXE7kI1PqdZBdr9y
MD5:	D4BA15B8CC8CEDF596DAAF62A9DAF1AC
SHA1:	54ECFAA91129B521D9418DB68F338282EB93B66B
SHA-256:	A95A18A3CDE8E7616CBD3FE83F0A42B95D23B8A23ACEA1D125EAB09561544B90
SHA-512:	A1BFAD13EF079E4A32BAB318D303DF2D217F4823BD2B517648003D34DA205A09564102522B5E85A85EFD8525F24468768DD0C25A22662A5D8806AC409BBAE598
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V60..4979..4980..9331..9332..9351..9352..9371..9372..9460..9461..12345..12346..12873..12874..21316..21317..24319..24320..65809..65810..66283..66284..66516..66517..67676..67677..67711..67712..67758..67759..67838..67839..67864..67865..68042..68043..68165..68166..68255..68256..68334..68335..68445..68446..68477..68478..68526..68527..69226..69227..69724..69725..70123..70124..71483..71484..71915..71916..119658..119659..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\200.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.059691672402746
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7yTWXrCn:002+XT731GRnXE7yTerW
MD5:	FCB974A71D7E96B63EA6E505E5FF36FD
SHA1:	8D0E98F7748BA5CB48A7A5C177F42D929A33EAA1
SHA-256:	EA26EAE9D3950D0DC4FFA68689A99E7A0E1B76EC4E5134BF3F80A39731C6475C
SHA-512:	088534A2C7C5B579C88976D092DC2D202B416AF430AAF735AB18D3D1159F8490906500D55FDD171C505B80C339403D74C77FDF1C94F4E6C15448A4EDB686C4BA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..65818..65819..66292..66293..68051..68052..69235..69236..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\2_3.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.1400302101252295
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7/4kUrF:002+XT731GRnXE79Q
MD5:	9F745A8C7EBC141305365785989BC912
SHA1:	CCB0E2967F356284C4BA2DBFB241D9D08B44D7B9
SHA-256:	80CD053F48675A5227C87BEFD5E9A5070AC87A669C537FE758E38D3A830563D9
SHA-512:	FF95BA08FAB0D0FB5348EE5166CDF6A01999272BA38466F94E7C1EF47E6ED427CDD1DF9349939E2920C2F1999CB0B4C94D21BC02C97DE8ECED1723E384BB23BA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..8532..8533..65911..65912..68093..68094..69246..69247..74843..74844..74846..74847..74854..74855..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\3.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	4.551825974624172
Encrypted:	false
SSDEEP:	48:0z+XnEnsf9XkIDrwJKABTlcVM+garxc0lxPQMZjP9+53:0zoEnsf9XkIglVlcIZ0TYyjPo
MD5:	2BDBF1747B63666DAA665661CF52EEEC
SHA1:	FD9484AF45523E41AB48B5DEFE7CCD6C8E821811
SHA-256:	B0241EFFEB5A348B861492EAF56F500ED7ED809A5534CEB0688CF21E36F677F2
SHA-512:	14025A03FA2BB92D492A5FB3202C3F419A67D56A1B654AE31E9D81FEA27679C47B6CACD9F0212193C942D46693A9CEA9BC85A5935FEE10CBCB0C87B382AF670E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V224..51..52..179..180..1635..1636..1779..1780..1987..1988..2409..2410..2537..2538..2665..2666..2793..2794..2921..2922..3049..3050..3177..3178..3195..3196..3198..3199..3305..3306..3433..3434..3561..3562..3667..3668..3795..3796..3875..3876..4163..4164..4243..4244..4971..4972..6115..6116..6131..6132..6163..6164..6473..6474..6611..6612..6787..6788..6803..6804..6995..6996..7091..7092..7235..7236..7251..7252..8323..8324..8546..8547..8562..8563..9314..9315..9334..9335..9354..9355..9463..9464..10104..1010

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\30.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	719
Entropy (8bit):	5.1863908538943315
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MZhyn3QRiceDKX4AFDi3:002+XT731GRnXE7rg0uXLE3
MD5:	AE63D4F82DA552CA0B65AEBEC813DEBA
SHA1:	810FFC30C37DDC9B9CF10F0189F3656D8FC491B3
SHA-256:	9499F3FC388C0FE45F57A88040C40BE9E65A9952001E72373F8AB02DE4F71377
SHA-512:	8146ECA634D80BAAF3074366D5786615C3224B90D091D1A9C0345AB7580F9673F0E797ED950FCACDAE8A89D70DEB8CDAE941E684E2C829707A8D85F3647649A6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V30..4980..4981..12346..12347..12874..12875..12890..12891..21317..21318..65810..65811..65893..65894..66284..66285..68043..68044..69227..69228..69725..69726..70124..70125..71916..71917..119659..119660..133507..133508..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\300.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.095209035473443
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7yVUciJR+Q:002+XT731GRnXE7yVWJQQ
MD5:	013BAE047DFB4831A124EBB6F380D6C0
SHA1:	08CCCDEE1BA2DB3ADDDDA33ED3BEC3B413B34662
SHA-256:	8677F41C0A8C8E2E44D8652AB5F1B663A6BF18D0C1CBF47879F6A9E5CACE205C
SHA-512:	874F6DCFE32A689362909E832594C47980908DFC9075948D03B880EBB9291EB68980FF12AA0C54D493BE71737D7D01CC04DBD6A738B8E81DD665EED7FB6D1F29
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..65819..65820..65899..65900..66293..66294..68052..68053..69236..69237..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\3_4.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.119680297465111
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Q0nLp1ccy:002+XT731GRnXE7Q0nLPS
MD5:	01A0247A0A060B473B4BA506824E05FD
SHA1:	84354BD8A499728F61CAD2B3CDDB73F2C8D030C6
SHA-256:	F20C82D10233D4C3B0CB16F4A4303F80B5BFF6AC43D0A2EBF61F415022BD1939
SHA-512:	2A76DCD4F0DE3E5248C700E9B4B1D8B551F101546F15172C0E23CDBC22D4B05955EF0CBEFABEEF77B2C5982AA2F50A458458FEB264794BD788021AA86FB564D6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..190..191..2552..2553..2932..2933..3445..3446..43058..43059..65912..65913..68094..68095..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\4.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1932
Entropy (8bit):	4.577168484690806
Encrypted:	false
SSDEEP:	48:0z+XnEnQ3veoyN3fdnIUvDoZnZE07yRQnyUHlGRtzrHdjrjBd+OPbM:0zoEnI9yRfdn9DgZErOZw3zbdjHnDo
MD5:	9EED468C96088ECA7CAFA0F075825E78
SHA1:	6FE9A6165E1AAFA79B8047832F9E298D183ACA07
SHA-256:	7BC9F5C4EFBEC8CA6F0A29402E7CA5CA54935774CC41AF0B480EEA2AF9081EAA
SHA-512:	B59E89B41D5764CC65D862E2F780657079490B8B172F802DF2D22E575053DA5DA1942A81B75AF7981CAF05BEEE6D6E701667029AA4B5925CB258ACA985DB8957
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V212..52..53..1636..1637..1780..1781..1988..1989..2410..2411..2538..2539..2666..2667..2794..2795..2922..2923..3050..3051..3178..3179..3306..3307..3434..3435..3562..3563..3668..3669..3796..3797..3876..3877..4164..4165..4244..4245..4972..4973..6116..6117..6132..6133..6164..6165..6474..6475..6612..6613..6788..6789..6804..6805..6996..6997..7092..7093..7236..7237..7252..7253..8308..8309..8324..8325..8547..8548..8563..8564..9315..9316..9335..9336..9355..9356..9464..9465..10105..10106..10115..10116..10125

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\40.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	721
Entropy (8bit):	5.178464370315568
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MhMTvtjUsgmG4sv:002+XT731GRnXE7FvtjUsgmGp
MD5:	84FC7A8C8940C0B7A5A24F52BD482F54
SHA1:	9E6DA555E3AB4A9C0E45E758EFD028ACC8A55B84
SHA-256:	81630E2A8053F2D0870F93D7C2AD8322F1556725DE395432DFD21AEE0A4E150A
SHA-512:	E1CE332F70B3D8B7081279F2ACC317BDAB43E8915F810EA2840F2D0A65E32744B67B3446C69C49515DDF78E92D1F57C12EB97C5B8D8A8C5B37820EFBA2E81130
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V30..4981..4982..12875..12876..12981..12982..21324..21325..65811..65812..66285..66286..68044..68045..69228..69229..69726..69727..70125..70126..71917..71918..74855..74856..119660..119661..133516..133517..133532..133533..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\400.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.0731958616523904
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Vo3:002+XT731GRnXE7Vw
MD5:	FD6C0D6222911872DC29F1DC723E4BEB
SHA1:	1A38F61DC398D9FA249F1FCC7EF091FDC00BFC05
SHA-256:	5531A6846DB35C86D8A4BB4D17B988E6A55DF029C7CE9E7BBE45E55D29A1E25D
SHA-512:	4F86F7FA7549EFE662B8BD4A35339CA85DB241F931E2D9273C8C248FF6AEF69CCEE34D07C7394B02CDA74591A8965CA64A9D5A8B6EDE298412FF5CDBF860477A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..65820..65821..66294..66295..68053..68054..69237..69238..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\5.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.565075785674268
Encrypted:	false
SSDEEP:	48:0z+XnEnwLpocZXXIs4arr0YmV/1Aja5nD9oNNLJq9QAxa:0zoEnwLxZX4sDr6/1Y+uNNt5Ka
MD5:	DE3F0A6A7CAE12BE051796237F8BB45F
SHA1:	4F59BD30A06A87D38A9D10A7C20F97AA3994C6E1
SHA-256:	21CC74CE0112FCCA35D5CB5B18A4EB2600717EB0664F0B84ADD68D97F9D691EE
SHA-512:	4386F3C2719AA347A583BB74B7A303A9B5548D8211915125CC4BEB7A030308D6DCDE2DB1070F6761B526D30FCC53A6411AFD75D74EF5569CA7561E94492CD6FC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V216..53..54..1637..1638..1781..1782..1989..1990..2411..2412..2539..2540..2667..2668..2795..2796..2923..2924..3051..3052..3179..3180..3307..3308..3435..3436..3563..3564..3669..3670..3797..3798..3877..3878..4165..4166..4245..4246..4973..4974..6117..6118..6133..6134..6165..6166..6475..6476..6613..6614..6789..6790..6805..6806..6997..6998..7093..7094..7237..7238..7253..7254..8309..8310..8325..8326..8548..8549..8564..8565..9316..9317..9336..9337..9356..9357..9465..9466..10106..10107..10116..10117..10126

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\50.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.11088113742933
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE71XZrYP2LjEvfX3p16XJib:0z+XnEnGXZr62MXq0b
MD5:	19A24E2F7E8433CF898E0C88A4E85BD6
SHA1:	67E6D0EBFDF502D6F64418CF96761DEC7AB7B1B0
SHA-256:	9D82B23B98676ED0C78B6BE2F63B02DE22325CBDBC74C877821B794FCDE04D8E
SHA-512:	5FDFFE574FC7562AF83AF5169D4D98001D1B02EE02309EEBB8DFB4AF11A1FD499FF4627715B2D9EF4887ABF610C69C8D9F642D4A74D2E415B66178CC957CBBAB
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V46..4982..4983..8556..8557..8572..8573..8582..8583..12876..12877..12991..12992..65812..65813..65860..65861..65866..65867..65873..65874..65894..65898..65908..65909..66286..66287..66339..66340..68045..68046..68222..68223..68861..68862..69229..69230..69727..69728..70126..70127..71918..71919..74856..74857..119661..119662..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\500.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	643
Entropy (8bit):	5.114075213641475
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HqQRocnwOw:002+XT731GRnXE7HqQHpw
MD5:	84EC09A93D2D97056016E16214CE3F5A
SHA1:	6879CB98A8974F960007DAE5012DD20E7C9F74C5
SHA-256:	860FFABAA426A9F1095F5B0D9F3B23D9D3AF87B8D23F7D7AFCA11A703EC7010A
SHA-512:	99FDAAA00AE9F5F0BE91AC4598568CE07113C1EE8C7B7F68E927DFAD55F6D9D596CFE30E8259D37D3A5F6A12CC5CEF342FF1D57843938F7CD62853EB38F4DE54
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..8558..8559..8574..8575..65821..65822..65861..65862..65868..65869..65875..65876..65900..65905..66295..66296..68054..68055..69238..69239..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\5000.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.101323254427543
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7T8fZ9fq3:002+XT731GRnXE7T8/f+
MD5:	55CC66B7706F41B371AF9E49BF312A7E
SHA1:	86EDE31A0B50620058C486164CC5EBC4D751D1AB
SHA-256:	2236714A5B2D10DB8971567F8964AEBC489619FA5C4F887E37E17DCC2346CE5E
SHA-512:	8E16B5ED1FAD46423986181F6D88A3045C4CDFAD10785EE4F51439AEE29DBC5893B16C288FBCA9005485E852493B377ED75F575CF002CE3CF48D797224164DA2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..8577..8578..65830..65831..65862..65863..65870..65871..65906..65907..68063..68064..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\50000.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	575
Entropy (8bit):	5.082710441421962
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7aGeo4h+v:002+XT731GRnXE7koAQ
MD5:	61489DAEB9DB4C464AA63EA39232D230
SHA1:	3586CEF211EA008B2016B07CA14C853BB4FE84B4
SHA-256:	5903F13293D76803323DE64EE9E46164186218CA8BE6BB58CAD06880DF7FD5BF
SHA-512:	CEEFE3F5551B82E5900493FE58D99F33CA95279282204036D327C42D831D098380ACC43B3AF505DD09FB114358288C845FD852551E290D712AF7AA97A98E8FD8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..8583..8584..65839..65840..65863..65864..65878..65879..68072..68073..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\6.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	4.635520264806736
Encrypted:	false
SSDEEP:	48:0z+XnEn0QSmG+M/viVe4SIwl0hzRzy+iOuAW:0zoEnDu+oaVJUyY9n
MD5:	989D5081FBFC9F0A01C20EB82B3BC4CD
SHA1:	C9F7DFF40EA3178B89518C0F9B3D19EB4A515C4A
SHA-256:	B56B05D193E8DCC5E34655034F70694F7802433C745E53D883D4813BBC9DF005
SHA-512:	4A842C1B026476428C90DD785A4B9D3A90A11A27617478C45CA3874688B736E19A00270AF08F2B45CE9562D7945917D6939E5D7421A0B6D76A3CA4627A6A9513
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V192..54..55..1638..1639..1782..1783..1990..1991..2412..2413..2540..2541..2668..2669..2796..2797..2924..2925..3052..3053..3180..3181..3308..3309..3436..3437..3564..3565..3670..3671..3798..3799..3878..3879..4166..4167..4246..4247..4974..4975..6118..6119..6134..6135..6166..6167..6476..6477..6614..6615..6790..6791..6806..6807..6998..6999..7094..7095..7238..7239..7254..7255..8310..8311..8326..8327..8549..8550..8565..8566..8581..8582..9317..9318..9337..9338..9357..9358..9466..9467..10107..10108..10117..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\60.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.166097877524294
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HZJSIoigGweHbpDv:002+XT731GRnXE7HZJSIoixweHh
MD5:	010678C73FB35CF4374ABBE2674BBE9E
SHA1:	1717909C62AC5B39E4724643D0DAABCF044AA198
SHA-256:	98CC30587C8F50774CA1FE77EF123684A89165B4DB50668F8863AEFE306237B7
SHA-512:	3FCF2ED91E58A14F7A972C84370F33A842B5D4E7719F58CA441817C323962BCFBFC0BB3719BEC866E1D8E0CA478D26C430DC83C6ECCCAAAA7560F71B4B1EF2A2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..4983..4984..12877..12878..65813..65814..66287..66288..68046..68047..69230..69231..69728..69729..70127..70128..71919..71920..119662..119663..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\600.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.057795466577562
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7/oXbAb:002+XT731GRnXE7QXbe
MD5:	621E9C4743F7D7814B6D5EC0EC28DFFB
SHA1:	DBFCB92FC634B7896BFDDC950AE26348BC540FDB
SHA-256:	2469CD4AB92FA21388DA3C6AB3C5594802A7C19F2F4195940886BC5959DE68DC
SHA-512:	E512DF82F3B932BD04C6D99A029473EC660BC556C6567226CF5FADCFEA6A166F12B211E39AB2AC9726D1BAB7DE309BC5FFD7C538193EE8EC906B436D7E886A7A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..65822..65823..66296..66297..68055..68056..69239..69240..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\7.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	4.650483150439496
Encrypted:	false
SSDEEP:	48:0z+XnEnskW5NiKKL3V9Aa3+OvzTqTCWj3:0zoEnsP5YKCV9Aa3++3/Wj
MD5:	D50375311FB4BD22AF918114A8532AC6
SHA1:	14576BF156A01E0677EDBFF429AAC1FCE4C30C18
SHA-256:	6FEC2E8682D89D13EB68560ECDE5E66D1B8EE03BD795011F0866BC2AABB0ED6A
SHA-512:	BB326FCCB35BB7315AFF05508F9B21E76C0C565A61C6FB6FCF94B33B8BFCFEFFD2B5636B44EAA985399133ADCA9E6C5BEB79CF63D4FDBC1BB9D3829E919434C5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V186..55..56..1639..1640..1783..1784..1991..1992..2413..2414..2541..2542..2669..2670..2797..2798..2925..2926..3053..3054..3181..3182..3309..3310..3437..3438..3565..3566..3671..3672..3799..3800..3879..3880..4167..4168..4247..4248..4975..4976..6119..6120..6135..6136..6167..6168..6477..6478..6615..6616..6791..6792..6807..6808..6999..7000..7095..7096..7239..7240..7255..7256..8311..8312..8327..8328..8550..8551..8566..8567..9318..9319..9338..9339..9358..9359..9467..9468..10108..10109..10118..10119..10128

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\70.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.170984439226206
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HHrOPY/wn93T5cN:002+XT731GRnXE7HHrOOwn9j5cN
MD5:	27DDDC7D59E5EF243A8957D1D2DD9B1A
SHA1:	22E9150DA9F4149A6F7DDAB3D10DF3E3AE678DBE
SHA-256:	3EB44AC6145AFD44604D5A25442194A0BF8FA65A12779605C279066F2A87AE4A
SHA-512:	35BFBB19439569010CF122C614D61A9769F62A4105C6839D1BA0DD2C27A55DCA4DE0D8AD2071C3C2EDA32EC20B6BE02121347EDDD8E7F1B9047C8376C21D227A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..4984..4985..12878..12879..65814..65815..66288..66289..68047..68048..69231..69232..69729..69730..70128..70129..71920..71921..119663..119664..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\700.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.071016455279259
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Gz3v:002+XT731GRnXE76v
MD5:	8A921F73C25F94D1EBF685E04F40D2B5
SHA1:	E513D7C0A8694F70669E96DC572568F5982E3CE4
SHA-256:	460E5E75243F529C8F70E8918E45C52CD65A417B50B6CC6CE4687087AFEF67D3
SHA-512:	A7A770E3BCDE73D00C4A30E6AAFE826C4FECB0858909BB766D93A4D12B271D3ABDEF74195E2457C9602334FBECFFA0041E63D2C83C899A51070FB15EDA607747
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..65823..65824..66297..66298..68056..68057..69240..69241..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\8.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	4.666698941301923
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7bP/e184bGw15VR1j4mpnGIm7EydCTlIXjdj9hmkftCdFx:0z+XnEnIPH4quVFGIud5zLhmkftux
MD5:	30C247CBCF98992E578539145781B7A1
SHA1:	5E559A440A3A822D5CE7456197FCF76704D572AF
SHA-256:	C3F8CD5AE91A5362B7E7BB85889B04EC45ED265C1000A917AD825B061BB8D127
SHA-512:	906CB384FEE199B6DC4E2FC2098F6C7C3E37668E58C8B3EEA67932EDC869C21F46D3572A89D2E25F4B85FB1D3937B523F134915546C55CAD62DD67AB965224F6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V180..56..57..1640..1641..1784..1785..1992..1993..2414..2415..2542..2543..2670..2671..2798..2799..2926..2927..3054..3055..3182..3183..3310..3311..3438..3439..3566..3567..3672..3673..3800..3801..3880..3881..4168..4169..4248..4249..4976..4977..6120..6121..6136..6137..6168..6169..6478..6479..6616..6617..6792..6793..6808..6809..7000..7001..7096..7097..7240..7241..7256..7257..8312..8313..8328..8329..8551..8552..8567..8568..9319..9320..9339..9340..9359..9360..9468..9469..10109..10110..10119..10120..10129

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\80.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.163017516175604
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7qNz04cvj5Gm:002+XT731GRnXE7qNir
MD5:	9034CF43F182D8DA0F686FE201E27A64
SHA1:	805CF18F304A67ABEDA0C88649132935DAD14A38
SHA-256:	C5C8DA527A4194522C2A6EB19A0A3CABCF089069B379C9489058826025DA2C7E
SHA-512:	D7CBB567D79AF73A975DFED076895B16A717D6232E539DE6980F814261A883EF60E4D3A87FDBAE83D068F92F228F72C6F13457A76FE4189C3A5A13D9CBBF77AE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..4985..4986..12879..12880..65815..65816..66289..66290..69232..69233..69730..69731..70129..70130..71921..71922..119664..119665..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\800.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.061647418599591
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7RFAM43:002+XT731GRnXE7rAM43
MD5:	285424FC931885A65C05CF6F0F4C3201
SHA1:	3E5AB6BE392810775A176D0E7219EBA45D410E44
SHA-256:	D30D0866946CC2B5277CA8B4F954820FB3FA9880D45FD0DAE9848675A4FF3015
SHA-512:	21817AA2856D7A5EC36BC4D2B2938E3D3D520091716CDF8F788F37752CB7C60DA75695EBB48B7980DB8F4F4567FAF18926D7BBB11A7E81A9F54BD8DF5A7DC577
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..65824..65825..66298..66299..68057..68058..69241..69242..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\9.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	4.65016144345568
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7e+0/RObPvDBoK/21zUU7kHWTU/hFg+TN82JJ4iUzLsK/yU81/:0z+XnEn1+I22xoHWmjr4R/sK/yHn/
MD5:	45E15C9DD1304DEF3CDDFAF570010E92
SHA1:	B07D9602C89747DB6A94883D75760025CE3A380D
SHA-256:	D975AF9C3CF35ED99F91392492F41C50D8A2C567ADEBD4742DA5F7ED25C5FE94
SHA-512:	D2C445A38DE154EC6D5933A8AB40905B78531802C0B601C46029118DA79988EE5745F1BF69D9E0B479E131358B48CFB67E967B4C226C67F8C0FE696BF041FF8C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V184..57..58..1641..1642..1785..1786..1993..1994..2415..2416..2543..2544..2671..2672..2799..2800..2927..2928..3055..3056..3183..3184..3311..3312..3439..3440..3567..3568..3673..3674..3801..3802..3881..3882..4169..4170..4249..4250..4977..4978..6121..6122..6137..6138..6169..6170..6479..6480..6617..6618..6793..6794..6809..6810..7001..7002..7097..7098..7241..7242..7257..7258..8313..8314..8329..8330..8552..8553..8568..8569..9320..9321..9340..9341..9360..9361..9469..9470..10110..10111..10120..10121..10130

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\90.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.151594645326592
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7qZZOvmfST:002+XT731GRnXE7q6ZT
MD5:	E7D5248C72A295226F4FC2157198FBFF
SHA1:	57B238671A9C4E27C9246E9CAF1112CAC8955F5B
SHA-256:	F970828BF4C98E5C997054C6D963EBB95DF27DDFA24535509568486BCCF841F7
SHA-512:	C8AA5ACCADBDE85ECF12ADD1776BD0F621605BE7819ECFFDBB0D7FF413BDE7947065BE40B1399997F9FB0F7209485DEEF362E68BD1E1A1CC67C2B538AE621FA8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..4986..4987..65816..65817..66290..66291..66369..66370..69233..69234..69731..69732..70130..70131..71922..71923..119665..119666..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Nv\900.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.09538151904847
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7vWh+sv:002+XT731GRnXE7vrO
MD5:	953116B109598042D26423675B135BB6
SHA1:	A44D01971612A36184FC2FD6DC953A478E6C4B6B
SHA-256:	2D96D23CA9909C9FF1B2F9A530F8C8A1ACD0ABC280E5766F5580921FE45B712B
SHA-512:	169B54DAC4CDF270074DE1773CA03CC802C8B95F5733D49ACB3CF58539F00C990D7A786E49B3C304120C05E53D74BA0586286ED6C5CF29E59416ED3EA5CF9E1E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..65825..65826..66299..66300..66378..66379..68058..68059..69242..69243..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\PatSyn\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	820
Entropy (8bit):	5.083980026827831
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7vBZyGOFUAKu90YZJU2xg:002+XT731GRnXE7vBHOuAKzYkpRHbX
MD5:	D7C7DEBA9546A26C15FA254CDB8B4EE6
SHA1:	5CB1CAE117924DAC85AB7CD0BBA11C10CEA9C027
SHA-256:	6FD723B65CC7B15D831ED9EF671F2931024ABCD8B258A3C32A20FE9F1F55F731
SHA-512:	CBB3DD7263CCC85CAEF1B62F712DA91872EE337E46E613F1241CAC684CDD9D411290B1F199A4D32E1B10607561C4E1545B6DD4ED95B113C707594A129D00BB3C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V56..33..48..58..65..91..95..96..97..123..127..161..168..169..170..171..173..174..175..176..178..182..183..187..188..191..192..215..216..247..248..8208..8232..8240..8255..8257..8276..8277..8287..8592..9312..9472..10102..10132..11264..11776..11904..12289..12292..12296..12321..12336..12337..64830..64832..65093..65095..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Alnum.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9027
Entropy (8bit):	3.843793147220211
Encrypted:	false
SSDEEP:	192:iZEzn2Japm0Lav3AN9f+jGakxk/Hm8I8U1+JqlWOR0UHAwqqdLM6:iZk2apm0La/AN9GjGaTvTk+JqlWODSj6
MD5:	98A1A4D7866EE2F3977082D91C73247C
SHA1:	1E8B72CE5A70A758814064A3B2B055D709326EC9
SHA-256:	29401BE3A696D644236080AC9AB18A74B7E8FCA335609F261374AB6720216EF3
SHA-512:	9C8F296F819140CFC8DB4492ECF7D8D2234D2A1DCC6928319F285783C09C437BDE22CDA33BFCEABC5B891E2C1BFC326E4E1137B607436365054408647C4DE2F3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1296..48..58..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..837..838..880..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1456..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1624..1625..1642..1646..1748..1749..1757..1761..1769..1773..1789..1791..1792..1808..1856..1869..1970..1984..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Assigned.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8768
Entropy (8bit):	3.855173205928987
Encrypted:	false
SSDEEP:	192:iZyVjWErjvipBLaxabMftr+wk/DvC0YuQCIeilFahBA8ZALMC3e:iZGK2j6pBLaxabMVr+wku0zRIeili7nZ
MD5:	A12A368C52DA2F6B9DC5718DB0369B70
SHA1:	6D1123FC7908450ED1EB312D3B4D8E3905D53696
SHA-256:	99394F38CB983EDAACA9F21C1B3495FF2C3D416C3235483001D0D7377DD45D3E
SHA-512:	505984DE0A9873A86A420025557F6B5FE38BDAEDF0155AE29404D078E49CF0A7F54EC6467DF27A5A6B4CD0EB5DBA356E23EC14E678F2F21C8E65E22CF4817793
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1226..0..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Blank.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	5.095514919735764
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP71NqMPn/v:002+XT731GRnXE7HqMPnn
MD5:	F9B128A0B61F94EE9E379EDBE7AF6439
SHA1:	C634E7AA8A48E11AE96F09BEE0C0879AAD19BA97
SHA-256:	1EFB3EF199241004B5338648F569F9F76784526BEFB29CE75CEA7834BB2FD8FD
SHA-512:	89783ACB29DFA0BE4758986EE61AE337D200D459C305A8AD02D3018FDEDF174B2E570F9FC7646A65A61C3B957AFE91DAA6DFF3C19B60D3762CED4EE779FE0A57
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..9..10..32..33..160..161..5760..5761..8192..8203..8239..8240..8287..8288..12288..12289..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Graph.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8827
Entropy (8bit):	3.8530862737922735
Encrypted:	false
SSDEEP:	192:iZfVjWErjvipBLaxabMftr+wr/DvC4uQQIeilFahBA8ZALMC3e:iZNK2j6pBLaxabMVr+wruTXIeili7nZ
MD5:	56CD9D2F8652DA87DDEE1DBF05DD5C22
SHA1:	FB1513783EA30F9A98ECC3B5C14D63620EAA1DA2
SHA-256:	D1CBAE34516C30B7B36ABE2B0E8B64D305C29F56F2E22A7556D42A84E0B26903
SHA-512:	A547BAC123F2833FCC89F14056775267B8AE04E1ADBAAE7546C171DCAF5C8C3CFCC81C2E51197F4F2CE0252DC515080873F43731DFFAA352BBCFFAA48A0A689A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1236..33..127..161..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\PerlWord.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	539
Entropy (8bit):	4.9872923043869415
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7XvU1ov:002+XT731GRnXE7XvU1y
MD5:	B7BF743BE24AC7BB6E2F9F5A47F41AA1
SHA1:	FE9828BAF55F1E3773CB1F8432F4C0B71A43F55F
SHA-256:	98F4BE603F2919B93742E1EDF2449E8AD7606DD5E73010A5D1080E014597735F
SHA-512:	621516C98D16AC5F67756EAB67F87A224A1D33390BBA6D66124DB0B9F411A12F21373E5BC2F17D93E096CA0F2169C09F28B33F25B1A8B1824BCCB699B0F9FF9F
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..48..58..65..91..95..96..97..123..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\PosixPun.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	540
Entropy (8bit):	4.996136738048602
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Al:002+XT731GRnXE7Al
MD5:	D66945908725D7FDDB19FC2F4F4BF2B2
SHA1:	0CD8AC49D792769172F9B98DB87387E75065FAC2
SHA-256:	C47D5E9CB6E651F67A89864FF3F72237EC5133D4D41CBA0E8FD94DBF658F151E
SHA-512:	4F37C6BCD0DF397AF88BD557E536B6B9915781ABA0EF133C94CD59B12664B72830CA410ED10E6B3D1CB157B49AFC446560863481CF37706EFFE68C7E7BDDC0DD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..33..48..58..65..91..97..123..127..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Print.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8791
Entropy (8bit):	3.8542461349971333
Encrypted:	false
SSDEEP:	192:iZqkVjWErjvipBLaxabMftr+w+/DvC0YuQQIeilFahBA8ZALMC3e:iZqAK2j6pBLaxabMVr+w+u0zXIeili7Z
MD5:	26C9355DB812DA3B2E55F9E167A9887C
SHA1:	DB51E5884AA22AF75563911E6132A51336DA15F1
SHA-256:	555154B2BA30FE7CADCBB6F78100416222D19C15305AB631A6099BA71251478C
SHA-512:	24F4EA534CD56776991C171F8C04F79BB8756DFB1292E0549CE045849840B012A7A6855F175398FF943F02AB48A7D07B6B931E6B0678C52906F5DFBEBE74F770
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1230..32..127..160..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\SpacePer.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	616
Entropy (8bit):	5.111200594973431
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Hj8/MNn/v:002+XT731GRnXE7HYMNnn
MD5:	87D3F1968DCDA298C4573BA1C348C194
SHA1:	9727BA20A6B1629376A45102D7A15F3433A1C7D2
SHA-256:	A5A280D0BE927F58D0685A7382B5FA0459221DDD8FC1FA85F1C74791BDA296CB
SHA-512:	164374A60B6788751B4126E8EA48F4B4D411E561D4174A8700AD15EF166A6312C3683F9DC31B237091516EBBD583BCF997E0CE1AF567D09448F14BA35968C6B0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..9..14..32..33..133..134..160..161..5760..5761..8192..8203..8232..8234..8239..8240..8287..8288..12288..12289..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Title.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.104182229562283
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HjvBydOJb:002+XT731GRnXE7HcYJb
MD5:	39F0826F13A5D83E09049B72E3FDDABF
SHA1:	FD2D346978346F7E1CA1B8806AA30961F32FB021
SHA-256:	0F2E80C29D0C0BC32E59C8458C0AEFBF0AE95079E76C19E126D6F510412804DF
SHA-512:	B238845C7BFDD3FCB84A0A1273FE8E02C4A2860C5F8376BD399B20454AB4F167619ED0507BA679295B6F950AE0CB082DD9BCAD900988BFB04E4F78B55D0C7928
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..453..454..456..457..459..460..498..499..8072..8080..8088..8096..8104..8112..8124..8125..8140..8141..8188..8189..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\Word.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9169
Entropy (8bit):	3.8407904268449613
Encrypted:	false
SSDEEP:	192:iZOjWEJjvimpLaxAbMftLRPxC/Hs8HfVzJliO3aoBJmuLqSLMG:iZOKIj6mpLaxAbMVLRwvnzJliO9ZkG
MD5:	B5C4BA3FBC0DF932174F6BF9F8289D5B
SHA1:	FDB9363AC7A81AD5AD5AD8E2482907883FCA05EE
SHA-256:	5B6177BFB5C41A5B0B485EC2BF152E37B1AFA3D7D28268E502A79B9C8F39BCC5
SHA-512:	2D43FAE534F6BB8DD4C1BF49ADCABCD985639A321814E1329044888E790CBA33C1FC8E1AB3599E28FC7C65F9D987E147B6AD2EEDB22E1E7396124ACABAFE5486
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1310..48..58..65..91..95..96..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1155..1328..1329..1367..1369..1370..1377..1416..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1642..1646..1748..1749..1757..1759..1769..1770..1789..1791..1792..1808..1867..1869..1970..1984..2038..2042..20

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\XPosixPu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2526
Entropy (8bit):	4.392479439658783
Encrypted:	false
SSDEEP:	48:0z+XnEnC/gKhoBYsFuPh/N3icWr1Avs9YbwZ0K10MjxGZiO:0zoEnVKW2PnicAb9YkZMM1Gf
MD5:	5486478F1313A57DF44ACAC8F3D8541F
SHA1:	97BA90DF7B2BCC6C440781AE478354146E9FCD20
SHA-256:	17B39141D69613833CC751BBF2A82CD372D8105A675F4C0A8DD4060DA776F7B5
SHA-512:	7008CC093654E138988F670CBD56F29F5E6071F1E961FF81475A8C335453C13885C0266F15FBC5A5AFDE8147066697E772A60CE39E6E6C87A34E9224EEBC792A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V312..33..48..58..65..91..97..123..127..161..162..167..168..171..172..182..184..187..188..191..192..894..895..903..904..1370..1376..1417..1419..1470..1471..1472..1473..1475..1476..1478..1479..1523..1525..1545..1547..1548..1550..1563..1564..1566..1568..1642..1646..1748..1749..1792..1806..2039..2042..2096..2111..2142..2143..2404..2406..2416..2417..2800..2801..3572..3573..3663..3664..3674..3676..3844..3859..3860..3861..3898..3902..3973..3974..4048..4053..4057..4059..4170..4176..4347..4348..4960..4969.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlAny.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1936
Entropy (8bit):	4.522688040453893
Encrypted:	false
SSDEEP:	48:0z+XnEnnXfo0FEZH05Dhu7RNS/IaCX3x5E:0zoEn2uJorpHG
MD5:	BF5A705A5C4E77384390F06BA38C9971
SHA1:	718150701D0EB4AB7208D4F704ABCBE60DC5FAA9
SHA-256:	2DC1E34064BDF2628CFBAF453E191F73AC0B1A6B76EF3EAEA3A7388EF43579E6
SHA-512:	85A26107CBECC4D6FDF6064BC15A7B8C23A409B255C8C3D8B76A6E2AA5849E530EAC9E55C94CB8AC95232F51229E65238190BC53C08D70DE86D20AF25A7F360D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V246..65..91..97..123..181..182..192..215..216..247..248..305..306..312..313..397..398..411..412..426..428..442..444..446..447..448..452..545..546..564..570..597..598..600..601..602..603..605..608..610..611..612..613..615..616..618..619..621..623..624..625..627..629..630..637..638..640..641..643..644..647..653..658..659..669..671..700..701..702..703..768..770..775..777..778..779..780..781..787..788..817..818..834..835..837..838..880..884..886..888..891..894..895..896..902..903..904..907..908..909..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlCh2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9237
Entropy (8bit):	3.8374756652221524
Encrypted:	false
SSDEEP:	192:iZmajWEJjvimpLaxAbMftLR2xF/es8VfVKGJliO3aoBJmuLqSLMM:iZmaKIj6mpLaxAbMVLR8mlKGJliO9ZkM
MD5:	5E35F81A3D67DDFDC4D6C11C6A49F17E
SHA1:	6BAB21058451BEE3887A50F1C905D18960C9EA6F
SHA-256:	E9BC90B7146EEE657868E78A01E0EDC267D5D8BB740295717D24D1CC05BBCFCC
SHA-512:	F387BEA211EDCC34B0EB653D9A8C36373C6380529E18F9AC8C7FDBE5B0D6119CE959510DA59487117B363D74BAB751F97AB6816E4B0E27AED456A3BF2DF4BD9C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1324..32..33..40..42..45..46..48..58..65..91..95..96..97..123..160..161..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1155..1160..1162..1328..1329..1367..1369..1370..1377..1416..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1642..1646..1748..1749..1757..1759..1769..1770..1789..1791..1792

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlCha.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7925
Entropy (8bit):	3.8848321004747817
Encrypted:	false
SSDEEP:	192:iZuLpqTXlkKo+wtxx//O8V0N9mwWClWOc5TS5a/qbLMs:iZulIXlkKfw590vmwWClWOeg+Zs
MD5:	BF45BC86E8B6A8B34A82AEFCFC252167
SHA1:	2D0CA052F1B6852C9F5F83BF9608D44E4C0C085F
SHA-256:	12D94B6017D00CD432A23D9501BE1215A340303A822431FAF3C94FDD18627A07
SHA-512:	2887210DF72D0126EB95418D93B509307D08859E1851062D5E07CEBAFD2B9A3ACE624264F579DEF4A2C9BFBE2749ECDEA7D87064084EEEFB6CAFA22F9A3E795A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1120..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..880..885..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1488..1515..1520..1523..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074..2075..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlFol.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.0517171882567515
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7AOfIp4wOjGuaVI0uUTyO:002+XT731GRnXE7AOf64KHIkyt4aTjK
MD5:	0B15C60D3083D34F1F432CDBAE69D88A
SHA1:	9875474DAE6E4A3B514EAFBA1FF5086A69DDF6B4
SHA-256:	374C7C33A33913FE7392BA11AD11A6AA9BDE7824A04B588DE5BF99C922A2F851
SHA-512:	A2857DF1D06E70624784A361546096212A23C7F76BE7107AA9F0E8C48A4ABB3F9384D1DF1BDD6D0018EC32A835431E11280149E56B9EA43DB86DFDB1D02ABE1D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V58..223..224..304..305..329..330..496..497..912..913..944..945..1415..1416..7830..7835..7838..7839..8016..8017..8018..8019..8020..8021..8022..8023..8064..8112..8114..8117..8118..8120..8124..8125..8130..8133..8134..8136..8140..8141..8146..8148..8150..8152..8162..8165..8166..8168..8178..8181..8182..8184..8188..8189..64256..64263..64275..64280..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlIDC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9203
Entropy (8bit):	3.839319198140318
Encrypted:	false
SSDEEP:	192:iZ5jWEJjvimpLaxAbMftLR2xF/es8VfVKGJliO3aoBJmuLqSLMM:iZ5KIj6mpLaxAbMVLR8mlKGJliO9ZkM
MD5:	2C656C619B601DF9FCF2A0A6DAEAC29C
SHA1:	C9004DF28D8FC709C46006DFEAD5CDEB781F04F3
SHA-256:	23A9D923A448F57A7D3914AAE73EB9E11E929EE9EFF9C00F14EA9668576E249D
SHA-512:	2DEA58F3EE2ACEA4D76C81149E5D2772ED9BB95462F1917109DE16E2B6CDFDFECC8E2E2F9C2BF27619609D7CC08564E86A09761F1EC68A1235182641889FC9D4
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1316..48..58..65..91..95..96..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1155..1160..1162..1328..1329..1367..1369..1370..1377..1416..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1642..1646..1748..1749..1757..1759..1769..1770..1789..1791..1792..1808..1867..1869..1970..1984..20

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlIDS.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7975
Entropy (8bit):	3.88285871399181
Encrypted:	false
SSDEEP:	192:iZbLpqTXlkKo+ttxx///m8VtN9mw9ClWOc5TS5N/qbLMs:iZblIXlkKftdnNtvmw9ClWOeg5Zs
MD5:	16FD18B3FA0EC12D2EBC68B4C39BB618
SHA1:	154A4FB8D9B05E565EACF1A4BC175D091263D949
SHA-256:	2D55CAE505D2EAB86A1CA8719CF3195307BE291C6ED862D5E850829112D02836
SHA-512:	902D198B83B2F6BA58AB1E052758A3CB28411B495761E5769FBFA583858C322A2991DA5F8B1068E83A5D08A6C222C950A5B2F78AD9423695AB123A0565BB5507
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1128..65..91..95..96..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..880..885..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1488..1515..1520..1523..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlNch.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.185187912440428
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MPQS2e7BeGtL1wWYxNP1:002+XT731GRnXE76RlBGW+11
MD5:	08326CCF1EF2AA516402D9E6EF7E0C1C
SHA1:	5F10A7B4A723662C21A0C3327218EFEC0E126817
SHA-256:	78A00D5782CB0EDA787261C3DEE5F4EB9BF57ED8E0EA7A3EB66FDC3CE0561759
SHA-512:	F6D90641521A6B58944E1F3FEC8AEBC8D626846E1DC8937B27C9292BE142616E99C4FC699FAF538995CC51479C5C849D99DE67321ACC8235E683CAB26C418B7C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V36..64976..65008..65534..65536..131070..131072..196606..196608..262142..262144..327678..327680..393214..393216..458750..458752..524286..524288..589822..589824..655358..655360..720894..720896..786430..786432..851966..851968..917502..917504..983038..983040..1048574..1048576..1114110..1114112..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlPat.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.019473274779793
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7wb8NCYgQ:002+XT731GRnXE7wS5
MD5:	6A428CABA9CB1F3486EA5940751DCB12
SHA1:	12E4F5036BF2F21C56537A1FBE46164990736D14
SHA-256:	D93E548D12C41F0AAC89EDB2B250E008CE2A8B7D17F908B49AD2CEE1A824AD9D
SHA-512:	8BB38A31676CE9C4A06F488D4CA1F8134E7CA5BD23857D3F96EE935CC5428E7382C230B99D3C9FEA1003B8CA7850BFE39E8EF16C1275364BBEBBAAFF0A549DFC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..9..14..32..33..133..134..8206..8208..8232..8234..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlPr2.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	645
Entropy (8bit):	5.135549743876377
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74FsOfukpWjuPUbOjGuNH:002+XT731GRnXE74XfubqH
MD5:	AE54D39F58E937084AD0D44E17448BA5
SHA1:	A2E38A280A41345427AF0843E2ACCC35E110BEE4
SHA-256:	947D65FB0CCE461BCE81D5AC8563C2DE0FD0F3601005807AFC20867AC9EF5722
SHA-512:	DFD7D65A6A24E596D18E7DEE037E9A52EA58C2F5C3D906A0FBA08CB0E665A35A901C24FDB873FD1D4B4FD8D1A99A52BA5F5A59873D50F45FB3720C3D261A1B31
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..0..256..304..305..329..330..376..377..383..384..496..497..700..701..924..925..956..957..7830..7835..7838..7839..8490..8492..64256..64263..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlPro.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	635
Entropy (8bit):	5.126161884168692
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Dn2FsOfukpWjPUbOjGu1:002+XT731GRnXE7yXfumqH
MD5:	15CBD96EABE8C2325F6646925C275C3E
SHA1:	8D746961694930FF2EAF784AE2B22B74C3CE98CE
SHA-256:	D9957B4CF76C040B400A7141A61973A7113E253CAD6236881BC3E60C353D5119
SHA-512:	B173DCBC5F4F337EB05B26D9E087669B3009D4E490CA0BAC5C328E7E4D5926990B7695BBD30EADBD82B6BA2D93FBA6EDAB3BC3C35E52F25459F0A9784BF6E6E3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V24..0..256..304..305..329..330..376..377..383..384..496..497..924..925..956..957..7830..7835..7838..7839..8490..8492..64256..64263..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Perl\_PerlQuo.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	975
Entropy (8bit):	5.019982085582274
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7Iqv4OuAK/FVgw1RHyJ7KGz6:0z+XnEnjqvXK/Qwbau
MD5:	E09E358AA201B077D583D6EE4FC3B202
SHA1:	32EF06DB364631DC0A8F0DB8E3EC36DE2A784246
SHA-256:	A49A49DC64FBF588A4A590F8706744657F8043D9F8B6BE27CEA0DD3ACDA867D3
SHA-512:	C33B281D6AC8777ADEFBEA2254426AAE236A8F33C91796A2FDE682E8D510A196F4C74D75A344EBC2BE7F04275A3AAF6A85B0E309D400A446EE84BCFA1ECCBF7C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V78..0..48..58..65..91..95..96..97..123..168..169..170..171..175..176..178..182..183..187..188..191..192..215..216..247..248..847..848..1564..1565..4447..4449..5760..5761..6068..6070..6155..6159..8192..8255..8257..8276..8277..8304..8592..9312..9472..10102..10132..11264..11776..11904..12288..12292..12296..12321..12336..12337..12644..12645..64830..64832..65024..65040..65093..65095..65279..65280..65440..65441..65520..65529..113824..113828..119155..119163..917504..921600..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\QMark\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.158335315961857
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7fMYUA6TCKB9VAIYcH:002+XT731GRnXE7fSA6JSIYcH
MD5:	46ED726E48E903166C2835FE8031AF88
SHA1:	62B2D76B2A5A20B0F270AC650A21A126DD73DA6A
SHA-256:	80C21FC8FE209BF4D9AB531AD0CC783A031247ED95CD0C354196F1F5AF4FB1B3
SHA-512:	36BC577F3BB1802CEC00CD699D5F496FC91F3E4B8FBC9091EE29607AE49576518C9DACB709FDCE47A8401AEAC5C127DF01C24233C876A65E4D79A1A72DFFD5DF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..34..35..39..40..171..172..187..188..8216..8224..8249..8251..11842..11843..12300..12304..12317..12320..65089..65093..65282..65283..65287..65288..65378..65380..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\AT.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.049111453379999
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7dy:002+XT731GRnXE7U
MD5:	9EAC9B354DA4BD2159608C90C1DB8A9F
SHA1:	7D38E6B7602DA4E89B5ECCAED4654E3CA5CAB165
SHA-256:	C5E34305610E2CEDEE216C749C6C9BACAC7822E8DAD4F952669D160957B245BD
SHA-512:	8F0B0D884DDD7418C5181E5EBB23E76250D0F72CCC38B1B405F33B3CC295C6ACA843312FBE3B3463AD60FA6CA9A7E60322CEA8C1133BCFADDDAFF6D51A0B4999
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..46..47..8228..8229..65106..65107..65294..65295..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\CL.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	4.9729350127335525
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE77wzA8dVvKAHq4TEAy2u469eEcxQ:0z+XnEn5M8dVvKAHqsu1PcxQ
MD5:	320E2F0A06CB7A69917CA15371AE9F4F
SHA1:	DF8DFF806D6E4082E6D354ABE94048382674A878
SHA-256:	10872E404629374B320BF963CD102D509D88748885D5626A2032A5330988D07A
SHA-512:	6606AE4C722035A089BC2D53D200DD5B64DAADB9F01A329100DBA53C01234ED98437B60820125ED35C684558B4BB9CB347BC4917EC968B612FF03C7497BEE769
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V88..34..35..39..42..91..92..93..94..123..124..125..126..171..172..187..188..3898..3902..5787..5789..8216..8224..8249..8251..8261..8263..8317..8319..8333..8335..8968..8972..9001..9003..10075..10081..10088..10102..10181..10183..10214..10224..10627..10649..10712..10716..10748..10750..11776..11790..11804..11806..11808..11818..11842..11843..12296..12306..12308..12316..12317..12320..64830..64832..65047..65049..65077..65093..65095..65097..65113..65119..65288..65290..65339..65340..65341..65342..65371..653

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\EX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3580
Entropy (8bit):	4.189717145590351
Encrypted:	false
SSDEEP:	96:0zoEnfUUjQviXMzlvX+LJdrDuVspCtL6wI26whsru9eJEc:iZfdjQvi8zlvXoYsctuwIJpuw
MD5:	72E04026FCF58D1A933841454005F3EC
SHA1:	3A49EB822A051A88ECCC0B6BE0256749890B8D28
SHA-256:	1F8E0D55C7A653CC221E0779F698024A47755F215D45A1A8281FEE365646BA32
SHA-512:	A257AEFCDB89E03D69596C518F01258EE5A5586F91D1F31ECB9478E729AFE0380065517E5E040153452022ADF386B4D335A7D8CED4C79A1AD07B9B44E32D0E77
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V476..768..880..1155..1162..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1552..1563..1611..1632..1648..1649..1750..1757..1759..1765..1767..1769..1770..1774..1809..1810..1840..1867..1958..1969..2027..2036..2070..2074..2075..2084..2085..2088..2089..2094..2137..2140..2275..2308..2362..2365..2366..2384..2385..2392..2402..2404..2433..2436..2492..2493..2494..2501..2503..2505..2507..2510..2519..2520..2530..2532..2561..2564..2620..2621..2622..2627..2631..2633..2635..2638..2641..2642..2672..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\FO.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	5.165012296062524
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MFnIPlssYO/eQQC1hU6R:002+XT731GRnXE7xlWOjzjGzQaM
MD5:	8BA9EEF29C59109B65A76B8C637AD427
SHA1:	F94FE97281BB6B7362EF38DABDA7C46F9AFCF832
SHA-256:	964B61B1C9DAA86AA71156D8A0D15C5EB6CFED94500825B2D0FA0FA65239F00C
SHA-512:	6CD40EFB1D57B9FA88E4F54BD88FEB2DEBFD5DBB01AE30F57C9C5134BEE9056757D6308A2DE5211F84778CDC12167136FB7B1A100A37018CCED3086F9949FD4A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V36..173..174..1536..1542..1564..1565..1757..1758..1807..1808..6158..6159..8203..8204..8206..8208..8234..8239..8288..8293..8294..8304..65279..65280..65529..65532..69821..69822..113824..113828..119155..119163..917505..917506..917536..917632..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\LE.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6534
Entropy (8bit):	3.94483569565353
Encrypted:	false
SSDEEP:	192:iZWLpqTXlkKokTtU/qm8ZsN9bsClWOy5TS5OoLMs:iZWlIXlkKZTiyxsvbsClWOsgys
MD5:	E7CCF25C2011D6B41170FA7B40522412
SHA1:	7AAFD29E546C683AAE35C8631FD9A25A337ACD93
SHA-256:	C931DB43327FD278D8D291162D2B3E970FFB128919F27D45C84C00180C18C19E
SHA-512:	1D271481FF1A54AF34EB851379BD06EABB8EB2CA3D9BB8DD3622105D01CC0CA332C01CDED0448009C4DF95BCE829DC08CB0DE60A372AC2C8DD91BEE91388AB4C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V910..443..444..448..452..660..661..697..704..710..722..748..749..750..751..884..885..1369..1370..1488..1515..1520..1524..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074..2075..2084..2085..2088..2089..2112..2137..2208..2229..2308..2362..2365..2366..2384..2385..2392..2402..2417..2433..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..249

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\LO.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8267
Entropy (8bit):	3.8092440293882746
Encrypted:	false
SSDEEP:	192:iZa1lHkjEWnyQHxZ4+BTp45rVBSxP0tkDiR73u0gpP:iZa1hgJtTKVID+7+B
MD5:	E1EDF5E92B8B48CDFACCE2E979A0A38D
SHA1:	A26DE71FFB21C9DC0126F904BA521693BC2BA67A
SHA-256:	C377FBB2D326EC411A8BEE176E0104FF045C1012EA738655BF958FC1650C7D9A
SHA-512:	4A39D2EE23D65DD0020FDDDE981A8536B57FC1653A9C6F979262599DF301FB89BA814F29B6B61B96EE6F695B6F36E90E5D22D4EDE129E88C0BCEBF357DEB19CF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1272..97..123..170..171..181..182..186..187..223..247..248..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..34

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\NU.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.915393402032625
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7OAc3g7+dy3O2ezqa7mctVdg4Pa+7Q:0z+XnEngcG53erg4vQ
MD5:	61D67B4C47D3DC4A14E46378F706849D
SHA1:	D2C6D06D4DDDB8B21A222062CC5F52E350A8F746
SHA-256:	0047A8A76012E591DBF9A18EEB8E015ECA71BF3B8287735D55FA0FB00F3EF3B6
SHA-512:	BE0988B51E840E41D0F2D4D0C004A3762A309BBBF5EF1591A605CE4A24F9CC84BF5E56F2EEE4202B9ABD8F46BECCDCEC0DE35BC523D113E6B36D8DE0C807D961
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V102..48..58..1632..1642..1643..1645..1776..1786..1984..1994..2406..2416..2534..2544..2662..2672..2790..2800..2918..2928..3046..3056..3174..3184..3302..3312..3430..3440..3558..3568..3664..3674..3792..3802..3872..3882..4160..4170..4240..4250..6112..6122..6160..6170..6470..6480..6608..6618..6784..6794..6800..6810..6992..7002..7088..7098..7232..7242..7248..7258..42528..42538..43216..43226..43264..43274..43472..43482..43504..43514..43600..43610..44016..44026..66720..66730..69734..69744..69872..69882..6

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\SC.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	749
Entropy (8bit):	5.139358310674435
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MHqd981kKbQv3sXUsv:002+XT731GRnXE78y9vl+Usv
MD5:	82D0E2FF4331FCE6ED74113A7D44A0DC
SHA1:	5EF2A6496D653463CCFB808CF4D3139AADCD2504
SHA-256:	0524E20B13CAD2F6D8435635A4CBDD429DF23DEF81EB2AB8D5F2B4895FF4B278
SHA-512:	267D3E71500602FFE2EFBC431301C764B5C3FC5014AD4D9A46E4C9FD5CE52ADDF889E7C9CA941292A025660515AD54CE00B35822861DE3456C6397B904D68AE3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V38..44..46..58..59..1373..1374..1548..1550..2040..2041..6146..6147..6152..6153..8211..8213..12289..12290..65040..65042..65043..65044..65073..65075..65104..65106..65109..65110..65112..65113..65123..65124..65292..65294..65306..65307..65380..65381..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\ST.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	4.838628255090824
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7ndEksixbHuGZs/pF9cCPegZYhvuXv:0z+XnEnwmwKGgpXcC2r4v
MD5:	C10594B067C984AEC34A0C0B9A547CBF
SHA1:	384560278A13FB190C2016C9E2E67C165F4E44DA
SHA-256:	A18529EE3E3D6D656C4F8D57D6637680550626FFA0A0E7539A1DAE28A1214BC5
SHA-512:	827E7D78AD2CA64890E3BFC96F881EB15575EBA478B6B5018C4D68837D8A92FECCA09464B49AE3314470E0EFD08ED3A7D08D4A416A9445F55A223C58A1B835CE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V122..33..34..63..64..1417..1418..1567..1568..1748..1749..1792..1795..2041..2042..2404..2406..4170..4172..4962..4963..4967..4969..5742..5743..5941..5943..6147..6148..6153..6154..6468..6470..6824..6828..7002..7004..7006..7008..7227..7229..7294..7296..8252..8254..8263..8266..11822..11823..11836..11837..12290..12291..42239..42240..42510..42512..42739..42740..42743..42744..43126..43128..43214..43216..43311..43312..43464..43466..43613..43616..43760..43762..44011..44012..65110..65112..65281..65282..65311

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\Sp.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	602
Entropy (8bit):	5.0938618174238215
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7FBEQIMPn/v:002+XT731GRnXE7IPMPnn
MD5:	A0966E1862CCF880304FFF2D30A3F9CE
SHA1:	B4F1B4BBF1D2C458A1CDEE6F2882D07818CB467B
SHA-256:	79DA11DEB5CEC78E9E1A45F7AC906E3226B57D388841A8D30FF6631B2871268D
SHA-512:	E53F7094C8CCD1D961B8FD780D81459E99F6BB25CD14331E1676F1FCEA70BED4CCA32F65DA24F7A921CA54E2D5434FDAA8EB1395E50A8DD14FC3DC05A44BA261
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..9..10..11..13..32..33..160..161..5760..5761..8192..8203..8239..8240..8287..8288..12288..12289..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\UP.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8241
Entropy (8bit):	3.809739562453826
Encrypted:	false
SSDEEP:	192:iZEvlzvjEFnyQH3Z4+BTp45rVmXz0thDiZ33fpE9s:iZEv9L+TTKVNDC3B7
MD5:	22C22972490A7E6680E2BC5FC272C75B
SHA1:	9460E1D4D16B9FF49A703B532E4485A43F092664
SHA-256:	CE25BA0A99DB97F023FB8264481FD3CD8225D3E8D2A3BE92F9344DE1E3BAB73E
SHA-512:	D53AB10D62B777CF611DE74ED64BBCBDDD7673D4C8DB0502BFEE236C8D797394125B1800E50A7FE1395ACF111549A133AC992B6B7C5499E18BE897AAF9298842
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1266..65..91..192..215..216..223..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..350..351

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SB\XX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10047
Entropy (8bit):	3.814114306298623
Encrypted:	false
SSDEEP:	192:iZH5hjWEJjvimpLaxAbMftLLHFbNp/cPse4RKiKkJniOtaiB4LNLq/LMNJ:iZZhKIj6mpLaxAbMVLL9kP3iKkJniOhc
MD5:	AFA0F82851FE8053F9BF06FD888882D7
SHA1:	04CC5540D5A45EA97B31398D7851FB14D789FB1D
SHA-256:	BBC985D87E068E4319821FE9039C03E4B6E944231A1D5810B17BF4F326099F93
SHA-512:	E5B6803A7B015A4CBAD159A377002671D16422CBD470EC415D2476397CF24032DBB6898DF828AD34291CDF2CB03CC7D023393A1F544295CAC1748FCF6CA1AF0B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1447..0..9..14..32..35..39..42..44..47..48..59..63..64..65..92..93..94..97..124..125..126..133..134..160..161..170..172..173..174..181..182..186..188..192..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1155..1328..1329..1367..1369..1370..1373..1374..1377..1416..1417..1418..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1524..1536..1542..1548..1550

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\SD\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	921
Entropy (8bit):	5.044576291612322
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7uoSzo8iQE/2fwm7MUp:0z+XnEn/po/ywmbp
MD5:	7997E87E51B61DF5941AE0045CB2DB07
SHA1:	8535605D21271969B72706A469B93DBDCAAD1A65
SHA-256:	B55BBC507EC29443C6FDA0C6A5807608C9EC4849FE1F264678B6C1BFE9204748
SHA-512:	D8D4FA2A3C972186521C3F8E44C34C4C656CBB3156E4178A0EFF6A6079B723D806E03766FFC5358FA55295143944DC5860507E58A54D50FB0A0BDAB200F08BF1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V62..105..107..303..304..585..586..616..617..669..670..690..691..1011..1012..1110..1111..1112..1113..7522..7523..7574..7575..7588..7589..7592..7593..7725..7726..7883..7884..8305..8306..8520..8522..11388..11389..119842..119844..119894..119896..119946..119948..119998..120000..120050..120052..120102..120104..120154..120156..120206..120208..120258..120260..120310..120312..120362..120364..120414..120416..120466..120468..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\STerm\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	4.821472671531533
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7QTdEksixbHuGZs/pF9DFQgPegZYhvuXv:0z+XnEnPTmwKGgpXDJ2r4v
MD5:	CD2E72C05BC92021D094E63508EF52E4
SHA1:	C3080880A6F51F07F4DA5129D59B0262B77825E4
SHA-256:	895038824A84814DC13F541D2B18E7E611820B2197938CAF5A6D93078B753965
SHA-512:	033C5BA2FDAD4A58BEE2F32BF0F8EAB2B52231CC41F7AD4A607EAC9CE72DB8358531BF62EE0812577ADC0B783F9707ED8C8A80F6C25CFBE9CCD5B93648D0ED3D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V128..33..34..46..47..63..64..1417..1418..1567..1568..1748..1749..1792..1795..2041..2042..2404..2406..4170..4172..4962..4963..4967..4969..5742..5743..5941..5943..6147..6148..6153..6154..6468..6470..6824..6828..7002..7004..7006..7008..7227..7229..7294..7296..8252..8254..8263..8266..11822..11823..11836..11837..12290..12291..42239..42240..42510..42512..42739..42740..42743..42744..43126..43128..43214..43216..43311..43312..43464..43466..43613..43616..43760..43762..44011..44012..65106..65107..65110..6511

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Arab.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	4.742430732801888
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7cWd9vhvQkU5E3o440nHrsjRDQKJImivBl6RkJ:0z+XnEnTWdYh5E3l40nLcQKJImEBl6R+
MD5:	3DB172B04A7F8D3F9A5A4246508A6B28
SHA1:	DF58DD2A93DAAFA408910C11F13B0324CE997BC9
SHA-256:	D09288B33732BCB84768917F873902BD8B92F999FEC2BAA8127E2566B8379BCE
SHA-512:	B60C752F350A3C2B09017AF83964F0F1CFA257C20EA9A9D237FAFFDDD8DE2C21420CE3B128314076D57E4DDA6B51265E582027357B30BF11B75334BE93E96DE5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V108..1536..1541..1542..1548..1549..1563..1566..1567..1568..1600..1601..1611..1622..1648..1649..1757..1758..1792..1872..1920..2208..2229..2275..2304..64336..64450..64467..64830..64848..64912..64914..64968..65008..65022..65136..65141..65142..65277..69216..69247..126464..126468..126469..126496..126497..126499..126500..126501..126503..126504..126505..126515..126516..126520..126521..126522..126523..126524..126530..126531..126535..126536..126537..126538..126539..126540..126541..126544..126545..126547..1

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Armn.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.093975187521022
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7IMg+R4Qn:002+XT731GRnXE7u+RF
MD5:	18DE3459BF81A33A479A38E86258B272
SHA1:	51180722380959A4B0E2B43A035D9CFA710E9E84
SHA-256:	F4F5CAA4C774BFC116381CDFADA7B43F83EBAE1554CE8F60245EF406E36F9FA9
SHA-512:	60668A463C802496FD1125700D8594A658B061AAD0830F5FBA5DFFCDFC33A661883FE98C1A64C9BBF8CC8767AB75F52C34CDCC49F338CB6B44D08671520E0A1E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..1329..1367..1369..1376..1377..1416..1418..1419..1421..1424..64275..64280..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Beng.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	5.1057050032402485
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Pye7fmdChyEGK:002+XT731GRnXE7Pye9hDN
MD5:	41FD3D93CA5211C7062C7688DE6532A2
SHA1:	F2926DB2F21C5978CDF61A3387CD10A799D0B1A0
SHA-256:	1AF14AD20117483D4B1CECDF510C1E170D629FD22E489397E74D83C9ECC37C57
SHA-512:	AD84351391B655C71201526A4B944DC3E59E1DF8F8061B8FAC524037602B451ACD7F88E86BFAFF5BF23CD833E4F5576A29ED3597555AA622BE13597DD2C46B86
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..2432..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Cham.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.073803406830853
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP76QyeU:002+XT731GRnXE769
MD5:	67C12D4C0B428357DAF68E9136DB4283
SHA1:	B2518D4BFD94ECD6179CE645F01575471F7453B3
SHA-256:	CCADAF09123880741F433D4315F2517DC0ED0E75A9FF8E076AE01C82C6B704BF
SHA-512:	63F2CF645F7E361A206B631BDD88FC1ED47ABC034FE91536CA8C80E221D9BB922DC3A3B1510CFE3ADA10ABD00692D9355210D344F138CDEBB6EF14DDF95D266D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..43520..43575..43584..43598..43600..43610..43612..43616..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Cprt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.102597716870383
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7GgnJl6JTN3UUdw:002+XT731GRnXE7Jl63kV
MD5:	C4927F2C5A17A6FAA8D72730B3A825F5
SHA1:	D805E0F2E77944D0BF333D3BB57F6505C31AE0DE
SHA-256:	5D0F6268EFF4E9E845D903E9BACB02FDE1FDE237B30F6B0862789F5566BE8B9B
SHA-512:	BF5D3269BC41AF8EA5C6E918F229F7557DC02CFBA8C8D7F41C0413728824062EF94DDB4096ED3FCA859B41F77805D2F58F4A916C957541BB45C782445279BAF8
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..67584..67590..67592..67593..67594..67638..67639..67641..67644..67645..67647..67648..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Cyrl.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	597
Entropy (8bit):	5.114785992067022
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7lMdGgai/kh3:002+XT731GRnXE7Kais3
MD5:	F84939A63106BD8868A60856B75E3827
SHA1:	45A85EF74EA5F0ACF958421C1D86158B67806FC4
SHA-256:	73F4E0B50443C2EC862C4600D2C49329F6FC6F55EF75269834814AECB4E4171E
SHA-512:	C81F679FF135C11EC051C3395AA38D3166FAA4B80385F2AE557465F9FD445ED47B3EA2A6595A11F0481B7F4706658E70A8BDCD23875BC6E461D9A2B036EB0554
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..1024..1157..1159..1328..7467..7468..7544..7545..11744..11776..42560..42656..65070..65072..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Deva.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	5.027172788469676
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP79RqATKw:002+XT731GRnXE7zj2w
MD5:	1046939C90CE6AA8EE8546E8B7ECCE8C
SHA1:	24817B414EC8DF8D3ADC81C0CC09C661D897BF8D
SHA-256:	BD029D1052B911EF974CC6A9CFBEA357A3F4B7AB12494490B3958A5078BEFAA9
SHA-512:	C8F401E285DA2E98D45FEF2223B1941220DD675038CA9E5CF1BD43C5599CDEEA51606E23ACA73C17338B5FA7E60034428CE68F65BFB0419A0146E3A6921116BC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..2304..2385..2387..2404..2406..2432..43232..43262..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Dupl.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	587
Entropy (8bit):	5.080969591468495
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74y4ATgm6Ali:002+XT731GRnXE74pmli
MD5:	DCFC582FB744C788839FDFA37B1BF63D
SHA1:	8A6C6133C49B3F15C08EA09BC168165B39C9DDC1
SHA-256:	4CF1E7910E74227EE940DEEEB885D51B5490E9ACB0460D4A6C435F9892E0000E
SHA-512:	0D186DFB92429BCADCB67E4F53CAFED498D7F667A88BC810E4EDBF799EC8E98DAEDE31401E9CED3A358C8E32951E4535742745C3C576AF6B09E4D3D938D66DCD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..113664..113771..113776..113789..113792..113801..113808..113818..113820..113824..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Ethi.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	919
Entropy (8bit):	5.045604574867221
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7fyGhxdGqRp9vK2OFiFVd:002+XT731GRnXE7fxrpiwFV3/+3VxZ7y
MD5:	61861DD2554BFDB3366B0A1E327724AA
SHA1:	4A208BAE4A173520AF5BEF0A3AE22494771D0C1A
SHA-256:	C1C29CC4755D9519BF8F2A20993CB76838CF798688A27774FEF6EF54F2CD1132
SHA-512:	82867DB56DC4314EDA262D508CD2A2E940B6056B2CC5DDB766A2F7CB0F19989AA5E6D0DA6E08294181492110A89280C7840295BA45E42A611B6463A8DC36DBB0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V64..4608..4681..4682..4686..4688..4695..4696..4697..4698..4702..4704..4745..4746..4750..4752..4785..4786..4790..4792..4799..4800..4801..4802..4806..4808..4823..4824..4881..4882..4886..4888..4955..4957..4989..4992..5018..11648..11671..11680..11687..11688..11695..11696..11703..11704..11711..11712..11719..11720..11727..11728..11735..11736..11743..43777..43783..43785..43791..43793..43799..43808..43815..43816..43823..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Geor.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.1269817396315975
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7WQVpSIC+gw:002+XT731GRnXE7FpjAw
MD5:	095204C0B20A7B4DC91EE7B60F3571B9
SHA1:	5FD27307649049C6AD9350587DE904338A248AF2
SHA-256:	A6686C95EEF1726D6B36288E223D3C6468692F2C97AB5989508EBA5ABBA9BE44
SHA-512:	C0F4A0F1BDB014E6AAC7F4CC2D89C82E3ED2CE8E4B23C7D654767F2C76A49C48BD68AEC8DAAC425C624AAF5C217EC5A9F125FC78F26640B44444BA83B8BE1EBF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..4256..4294..4295..4296..4301..4302..4304..4347..4348..4352..11520..11558..11559..11560..11565..11566..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Gran.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	717
Entropy (8bit):	5.074551525362385
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MyymSiyB+IvlxIUOMVqO:002+XT731GRnXE7OrYIvl7O3B6v
MD5:	8F925FB114C6306E4DAE4B27512B7ED3
SHA1:	A2E20C532FADDCDC110A3FE6E50C7378B8C79BDB
SHA-256:	5367F2ADB48363B911CE3DC9A72D322CCC9F845C05164E17BE7677B017E2EA3B
SHA-512:	C38F1A325C2D9A506598CC714D2ADA6470C7FF238397BF05202E812368F3318B0F5130B16D1A1AFFA8D11088452EF4801F815F4953D0F82EA5943F6C6BC8A69E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V30..70400..70404..70405..70413..70415..70417..70419..70441..70442..70449..70450..70452..70453..70458..70460..70469..70471..70473..70475..70478..70480..70481..70487..70488..70493..70500..70502..70509..70512..70517..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Grek.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	929
Entropy (8bit):	5.029198382919612
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7It+YkYKhQDr8vY4X/tx:0z+XnEnjiN8ojX/v
MD5:	B9B0AB309B72287A0801622F3A0D9420
SHA1:	A48867C4B41BAC46D5C6175DEE1E33DA4D811BE9
SHA-256:	6276A34F06472C080ED4F33F99CFB7F7D877C6003F276046742CA93BF7247109
SHA-512:	92B4B39878157EE45B4775D4E67F1F558DADB4483F1D1F384535D9418D62D606A3D4669E847DBBE8A3C17F1F9F6BBBD3543E8EF395565DBD63F2FB0730BBF36E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V72..880..884..885..888..890..894..895..896..900..901..902..903..904..907..908..909..910..930..931..994..1008..1024..7462..7467..7517..7522..7526..7531..7615..7616..7936..7958..7960..7966..7968..8006..8008..8014..8016..8024..8025..8026..8027..8028..8029..8030..8031..8062..8064..8117..8118..8133..8134..8148..8150..8156..8157..8176..8178..8181..8182..8191..8486..8487..43877..43878..65856..65933..65952..65953..119296..119366..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Gujr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	5.10228776986659
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PyzEgOy3NpCr7ruPTwoJ:002+XT731GRnXE7PyAxyLCrOLnr
MD5:	3D1D21A45C21B49985CD87427064E35E
SHA1:	AD89076C290273372FEB142A00FFACF02D483DAD
SHA-256:	65E469AEB1FCA6192703A41C8F4F44F16812ACB9A1C6BF3191EECAF3F0A49316
SHA-512:	8226ECAC7E4E5F1DCB2AE8946E0EE9C671CBF53027473B900E2A86CBD4EAFC6293D86342BE230835C2795AE39A0150C6FD2DEF938E4395C477D0A10DEAA64289
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..2689..2692..2693..2702..2703..2706..2707..2729..2730..2737..2738..2740..2741..2746..2748..2758..2759..2762..2763..2766..2768..2769..2784..2788..2790..2802..2809..2810..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Guru.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.084364706824316
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MXmUjVXzYMkrZi8Etf63:002+XT731GRnXE7WzZ83FtEtSmQ
MD5:	04CDBFCD94C76EAC3F73C4969F8299F0
SHA1:	9809F2596BE65A05E48E6FCF78473087D103497B
SHA-256:	785CF8CF2B737B8B10BFC1F4A876D9351361E01DAFF9F3E7B469D0647323F9F3
SHA-512:	91E38AA6B816161471AB1461F08A806C54A660071AE7EC550B8EB22DF8C085CAA6F1B1B9043C76DDBD686A808B4A3CF4A50AF5C410DAAFC7CFE627C7F091C7EF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..2561..2564..2565..2571..2575..2577..2579..2601..2602..2609..2610..2612..2613..2615..2616..2618..2620..2621..2622..2627..2631..2633..2635..2638..2641..2642..2649..2653..2654..2655..2662..2678..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Han.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	741
Entropy (8bit):	5.147407702826037
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MaCmv8rRHAmpFRZSj:002+XT731GRnXE7pChrRHAiRu
MD5:	8A15F312CE8AAAE467EB1B8CD7F76F58
SHA1:	934026C81D1452CF354125D3E0FBE12831CD1BFB
SHA-256:	3E57775D2B8CC17A1293E953905CFE140CB108FB08549DF377570FFFB2D5E3D6
SHA-512:	9ACC8AFDAE8EADD95549B7C6FF1785FC678E25833417297D140E980E43D6224C6EBEBC9DB7CFECBC2AD11D607F01F70F8AB7217B2E721BE2ECD75FB321E6C113
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..11904..11930..11931..12020..12032..12246..12293..12294..12295..12296..12321..12330..12344..12348..13312..19894..19968..40918..63744..64110..64112..64218..131072..173783..173824..177973..177984..178206..178208..183970..194560..195102..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Hang.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	701
Entropy (8bit):	5.177305485124858
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PyGHmdhvyfiKI1qicya4:002+XT731GRnXE7PyUmPynIzrv
MD5:	3BE90BC163E019D99BCCAA5EEB2BCB8B
SHA1:	49AB06448DA5395F4180A4573EAD12B94E781488
SHA-256:	45AAF7CBFDA022EBDEE0218E3FE9450CA070846E08698D093E3F83A077FCD392
SHA-512:	5A34394F23FAA4AC573D9D5C2386FA96C1498551237773D66EA55CCAC97A92BF59E78D7609CB5AB47486023670C6D0B91AFA350FF7071A7198451911EA3C3128
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..4352..4608..12334..12336..12593..12687..12800..12831..12896..12927..43360..43389..44032..55204..55216..55239..55243..55292..65440..65471..65474..65480..65482..65488..65490..65496..65498..65501..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Hebr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	627
Entropy (8bit):	5.135269474176424
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7ph7UVL0:002+XT731GRnXE7wA
MD5:	6559240B29DA5C6B85569ED4256E3E61
SHA1:	5F9B3C44FA409A43398303619E38426BF05F15EE
SHA-256:	A38E1F8A05DBCDD740DAD2FCE2113737922FD413E41FBCA1FBE5A29DC775A1BE
SHA-512:	C2DE8C7FAEB5927C7A7317C9DA2908C39B2E136FC8EFA032862F33B4150016CA6A6D5D9B13512A6B0F9733707D73BE261D2BC6FA6FB3F4FC1EC1EFA119E65BA2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..1425..1480..1488..1515..1520..1525..64285..64311..64312..64317..64318..64319..64320..64322..64323..64325..64326..64336..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Hira.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	566
Entropy (8bit):	5.084065239626218
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7+pgoSaX:002+XT731GRnXE7+uzc
MD5:	4F62BD0BCAF81E5DC92DC86FA08C6669
SHA1:	1C6D8639ED7D1FE8ED854801A61525CA4ADC3671
SHA-256:	10AB2C7C62A7682193AF1FD6617D213841BE5A786322427DEE947F70750415F9
SHA-512:	FF81BBE14F02F61AFA091B8FAE5BAE75C1614AD7CF9CC316D2BC1AB86502658D9AC4BB89041745E05D241782F9271D87DDCAD2C1D865D604EED9D602968243EF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..12353..12439..12445..12448..110593..110594..127488..127489..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Hmng.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.077893194758636
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7wTrsCu+0UTqb3z:002+XT731GRnXE7wfe+tTqH
MD5:	02FCF0C26D35BB91B3B5B619E6EE1E32
SHA1:	EC41D9389882B4EB10082E3E68ECA7E84F965214
SHA-256:	32D85F2C86E4D6D51830D125DB2318BCFE98DE5AD54936585A905E87AF01832C
SHA-512:	D4D923CE3DC0FDFC5309CA4769E65E45845ACBD1BED48278E364BA9E03F45A3D5EBA32B59FE1AAFF7C422CA92E156027CCF876E7B8056FD240929D2290A3381D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..92928..92998..93008..93018..93019..93026..93027..93048..93053..93072..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Kana.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.153453201415197
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Novurc6AWv:002+XT731GRnXE76vqc3o
MD5:	3C8F3A215A829A27C3EF17E746E075E1
SHA1:	540B70FF0A42EC2F6E8943A56854A64715FE2346
SHA-256:	EA63FA899F74B4220D731B5CE5A4E60AC8BC81837C5B7C9E3100D8BC10BD40BD
SHA-512:	787C60A6FD260A7FBC4A67A58578B344383CB5C93AF01E41F0AC70ED0A6D96FB96C3260E27BDFA81E3FAF287B09F61F7FA08C9E2B2AFF7B66E392F3823C080A3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..12449..12539..12541..12544..12784..12800..13008..13055..13056..13144..65382..65392..65393..65438..110592..110593..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Khar.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.083060542643374
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MFoMAWn:002+XT731GRnXE7MFTP
MD5:	CD835BDE646401D712B328242D232ED9
SHA1:	3C24C29347FD7777BD10DC496C328FEFB978C17D
SHA-256:	93E276CFF6C5F80DB5CB23518196E5A9B0F7018CBDC4F24F5B367D0D99C52A31
SHA-512:	5EC47628B6AB5FC8942696253FED24D9E56A0A69AC3243A372C09205723D3C0F8EFDF76F3A219ACC2D461362D7655228C66E3C4BF8E32D78A1509997D768A122
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V16..68096..68100..68101..68103..68108..68116..68117..68120..68121..68148..68152..68155..68159..68168..68176..68185..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Khmr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.0150309759048435
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP79U3:002+XT731GRnXE7i
MD5:	B11398150F42276EBDB3369AB45EE587
SHA1:	6A88A6713CA0D474117E55094E5FB96967618DC8
SHA-256:	CF242B3D864C88589E0F3F8A31BD54A7E0E7DAE42381C506FA1052D829004FE9
SHA-512:	BC169F233E7165B9F623502FC63C8CB98D9244B676D8FFBD1A0CD555A4021C23161BA1CECFC3E7CFB6EC693516C33F44CAFAD55C08A02D65BCAA73832CD0DAB7
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..6016..6110..6112..6122..6128..6138..6624..6656..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Knda.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	5.0950722758232105
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Py49Fne4Q9W4CXqC:002+XT731GRnXE7Py49Fne4cW4o
MD5:	6827792FA4D97110E513A4192FC4FDB9
SHA1:	AAD8BC04D3A42D3A1831E658ED21317C57055932
SHA-256:	4267E4ABE18CC255544CE07C999F3CA2D884233DC02D6194B0D5B3415A2EDE5F
SHA-512:	2A72A13BEA8239388F60E8C954E6133600DED1FF3F055EAB01237FBE975A42E4D19A1895CD658206C6777B3BF04773DE5DEB0310E2E0454581FB1F00511845CD
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..3201..3204..3205..3213..3214..3217..3218..3241..3242..3252..3253..3258..3260..3269..3270..3273..3274..3278..3285..3287..3294..3295..3296..3300..3302..3312..3313..3315..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Lana.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.058422459163812
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7We/3:002+XT731GRnXE7j3
MD5:	769D042EC9A4B26FE00E5AEC520089A1
SHA1:	559F8CB5F87A02D06E90A19ECCD3FD0AACDDEFCE
SHA-256:	7FE6F9E25C8172B5D859E4545E2286451201870875E2E2EF044A863466F0221E
SHA-512:	182A3EA412C8FDA3B598579EDFF7AD0D169EC4BFE7118CCE4EF985DC2ED2C8A1F88838E06D8ABA70206E69F1B2A276BECB95AA9A9802D59616D2E0C6308498CC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..6688..6751..6752..6781..6783..6794..6800..6810..6816..6830..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Lao.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	723
Entropy (8bit):	5.079034791779407
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MRVndkOdsZIGbfOBWoKT:002+XT731GRnXE7yV+O6vb2BWFOi
MD5:	C74B0D76E7276E44558FC2B69253149B
SHA1:	F436724C0E9C92C571C5CE77CE3D378F5C311AFB
SHA-256:	BAFFA0147660CEE54E02830883A3C84684B0393EB74653C0181C80BE27C31AE3
SHA-512:	5D75FED3C9644A6AC1208ABA3B1CEE562E6C6BDC5C86CE8B2932EE18BF49718273CA51E3204FD7A80998D89F4B424FC8FE74D3FF986BA2840B15A6A6F0F05B34
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V36..3713..3715..3716..3717..3719..3721..3722..3723..3725..3726..3732..3736..3737..3744..3745..3748..3749..3750..3751..3752..3754..3756..3757..3770..3771..3774..3776..3781..3782..3783..3784..3790..3792..3802..3804..3808..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Latn.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	880
Entropy (8bit):	5.0906446679877435
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7eYqR6h5vXiWRVhp/4Mev:0z+XnEnnklSif/bev
MD5:	2E8516FD627982BA6239EA3183EB4CAB
SHA1:	E3997AF95C1936B6B66C4EBAC8AE3B5D48722574
SHA-256:	FA20CF28B6BCAF6ACC0993C00F7A18882143EC32C76AEFFEF06D47C330EB99DD
SHA-512:	02D1590CFAC96DA8C5B08805A8548FAE335608F442EBE58FD0A6D293F4970DFF7E5E34D333921DD3D77E26739CB1FAACCB2AB454A2337F4375743C7C3E47A795
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V62..65..91..97..123..170..171..186..187..192..215..216..247..248..697..736..741..7424..7462..7468..7517..7522..7526..7531..7544..7545..7615..7680..7936..8305..8306..8319..8320..8336..8349..8490..8492..8498..8499..8526..8527..8544..8585..11360..11392..42786..42888..42891..42926..42928..42936..42999..43008..43824..43867..43868..43877..64256..64263..65313..65339..65345..65371..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Limb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	5.023435189592198
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Qd7+Vv:002+XT731GRnXE7QdCp
MD5:	0FDF133D5FFF75CD796C96132A83BCA8
SHA1:	2B0452FC538F257DBE899B7597CAFB982F65F748
SHA-256:	FD2ED0F880B6499D5134D79BD7AC9A0057932D638786228C44A7D5B0D133DA4D
SHA-512:	C4D42D27C52FF40E656B7450488388A2DD58A2318CC0A0E399F01AEE2696F7D3DE9A997C86904CC8ECDC7B80F1EBDD55AF6AD09A40A7C9617B1D94C485E771A5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..6400..6431..6432..6444..6448..6460..6464..6465..6468..6480..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Linb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.06918602061017
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP70bV3TQyh22TBX41y:002+XT731GRnXE7G3RZToy
MD5:	190F361996CAECED8C5D51E2A69BECDD
SHA1:	030B841F4ECBB5C34ADC916EEE8D0D188276C1B2
SHA-256:	45412032CFE58869B6D91E6DBBE9FC342A36F8A697F299A5F65C0067DE209080
SHA-512:	27DA40700C5B90822F5EE8A4C7BAB758531E91834FEED836B59D992DC255D3B7123EC4BF7D0FF9290D493F44B1BBA21100C4192133E6ACCD89C554F3554079DC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..65536..65548..65549..65575..65576..65595..65596..65598..65599..65614..65616..65630..65664..65787..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Mlym.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.079885951134288
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7cW7EGWK1+HW+k4C+iP:002+XT731GRnXE7ngG51p+M+iP
MD5:	2DC5D70DC383BCBB148FF6E0A4631AE3
SHA1:	62BC41A04AA539FCF686D1881219CC39A26AF26E
SHA-256:	40A94AFEA7909D3F45A9D7FFC97A9985FBEE2CCD7B37FF75BDC1BE13503458C5
SHA-512:	67201CFE43F42A2235CEAA2F2976E3B237C67ADBC521EDCF946E5E26B3E66244DAD5BA57EA3014A6DEC5D238547D37E59B57E9FBF0EA168E8BFCF9F025F4C14E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V22..3329..3332..3333..3341..3342..3345..3346..3387..3389..3397..3398..3401..3402..3407..3415..3416..3423..3428..3430..3446..3449..3456..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Mong.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.0756101748315965
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7nMBoX3M:002+XT731GRnXE7nuos
MD5:	306B410F588406BEECAAAD8F8ECF17A6
SHA1:	E636690ABE29BE55A257EC7AE7D49AB555465DAC
SHA-256:	9E8A0391B79FB19577B0AA74DBAA177B478340719BD0FE55BDD287B9FE3F8924
SHA-512:	573BD3E7D20495EE80A228EAF0BCE0FE431550C2930220D16666CC42D85CA6933FC6B2D15B4A54E67D9DA3A21049BDC78943563F7684E146EC7112E46DAA1F24
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..6144..6146..6148..6149..6150..6159..6160..6170..6176..6264..6272..6315..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Mult.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.058892539039503
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7rX3S5Q:002+XT731GRnXE7L8Q
MD5:	A5CA8DA1FCBB786D6050AB8B9D5B24D3
SHA1:	921F98949910AD72FC64ECF68DDCB91467D32AAF
SHA-256:	64108A9D8B6594B1AEFC89AB8E690CA1B7B51BC9F3D0312C1289AD5553BA748F
SHA-512:	DBAD47A30B7F89D88246E35E706C4D6023CD834308044795364096C65FF1B9EA5D4DEA03D771F9011A6E8D76D7B208BECEF2E9C03A3A52DA3FC9B1A2903CCBA4
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..70272..70279..70280..70281..70282..70286..70287..70302..70303..70314..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Orya.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	5.102427735380458
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PyFu0AyfBkw/ddZDiXke:002+XT731GRnXE7PyFLA4VdhiXke
MD5:	CD8E3B65F73806445F98F63FDC60989D
SHA1:	8FA18C87B5DE30A1964D5F87D1CAE9FFCCB9AED4
SHA-256:	B55A7FEA74F511908339C429987A7B195B9418FA689F6B32F85297414C5A221F
SHA-512:	BE3620A2B7FFBE7929394B10C25FBE60F96B708C0D360733FB28B43A1FCF2A992346AB9797D3E0EDFF578F17DCB9A8FD172EC5FB15EFB814B5ED5D1A8AFCEE1D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..2817..2820..2821..2829..2831..2833..2835..2857..2858..2865..2866..2868..2869..2874..2876..2885..2887..2889..2891..2894..2902..2904..2908..2910..2911..2916..2918..2936..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Sinh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	5.113849324161718
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7/2lDeegqFvIq7+4ysMSS:002+XT731GRnXE7oDeegqCocj
MD5:	695F6985C3730B072F3E7F5A030B0D73
SHA1:	B13A6C363DE68F503F14165806180E16CC1C5C56
SHA-256:	A872F5C339512C603D112CC493A50CA2A3C8DD6BBBC9B9B118B548D6E857A17E
SHA-512:	7878F0349B3E8A8055E1E29B4BB8B5A4DBE88E7C7CC12B16A5C76333F3B0C1D061AD77C82BED9FA521B10B93A993BFF8EBAB788B20DF3699970DE1E011707B10
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..3458..3460..3461..3479..3482..3506..3507..3516..3517..3518..3520..3527..3530..3531..3535..3541..3542..3543..3544..3552..3558..3568..3570..3573..70113..70133..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Talu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.020557255810608
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7H601:002+XT731GRnXE7B
MD5:	A648EDD16E0B10DA05396B979BF1D402
SHA1:	7F1DA4ED66D3689452B62B81760D957BB857CC88
SHA-256:	88CD7FBD05D5B3BD0023F2ECB7D440EA4540F61BF951B732CA45D3725A5EF9FA
SHA-512:	FE6B951CF2566E527B25F8A68D1BB9A0413DE46483002E5B24032380D83291AC48A1791747AB29AE411089C68DEE733794D421914B9548BA4771E0439AC4F003
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..6528..6572..6576..6602..6608..6619..6622..6624..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Taml.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.13851586403429
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MEAZ7nIZt4BEoGv3OsQV:002+XT731GRnXE7S7IT4Cv+sQV
MD5:	016902EBD01418D82AD734387075EF5B
SHA1:	6A6A50C0AE9E8A55F32C2DF58FA0DC0DDCCB6C86
SHA-256:	20A7C9E627B37536E20B8B1B79E58DB37A038A40F684966A072E5F74B68F566A
SHA-512:	D26DEC8838D46CCB9095849A44F2FD7D3CDF358EA6116EB559FD4A253D860CAA2012ABFE9EC405D0F36AD6D77DF1F4BE7A2FBAFE5EDE4B93ADEDC58E4E0E8384
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..2946..2948..2949..2955..2958..2961..2962..2966..2969..2971..2972..2973..2974..2976..2979..2981..2984..2987..2990..3002..3006..3011..3014..3017..3018..3022..3024..3025..3031..3032..3046..3067..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Telu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.120071968847732
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7hhVX7xjWyWf/Z3:002+XT731GRnXE7nVVjWxHt
MD5:	C37716CED61458A34860809FD333E081
SHA1:	27DD03FAA8BA2E06A28A1C7534BB4D1F122C0E1E
SHA-256:	CB32E85A75F771D40F83158D72F50062FC2A4F71D43E8357692F9B84244C3F08
SHA-512:	5927842C7E695E914337E1201B1D38DC74C094641C1489451061368E887AD17678571AD0C472C64E67BE434D50F0812DA6DBF93E3063579FC77C1AE6259FDC87
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..3072..3076..3077..3085..3086..3089..3090..3113..3114..3130..3133..3141..3142..3145..3146..3150..3157..3159..3160..3163..3168..3172..3174..3184..3192..3200..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Tibt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.088030048810098
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7zj+yaSy:002+XT731GRnXE7zj+y/y
MD5:	FC0721AA8BB26F004C973D003CD92123
SHA1:	92790D2321B914CE36032C583BA80589D69B7DA4
SHA-256:	279158D0C48B2CC6E84A8210A472630E4778143A964DAB03E5C7AF5DB58F46B7
SHA-512:	CAE9A7DD1F2FA0C2D547725872188CCC08FB9DAC0224AF5BBDBDF0292A7D25C50AA9308C79E55886399B626FE364399D3E413F0331AF140F079BD1CB56AA2788
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..3840..3912..3913..3949..3953..3992..3993..4029..4030..4045..4046..4053..4057..4059..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Xsux.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.060162602129597
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7nKj+M0SAIQ:002+XT731GRnXE7nKj+F7
MD5:	3878C532F9C8A15DAEBFE828371C7409
SHA1:	4B8DF9AF3410F468AF6EE3997061292893578E62
SHA-256:	1DFC598431E0195592F78E39A15AA8D207CC0E38DE95CB2DBDA4AECF31F68919
SHA-512:	16164B153037D8069D15F1374862BD364B8B34FE39E2700356E1146EF077DA88234F7934A9F495678F3F4E5C12FFBD51EA426ECEFA066E1BAB56804E59464AEA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..73728..74650..74752..74863..74864..74869..74880..75076..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Zinh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	861
Entropy (8bit):	5.09903346996195
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7yMTRUZx8IDFIy7oh4oAj:002+XT731GRnXE7p8DDKGW08DyWUv
MD5:	3C54458AF7EB4B0A329ED806850A3E06
SHA1:	07110F31AEDB3ED2790E9FFE07FED0D861B5F29C
SHA-256:	C7FFBDE8A3EC3633AD77EE53EBD82EA8D1800B26FA3269251738ACAA273E3EF5
SHA-512:	EB5D6AD3B862C2D312FAACF1C3A1B2C7164C1C4A96D2DF6EAAB0159CFB5D97E74C7F01A99BAB85343E0B5C9C429F4411B23769758577ED8B35F8D13E0B4D4ACB
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V54..768..880..1157..1159..1611..1622..1648..1649..2385..2387..6832..6847..7376..7379..7380..7393..7394..7401..7405..7406..7412..7413..7416..7418..7616..7670..7676..7680..8204..8206..8400..8433..12330..12334..12441..12443..65024..65040..65056..65070..66045..66046..66272..66273..119143..119146..119163..119171..119173..119180..119210..119214..917760..918000..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Zyyy.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2756
Entropy (8bit):	4.320121911085973
Encrypted:	false
SSDEEP:	48:0z+XnEnsrotp/ROt8Qx1qQnf/phHH+AIwRv3+vv43t9UWnc5:0zoEnsamt8a1Nfi2vtbnc5
MD5:	C26D99D70732B958D225B1DFA3D9EBFD
SHA1:	E973CFFBECF57E71E3F16AC4799507B9AFCF9D42
SHA-256:	733664F16114A372D3ADDF3AC285A6428ECCEC8D4824FCD81CDCDCC222C58AFD
SHA-512:	F87D68903FBCB87344B14BC154444E8443F7BDCB08B0AF8DA7097DBC856E8DBB1DE4173BC4FEB81FDFE9040F029BBB84F44609856F430FEE2882924CE340E115
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V322..0..65..91..97..123..170..171..186..187..192..215..216..247..248..697..736..741..746..748..768..884..885..894..895..901..902..903..904..1417..1418..1541..1542..1548..1549..1563..1565..1567..1568..1600..1601..1757..1758..2404..2406..3647..3648..4053..4057..4347..4348..5867..5870..5941..5943..6146..6148..6149..6150..7379..7380..7393..7394..7401..7405..7406..7412..7413..7415..8192..8204..8206..8293..8294..8305..8308..8319..8320..8335..8352..8383..8448..8486..8487..8490..8492..8498..8499..8526..85

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Sc\Zzzz.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	3.85611367535683
Encrypted:	false
SSDEEP:	192:iZcVjWErjvipBLaxabMftr+wk/DvC0YuQjIeilFahBA8ZALMC3J:iZYK2j6pBLaxabMVr+wku0z8Ieili7nk
MD5:	DCE008269366D4DC4B0D865E036A9958
SHA1:	F0253C145D41DE27A636549CCD22904FE75107C0
SHA-256:	5A85F8348E794341B7085AC56627AC11A5FEC137C32EE1C77246207FD216D0F5
SHA-512:	2510FF131E14BBD86BF0C992563BDDFDF889D0A5B3C0A3CBFD01CADCF57086F5C9417D3FBAE4719166A3709AFD88D0763CC820C1E079BEF84D4CA90C427140EC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1221..888..890..896..900..907..908..909..910..930..931..1328..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..1425..1480..1488..1515..1520..1525..1536..1565..1566..1806..1807..1867..1869..1970..1984..2043..2048..2094..2096..2111..2112..2140..2142..2143..2208..2229..2275..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..2561..2564..2565..2571..2575..2577..2579..2601..2602..26

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Arab.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1262
Entropy (8bit):	4.771158387142635
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7GvhvQkj25E3o440nHrsjRDQKJImivBl6RkJ:0z+XnEn2I25E3l40nLcQKJImEBl6RkJ
MD5:	11ABF4ED64BC891176799715E0D8A7BB
SHA1:	D752CB36C1D71CB8B52F1CF3C58E0EDD7A7D7848
SHA-256:	1D4347800D6EA7DBC8C71F4E847909E97CAF58A7BEEF5751A7C367B37B166AC2
SHA-512:	0082B2DD653E901F9C6730B7BEEED47631A6F041355CB1F36CC8C68E944E68BF4441B56C1F9B1438FA6092AF8188CC9387A5F23AE7366E297B9F31767A0EB306
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V100..1536..1541..1542..1564..1566..1757..1758..1792..1872..1920..2208..2229..2275..2304..64336..64450..64467..64830..64848..64912..64914..64968..65008..65022..65136..65141..65142..65277..66272..66300..69216..69247..126464..126468..126469..126496..126497..126499..126500..126501..126503..126504..126505..126515..126516..126520..126521..126522..126523..126524..126530..126531..126535..126536..126537..126538..126539..126540..126541..126544..126545..126547..126548..126549..126551..126552..126553..126554.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Armn.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.092004022240942
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7IMg+RVO:002+XT731GRnXE7u+Ro
MD5:	8F38BE3FACD7AC0A310FF26627FF1A60
SHA1:	62C0C114AC764BAAFFE8300C22F59AA8E5C75C89
SHA-256:	AC3C3F81C375D4ECB59D64E148DAAA4E26AE1C13ED4B5BD91F0EB0F0D601AA4A
SHA-512:	1B41DBFA8D6B35E42D288DB95F1F26C36CF429E74E00505B5DDFE15C2333435C42462FA825A65900C05CC5EC17F8CF647628A4F39C415F3D53DB2143D462D8DF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..1329..1367..1369..1376..1377..1416..1417..1419..1421..1424..64275..64280..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Beng.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.102278383618432
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MvCATz7fmdChyEGK:002+XT731GRnXE7OH9hDN
MD5:	043F1B1555D7B6EA009868FC47D86951
SHA1:	DEDB88B21CA8A32151EC0785A11D389F6064F38E
SHA-256:	B04C88CD64913FD0CE4587A8D4B878B681950AB48F5DD856B808D6E7AC9BE626
SHA-512:	13F933350565048B376E774AB28B8E5261CF6E2377B5D518AE8636851DBE2823647684222F951C1AF78174500CB9755222C0A611377ACD06124F1EA05F3592EF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..2385..2387..2404..2406..2432..2436..2437..2445..2447..2449..2451..2473..2474..2481..2482..2483..2486..2490..2492..2501..2503..2505..2507..2511..2519..2520..2524..2526..2527..2532..2534..2556..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Bopo.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	783
Entropy (8bit):	5.125032283366695
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7YT4nLm+rrx1XQ1GZVF:0z+XnEnkm+rt1Ae
MD5:	D9F3C01E3183B56B0B57AB1F611718A7
SHA1:	176D98C341FAE8479B725CE714363E6F3E851DFD
SHA-256:	42D0B9C4833426C963BC7B52758FFECED92C642D14E49993405BB3DBF28FCC10
SHA-512:	8CA67EFDC805BB8F44ACEF695664EC33AA4DFE714DABFBA0F5B4D7464B3163BFE7273F3C5E92DD2F7AC6FDA4400A3C2F5C5227F63E18BFF4B1B42DF36B2DA6D1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V40..746..748..12289..12292..12296..12306..12307..12320..12330..12334..12336..12337..12343..12344..12350..12352..12539..12540..12549..12590..12704..12731..12736..12772..12832..12868..12928..12977..12992..13004..13144..13169..13179..13184..13280..13311..65093..65095..65377..65382..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Cakm.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.065440566755826
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7GOduY:002+XT731GRnXE7GOD
MD5:	EA3864E42852CBD74CCB2E45591240FE
SHA1:	156A83F72E5CA21FFEE73173FC6A0E10675C02F8
SHA-256:	113BC143C9F0507D799581F4182A2B79826257BBBBF51B65A6395D8C4E68134D
SHA-512:	42A639975AFBD1BEB7D8342D9643D67D885D1A9B6EB66DFC93B30A7C52ACC50A7B659CF94F06591125C4746A7EAA177A05A6302D8D076EAC4708EBD2779C065C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..2534..2544..4160..4170..69888..69941..69942..69956..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Copt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	5.063125309493923
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7lki0cQ:002+XT731GRnXE7b0N
MD5:	44834A8FD1FA1EB3177B7A1E38D8F2CB
SHA1:	5B17DF4CB8013804A05367F79183BA24E6223A9B
SHA-256:	43AEA0F0EC957652C2932A4E5057F434ADE5CC0F17021D6718C2A50B2F116991
SHA-512:	2BDB5F1697ECCF008C37FD7C067433355D302DCEDB147F0EAC68D389CCF6B907E3E888892B04E82ACE29A58A4C23BF0A269A2D601689289785074C73AE679EF3
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..994..1008..11392..11508..11513..11520..66272..66300..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Cprt.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.121328774197878
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7zvQ+4gnJl6JTN3UUdw:002+XT731GRnXE7zvQ+3l63kV
MD5:	360B958DC578EEF108BB822A00F9DCC9
SHA1:	1A42E1771217912E105098A9BF8A5072AC01C420
SHA-256:	BF49666F77454AC722E9A9E5EFD4C3A52F2DBF0BC1732DAC852024661D3398C3
SHA-512:	5A43321EDE0EDAB678B6AFB9E665C2F90D4C5771459CD85567D864E2B32D8ACC39966C7B1CF3AACF09DE4341B0509D1833F4D8AE85F821D72FBF19D10373FA85
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..65792..65795..65799..65844..65847..65856..67584..67590..67592..67593..67594..67638..67639..67641..67644..67645..67647..67648..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Cyrl.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	585
Entropy (8bit):	5.10011783883381
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MGgai/kh3:002+XT731GRnXE7yais3
MD5:	2F3A7C96510D78C9A438D0DB13C61A04
SHA1:	B28687F5A3E71C05FA2922F6B66EDC7AB6864CCD
SHA-256:	CFE80888770470514CE0AA7E3CF7AB11989E14B87AFC20806711A3159C860CFC
SHA-512:	DE7D97245E457D541B5BAB15A4EDC91ED6BFD66CBAAE5C7F63309407CF04F8E430129DFF9A6D630828380AB4BC4469567AB2149A808CABD2161600E8CF42C6DC
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..1024..1328..7467..7468..7544..7545..11744..11776..42560..42656..65070..65072..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Deva.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	583
Entropy (8bit):	5.095361405007746
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Zaaw5Bkw:002+XT731GRnXE7IDOw
MD5:	C9A30DB6A2AD3EEE20D80A8769A43555
SHA1:	7F9FA68120E5A1A1F9CEC89A05CC14789538F841
SHA-256:	537DE9C8DA27DA85170B7E0801574AE8A249618C4BB8AD31B9A98FC041165DB7
SHA-512:	FD6530045F85D556AC395637F8916D589522F45F40E4162C5CBDA7A4F1F018085071142335094B35E8BE081AB6B4D7ADC849B6162C5D69630527CA7358907326
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..2304..2432..7376..7415..7416..7418..8432..8433..43056..43066..43232..43262..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Dupl.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	587
Entropy (8bit):	5.076387043025749
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74y4ATgm6AlO:002+XT731GRnXE74pmlO
MD5:	826CCD04960ABB37093EC99ED72F4C1F
SHA1:	00CA45A2F9EF74A7AF786D909E4AC466BE121D42
SHA-256:	CC0DD7E13383180EC8B2C66C952781C874C0FF2B16CE27785C5A48F09B0611AA
SHA-512:	33D5EC26B42D2F1F31388ED89624D1F7D23D18B81C33C4916F100C54656BFE5FCC2B684ACBB46897F159A23A8A4AEA6AE85113647C5B7C8EA56189D90F52CA4D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V10..113664..113771..113776..113789..113792..113801..113808..113818..113820..113828..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Geor.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.133759962144238
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7dE4QVpSIC+gw:002+XT731GRnXE76pjAw
MD5:	90BEABB60C5E101DF77B728E95D9A365
SHA1:	74FED3A7673D5996C02A5FE38FE022C61971772D
SHA-256:	B4A45425D0699EA6D28BFB616EA9090A0EAFDB28C7DC2092CD49BAB031CA31F0
SHA-512:	476F46446AB84700D12F11C6C91CD3C72E5CE50249742942B0234D1135BE587D8EB649763508DDCE81E5C5D1D5CA0C4236DEC314A89FE4D491EB6D49B8C3C0C0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..1417..1418..4256..4294..4295..4296..4301..4302..4304..4347..4348..4352..11520..11558..11559..11560..11565..11566..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Glag.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.056900033423658
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7bMl3COQv:002+XT731GRnXE72Cx
MD5:	6F324FDAA825965E93B923A6DBF652A9
SHA1:	21805F9C60BBCAC412650282000170CF91B541A9
SHA-256:	8451CD6A567E2EC1DEF5226AE395CD985724037C4B639B36D0200200538D3DEC
SHA-512:	F95C95E580CB6EA536FE949A2DA6FFC4C37F3C8B597BFAF518BCBFB38DDF27D649F90164C34B17A0DCBACD749B356D0A0A4C1B770A3BD5562FAE273D12D53F33
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1159..1160..11264..11311..11312..11359..42607..42608..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Gran.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.062569290328895
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP79AecsO7NrIymSiyB+Ivd:002+XT731GRnXE7Ge+rYIvl7O3B6v
MD5:	869B7F39C441AF78FA7BDE55CC080EBA
SHA1:	810EC3C579BF2BD9249FBDB43B312D247F81FB56
SHA-256:	5D4BB1D12A4D913CD463929F4C4094F26B765E73A64576955AD61265B506DA41
SHA-512:	11EB596269A01FCCA5BD2AAC845C847063830DFCAA774017CD71DA9DDEF8BC6D16B14BB5E0147686F516B61B67E94301251156198345F14C5D92D459A4C20DC6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V50..2385..2387..2404..2406..2986..2987..2997..2998..3046..3059..7376..7377..7378..7380..7410..7413..7416..7418..8432..8433..70400..70404..70405..70413..70415..70417..70419..70441..70442..70449..70450..70452..70453..70458..70460..70469..70471..70473..70475..70478..70480..70481..70487..70488..70493..70500..70502..70509..70512..70517..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Grek.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.012021763411303
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7ImG+YkYKhQEc8vY4X/tx:0z+XnEnjmNrzjX/v
MD5:	16FFD8208D13D7B550060624AF958D10
SHA1:	049EFA1BBAC22042EE13A6E6441B2780FF224761
SHA-256:	582576C2F6777D2306CB54526483D9A1C6FE3776827B66FB7162F22320830079
SHA-512:	B1CFB19A297008388F0F66EE739BBFE18051D7BE9FBC1C988125B16284F3B2AD5C193385E5474223D552A84489A8CE42604234DDABF3DAB7FC01577DE09A703D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V76..834..835..837..838..880..884..885..888..890..894..895..896..900..901..902..903..904..907..908..909..910..930..931..994..1008..1024..7462..7467..7517..7522..7526..7531..7615..7618..7936..7958..7960..7966..7968..8006..8008..8014..8016..8024..8025..8026..8027..8028..8029..8030..8031..8062..8064..8117..8118..8133..8134..8148..8150..8156..8157..8176..8178..8181..8182..8191..8486..8487..43877..43878..65856..65933..65952..65953..119296..119366..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Gujr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	713
Entropy (8bit):	5.114703258825854
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7M8AiEgOy3NpCr7ruPTw/:002+XT731GRnXE7wzxyLCrOLnl8
MD5:	328626297054EFFA0355B57DF9F9D210
SHA1:	4AC55F97E67313A66CFFC72E56CCB4C56FBE499A
SHA-256:	7E5D4259C71B163FFF771E191444FF87C8D6F675F132D454E6B729DBE659005E
SHA-512:	EDCE01E490EB441A79734C39FF189BDD2B66F23D88A3B4B00200FFFCA69C87B7EDA7D22FE03353BFADA78EA7A699656BEC1141D800A1BF020C27099661332C56
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V34..2385..2387..2404..2406..2689..2692..2693..2702..2703..2706..2707..2729..2730..2737..2738..2740..2741..2746..2748..2758..2759..2762..2763..2766..2768..2769..2784..2788..2790..2802..2809..2810..43056..43066..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Guru.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	737
Entropy (8bit):	5.091328077358474
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7M5CAvmUjVXzYMkrZi8EP:002+XT731GRnXE7cvzZ83FtEtSB8
MD5:	C5A309A8C4BE994C31E3B1DAF506D9BA
SHA1:	A0D21429C27C2A2E78EB003F8E910DCB69E29561
SHA-256:	333597AA3FED7C19E2D27386DD4BC8C291AB162C01049536C86A3471160A4D69
SHA-512:	EAE13DDDD0692B330912DDE4D92D187CC6AB26A0763CA5EFF5BA2D2C71F91AD73D28EC282E3FE4F10C2A1ABDD70E9A7A4B445311E3516E4E422CB9EA2EAF87FA
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V38..2385..2387..2404..2406..2561..2564..2565..2571..2575..2577..2579..2601..2602..2609..2610..2612..2613..2615..2616..2618..2620..2621..2622..2627..2631..2633..2635..2638..2641..2642..2649..2653..2654..2655..2662..2678..43056..43066..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Han.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	939
Entropy (8bit):	5.040111982493357
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7eCL47UHmL4y1XQ1GZR8PRu:0z+XnEnJC7a4y1A2
MD5:	9FD5B4200A205796453A6D3888B80F82
SHA1:	E74D19E969F81D4D021B0DB0034C92CD742D3457
SHA-256:	07A696DB590F7145F38C8590502B3530F97E7744AC52457D95E9530ED60250C9
SHA-512:	D596E6440B03EF641691FE80E7C523DE395DA46E4E0EE3A3782853D2AACE985EF74EE3EF8F69DF3680824268AD815845FDBE71EDC5CCEDBD3EF76B189641A490
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V60..11904..11930..11931..12020..12032..12246..12289..12292..12293..12306..12307..12320..12321..12334..12336..12337..12343..12352..12539..12540..12688..12704..12736..12772..12832..12868..12928..12977..12992..13004..13144..13169..13179..13184..13280..13311..13312..19894..19968..40918..63744..64110..64112..64218..65093..65095..65377..65382..119648..119666..131072..173783..173824..177973..177984..178206..178208..183970..194560..195102..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Hang.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	911
Entropy (8bit):	5.0861708703064625
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7UQT4drm+rLfJXKcGZEzVRv:0z+XnEnnZm+rbJ/zLv
MD5:	76E2E3E6E6078AD3F48C503F88E1AA33
SHA1:	08E09E2C04D12268D6144ADD5F49DEDEA911EE63
SHA-256:	81F52A30F3A2EEAD4E0BD467FD5B048E156F4425A86F158D99DF988A0B9058F1
SHA-512:	5B9AF7614D1E503C818850C5CBB4E534CAF2BB3892AF87045862F48CC9CA5676FE98B23DBC9AAFAF5D1545C8F5F028A3D5524A95951D5CDA02ADE3F450299CC9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V58..4352..4608..12289..12292..12296..12306..12307..12320..12334..12337..12343..12344..12350..12352..12539..12540..12593..12687..12736..12772..12800..12831..12832..12868..12896..12927..12928..12977..12992..13004..13144..13169..13179..13184..13280..13311..43360..43389..44032..55204..55216..55239..55243..55292..65093..65095..65377..65382..65440..65471..65474..65480..65482..65488..65490..65496..65498..65501..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Hira.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.099800020454125
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7HrT4zmLxTMvZ1XQ1GZVREc:0z+XnEn7mLWx1AKEc
MD5:	96692E1AF88A6BCB3F983E3F7DC7F07F
SHA1:	B11B0DA7D4678CCF5E20D921094C12D12635BEA1
SHA-256:	19D0CA72ED058FD51EAE71B16FC623F74C0FCCA9B22B3E48AC5F670137878FA0
SHA-512:	DB43B6DCA80E426250C9EECFB1FB856F1D2D8A33C280AB6E98012DB486E7A154DA57093EC2ED12654F2717DD4174F8BC644C0AAC067C47E000ED1F2B7F5A6790
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V48..12289..12292..12294..12295..12296..12306..12307..12320..12336..12342..12343..12344..12348..12352..12353..12439..12441..12449..12539..12541..12688..12704..12736..12772..12832..12868..12928..12977..12992..13004..13144..13169..13179..13184..13280..13311..65093..65095..65377..65382..65392..65393..65438..65440..110593..110594..127488..127489..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Kana.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.113603187244272
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7FVrT4zmLkXKToXQ/5GZV1:0z+XnEnXmLBoA/K
MD5:	52F0E6CF9CCAB86D57D86827D7A8F8BA
SHA1:	C86F875E296FB72E6EDA3C52D7A8906357194918
SHA-256:	AA363387567AC6263349A2C309B21AC1AEF8EE506F5C9DBC1C37AF46A56947B8
SHA-512:	0A3012F1C70E86E60A0849A790CB48355269AEFB379C3D5BA32650096B2665D994AD70802908A837F8738E89C877BC7AF83B742B717453ACCC16DC961F6E7C22
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V44..12289..12292..12294..12295..12296..12306..12307..12320..12336..12342..12343..12344..12348..12352..12441..12445..12448..12544..12688..12704..12736..12772..12784..12800..12832..12868..12928..12977..12992..13004..13008..13055..13056..13169..13179..13184..13280..13311..65093..65095..65377..65440..110592..110593..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Knda.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	723
Entropy (8bit):	5.100924644042868
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MR8AP9Fne4Q9W4CXqZy3:002+XT731GRnXE7m9P9Fne4cW4Hy3
MD5:	E86A4D7CC822411201F185FDC1E50057
SHA1:	6009D2E32E18381DBE5AD0CB9F4EBAB4948D65FE
SHA-256:	99AF760AFA8F2F23F445F87CA5E21DD02E2A26E61965E2119E7DC31110D2E38A
SHA-512:	40A2DEECC0814D191DCDA987CF29CD9EAD6C2D38BDC97837017B3081A85444C4009EEA4E1F8835B28C3639F28244FE46373AFC79064C8F9AD04D545D47430B4A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V36..2385..2387..2404..2406..3201..3204..3205..3213..3214..3217..3218..3241..3242..3252..3253..3258..3260..3269..3270..3273..3274..3278..3285..3287..3294..3295..3296..3300..3302..3312..3313..3315..7386..7387..7413..7414..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Latn.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	940
Entropy (8bit):	5.052318789345962
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7IUYqy6h5vXiWRVqp/+6Mev:0z+XnEnj/klSiQ/6ev
MD5:	520153EA0E21DDCCE3D71B7B224FB04A
SHA1:	CAD21C89CE15586C699D2EBB1A7B2A0FA9F95258
SHA-256:	6DBB53409118DC3C5D034F112C0235020DE40D3FFBF8F3A1163CA4EB70320E72
SHA-512:	02CD7B7E66E88E5D89C28CE33D67F80859612462DCB2967A9A9A8F4A496C16E32DB6C044B6DFCBB89AB528D34876907C1C16F8FBC0311C8CB115D963FEC72159
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V72..65..91..97..123..170..171..186..187..192..215..216..247..248..697..736..741..867..880..1157..1159..2385..2387..7424..7462..7468..7517..7522..7526..7531..7544..7545..7615..7680..7936..8305..8306..8319..8320..8336..8349..8432..8433..8490..8492..8498..8499..8526..8527..8544..8585..11360..11392..42786..42888..42891..42926..42928..42936..42999..43008..43310..43311..43824..43867..43868..43877..64256..64263..65313..65339..65345..65371..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Limb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.044659534683019
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PRDd7+Vv:002+XT731GRnXE7P5dCp
MD5:	6A43A2956F1E9A25C263245F6384987A
SHA1:	5787E199D457E366E4DE6DEDE66C65F814CB0454
SHA-256:	D78F760C5044BF8BA43022CB41C07B810405244703C962CC7183759D67DC4EE7
SHA-512:	F3000A5413E03F22163050FECBC3E1685F09DC7215E01CACB331B39E05E9592DF6F798860B3CF2CBBFBB06FDF89D1972156F6D305AC5FEB7DF522013E92E13DE
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..2405..2406..6400..6431..6432..6444..6448..6460..6464..6465..6468..6480..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Linb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.087261369524775
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HtV3TQyh22TBX4wvQ+3:002+XT731GRnXE7HX3RZTlvQ+3
MD5:	8207AC089C3E9C58C548D3368916C78A
SHA1:	E2D31D479E4D964B1DC86922F79E439D641AAF1F
SHA-256:	F322062522224FEE4A40ACD0BB44F5D73B68EC9693360D6B32A6A4DF3380F374
SHA-512:	325CE913B17C9F9B59511710D64085589F660EBB45AA5D703EC684A16AE471F246003C695A9D3656DA55392CB4C16C176D4A622F01DF0A5C533F1046404FC233
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..65536..65548..65549..65575..65576..65595..65596..65598..65599..65614..65616..65630..65664..65787..65792..65795..65799..65844..65847..65856..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Mlym.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	5.096882501580036
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PyK8ABEGWK1+HW+k4C+5:002+XT731GRnXE7Py+iG51p+M+icyy
MD5:	25E6A34A8E83F13240D199DDB3424735
SHA1:	192F06B6EBEDF8BB06952094155740D772EE5E64
SHA-256:	DCBAF4E2617E1A6ADB7E0BC1BBFA6179EBFA17B04EFF9680F2C412A5C1DC5287
SHA-512:	19F4C73FB08DB77C0E807E8EC788C49A93B3354228301BCDE568BA00D63DF5F10021340A0E06F321F23E8736A52EE77CDC11C40552D23463077539D3DD2519DF
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..2385..2387..2404..2406..3329..3332..3333..3341..3342..3345..3346..3387..3389..3397..3398..3401..3402..3407..3415..3416..3423..3428..3430..3446..3449..3456..7386..7387..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Mong.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.041747591730228
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7qX3M:002+XT731GRnXE7qs
MD5:	E4406B31F7E74530E658CD1246459441
SHA1:	94200BB74A4AC3ED7CD97EF4B148773F30364E5D
SHA-256:	011CAC3BAEBA735C6756E8FF2649500F92FC692ACD782E6A3E6148D3448E5B32
SHA-512:	AEAA6373E610AB66DEDC4E0EBB7BD4173184DD029D21D79B876D9FD730EFAB9EFDF5E335272C3648EF1998879484880F36310854FC6735FD23ABBC769191CB6D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..6144..6159..6160..6170..6176..6264..6272..6315..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Mult.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.07472308993619
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78hOOX3S5Q:002+XT731GRnXE78UM8Q
MD5:	3B7A38891C89058C863B37D0EEA9C002
SHA1:	B4722A810715CFC729EFA44EB386E272E64E628A
SHA-256:	C114339D4C9C5644D93EFF9298D4DF56088A147A26721441C3CE40C5D1670DFA
SHA-512:	319BCBF80489B4C21396776C514D3BD1138A18FE21FAE03E184A93BD89A5F4EA11A17BF1E582D3F66AA6ED349EBD38FA2F97260B3BDC128087573B848E7ECFD0
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..2662..2672..70272..70279..70280..70281..70282..70286..70287..70302..70303..70314..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Mymr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.0576669254645
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP773ooedq3:002+XT731GRnXE7boDq3
MD5:	9E9B031D5AD160C7DFF1F2E97BA1CCF5
SHA1:	20673DF6DC42D759E9E129FABE3CA34F8480987C
SHA-256:	752EE70913AF4AD7F925FF4164250A66059E7DF8B49E2BFA23AC6AABA9FADB7D
SHA-512:	F3F022DC87BFD18DC8742DC08174B653A682F54FB394F018830767D3009C878AF76A04937A999BC3741631E618966A4A69FDF83CD97BE4B296E6DD526D986F2D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..4096..4256..43310..43311..43488..43519..43616..43648..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Orya.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.111253042545157
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MvCAf0AyfBkw/ddZDiXl:002+XT731GRnXE7OMA4VdhiXke
MD5:	BEB85687EE4729D92342202F5A3FBA68
SHA1:	FC5D98C321E1B80AB218508478904C36DC2C0190
SHA-256:	BEEA120A9438267F64A0F1DC06A0BE176720300B07EC5329C98DDA437BC96985
SHA-512:	287D42824BC13F21F1C547CE25346448A333EF1A0040059E70372B7129B9E5E92397C162F5F2028A57F4067A746BC9B666E029579D78970F0AD2E54BAE14E847
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..2385..2387..2404..2406..2817..2820..2821..2829..2831..2833..2835..2857..2858..2865..2866..2868..2869..2874..2876..2885..2887..2889..2891..2894..2902..2904..2908..2910..2911..2916..2918..2936..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Phlp.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.044068379201531
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP78tpV+pH:002+XT731GRnXE78tpkx
MD5:	52338CCFDABBEFE7A58D9C944FCE5684
SHA1:	C13374D4E67C4349431B6746DA092702441499F2
SHA-256:	F4C5098F75824F2565A386D25F038B7B903C28C205C8F09F7AE8919F7E50700F
SHA-512:	76FEEE40F3114C0D82489460F546C08C56C21C3BA12201F31BE95BED773E00B59700778C202ACD03C6BCB151838EDB3F52DE5C9E6B40FB1014600577B3C12501
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..1600..1601..68480..68498..68505..68509..68521..68528..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Shrd.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.117240098148544
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7sHWYdyk2:002+XT731GRnXE7sHWYU5
MD5:	5B37FA92F918A913C7A0FBFF33432349
SHA1:	F7859731748B3CD8F7EFAFBABF775A90BFE0E6BB
SHA-256:	68C819194B21BD7B2B58CC36279F18DAEDFEE64384149098AC37AD7B5298160F
SHA-512:	250021212A6964AC5AE16BD24394F4EE8525E400573A81A6CD39F5C39AEFD6DE6CA7AAC3AACA828AB04C95744ED6814823E9DCCA13A9956156946105EEB1E0C2
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..2385..2386..7383..7384..7385..7386..7388..7390..7392..7393..70016..70094..70096..70112..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Sind.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.057155817660356
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7RXw5llZt3:002+XT731GRnXE7RGllZt3
MD5:	4275599B84B6229C0B5FF31586555FA0
SHA1:	EBCC97B5CECFAB17C754D1242675D5FECE834814
SHA-256:	00914481EB72275226C4924EAF5CF3FB2AEB35839ECAACFF3FCFA6A5C007B683
SHA-512:	2CF49F62C41FA3632CDFA68E6F295FFB7B92CB050CD793577DE2022616134168376B4DD3C7A8F3D24506679A4C6EF141FA70B2E7ED04CEAE43864480CF601662
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..2404..2406..43056..43066..70320..70379..70384..70394..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Sinh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	677
Entropy (8bit):	5.119918586417298
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Pykh2lDeegqFvIq7+4yj:002+XT731GRnXE7PykWDeegqCocj
MD5:	9B13B75ABDA3D88C0032B8032013F3F3
SHA1:	AF7D92ADC162B3548731B2EF1E4D364C7341440C
SHA-256:	6D35201694B7A9C392A0E12B5E05EC5755EDE9CA43AEDB5642DD6A2CB2DDFD20
SHA-512:	38E15C2BEBAF5AFC7C6D8A60F4985B3670F521A3235268AA9628D060FC4B7F6F5E132C0BFB1C55ACD695155ED10DAE5FAC0E6F4E697EBDD97BB8412F28E5808D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..2404..2406..3458..3460..3461..3479..3482..3506..3507..3516..3517..3518..3520..3527..3530..3531..3535..3541..3542..3543..3544..3552..3558..3568..3570..3573..70113..70133..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Syrc.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	5.112158289756412
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7T05rvUiv:002+XT731GRnXE7T0dv1
MD5:	1D47E8CEBC714AAE26496777EBF4B628
SHA1:	8478DC41D2BF709C0E16BC7434ADAB796333C4A5
SHA-256:	96593E2B27A23658009C3CFF6D863A2BC6CDACE7604B7888AFC62BB0FA9D9A6E
SHA-512:	3E47E4D6BB2F045EFAD28F7DE40FF441872A776EED92BEC87A72B145837DDAC426797BF8543BC7A5F3A86BC8FD0A1E529DC9D174728B2849F2F225BDAF9E6A68
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..1548..1549..1563..1564..1567..1568..1600..1601..1611..1622..1648..1649..1792..1806..1807..1867..1869..1872..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Tagb.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.045018661919442
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7qduEv:002+XT731GRnXE7G
MD5:	8628C908A5ABE7F978DE0B1936C10FB9
SHA1:	2B688C3FEA030004736BE3875EC4EFB5C7C8C250
SHA-256:	BFAEE7D2718C68B00D72D2BCD0EEA9912538749FF57343C5F05507D9C4F3115B
SHA-512:	12F75F6B75FDF018942BE30FDFE61499DD7E638266BDB5DC90E953BA073BDDE96BF1135BFF4708EE3C0F8379E53C74239F208AD8E4B176D6673CD528362D8533
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..5941..5943..5984..5997..5998..6001..6002..6004..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Takr.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.075005328936904
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7RXw5lz1U4o:002+XT731GRnXE7RGlZU4o
MD5:	531A0F0015D03B9B6E60954DC6584A1E
SHA1:	E614127D0ACE2E538051234887F8891C02E97A04
SHA-256:	9408343F765EDEDF9A4BB7C0B45920248857C0012E46A7DC1F0448C38A4182E3
SHA-512:	EB2E41468D7E28C321211C4951EA3902CF5BA132022CB1CA9E7067F6ED71A6C2DF745822D5323903ABF6E507FCD3B527EEE63F2576600B8226503B75FB898186
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..2404..2406..43056..43066..71296..71352..71360..71370..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Taml.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	749
Entropy (8bit):	5.137494486012466
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MAcAZ7nIZt4BEoGv3Ose:002+XT731GRnXE7Nt7IT4Cv+sQ62
MD5:	14D640E3DF4BDA261D3978D88632E7B0
SHA1:	EFCBEAA278314DCEEF88BC850FCE11C8D4FD3B04
SHA-256:	B983A220C219D1CC48939A70C9940FC69E6C557CC93C9D86AA121494F67FCDC7
SHA-512:	C5D8CEFB89D679F04DF3B86A99F9E020A4A5D2A8FEA3C8A90C7B059F50A2797B82CA8D6C465F2C741601830EC283F6D37E6AD80B568546B786CD85EF5FFA050B
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V40..2385..2387..2404..2406..2946..2948..2949..2955..2958..2961..2962..2966..2969..2971..2972..2973..2974..2976..2979..2981..2984..2987..2990..3002..3006..3011..3014..3017..3018..3022..3024..3025..3031..3032..3046..3067..7386..7387..43251..43252..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Telu.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.1271547720112425
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MvCA/hVX7xjWyWf/ZUyy:002+XT731GRnXE7OZVVjWxHiyy
MD5:	24ECBD1B210DF5DFE6ABCC057A0BFCCB
SHA1:	F789029B1E383260D61907B8F395D9CE1656A84F
SHA-256:	5531B545721E4E048FA06E0E646AD2343FD62CB0A995CF8E9FB11576203E6770
SHA-512:	4E98CEC2D46A8049EC367D24975E74079479FDA3615A9D8788B0D97DD73AB79BDCE0892403AEF9A0069FC054D75EBDC20B570B546864FCD5BF15FDFBB8B5CE39
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..2385..2387..2404..2406..3072..3076..3077..3085..3086..3089..3090..3113..3114..3130..3133..3141..3142..3145..3146..3150..3157..3159..3160..3163..3168..3172..3174..3184..3192..3200..7386..7387..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Thaa.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.110436396682689
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PaQVmJ:002+XT731GRnXE7PaZ
MD5:	15DE3CB309311325507B3D661E823A37
SHA1:	20ECCC56DE8315A7B2DF27A56EF81427FFE7E178
SHA-256:	C0DFC1FEDD2E324987E8726BC27ADC3F596A401510B02D291ADEE1E821F2D175
SHA-512:	B3B9E5BF2AF1459B56BE3664043BAEADE7AB143A84684170175993B1D24D1EC6E71BCBB316C665A2B5AC6EDB05F4E3238F89DDD5C28E02AB01996AB9BE8CC231
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..1548..1549..1563..1564..1567..1568..1632..1642..1920..1970..65010..65011..65021..65022..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Tirh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.047487633340089
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7RXw5lQ1Q:002+XT731GRnXE7RGlQ+
MD5:	CB9D2A769EB49658B9A58FC90F2F2864
SHA1:	77FD72D8D906889DC261985DF9942CFDBCB69A1A
SHA-256:	23960BE0851B0A454E2B991422227697E7568294F28DCE598BBA9EDD56C6B563
SHA-512:	94AAB011DF3485780714BFF9F585EBCA8E6BE93E30878A32BF240B8C4FE5C24E63441D5C83FEBBA6C388D9C67E9A3EF8CA49302A090D8E35FCE149BF7F1F34D6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V8..2404..2406..43056..43066..70784..70856..70864..70874..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Yi.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.136832480339173
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7gZTY9UFX/+:002+XT731GRnXE76TZF2
MD5:	CBC08D5C1545738D103CCBC6AAD1D3F9
SHA1:	AD97B5A9CCF0C8D86583C6F80ABCABF880E91D35
SHA-256:	5E2D77BCF048259E050957B22BBEA951A803B4AE083418DA4BF8ABC8D2AA0259
SHA-512:	C9AFE8108F4319384A8094B919AF39D05C3E22CD7FF8898F0786B1EC2595270C784F55CC9BFA52FE588B7E707ABC60E1B7B51E39B082A72795C10F07211B1B02
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V14..12289..12291..12296..12306..12308..12316..12539..12540..40960..42125..42128..42183..65377..65382..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Zinh.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	719
Entropy (8bit):	5.162258973885861
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MxENl3y7olNV8G7awMNJ:002+XT731GRnXE7iEnGA8GNyWUv
MD5:	8B872FDA3FE1B34489AFC911B1E36385
SHA1:	C81212D61CB877C9ADD08BD992470CCCDA5ED05E
SHA-256:	A3FA766E25E14D517BEC7B24A8D3A7895C89FED93ADD914C2FE78323F09E34BD
SHA-512:	4FB09B7676D6B831423695A31561F1CE1A2F06D83A8686C6C518B93F0CAEC894204D007C8B485B41427D400E0184F2E0DF8DB6B89B2653F942027685B0A266B9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V32..768..834..835..837..838..867..6832..6847..7618..7670..7676..7680..8204..8206..8400..8432..65024..65040..65056..65070..66045..66046..119143..119146..119163..119171..119173..119180..119210..119214..917760..918000..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Scx\Zyyy.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	4.379432873343291
Encrypted:	false
SSDEEP:	48:0z+XnEncp/ROpEtyqFphH+Iwtv3+vv43t9UWnc5:0zoEncmpEMyWvtbnc5
MD5:	D91498DCC769C1FE3CFB822FEFD31DDF
SHA1:	FA3F388D44FF76F35029BEA0C43F12B4B41401D7
SHA-256:	D6C6DDBBB8944394938059F9A3BF11203C2E6A15EFEA3B976F9AA642C5DD6ABC
SHA-512:	B9EBA5E9C4001AD734FC9453DFB81DAA357647A8928419C7A0D76766734874C0400B2608CBBC86810F323922A31839C3BAD0A57925580033B22998B496D6D889
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V274..0..65..91..97..123..170..171..186..187..192..215..216..247..248..697..736..741..746..748..768..884..885..894..895..901..902..903..904..1541..1542..1564..1565..1757..1758..3647..3648..4053..4057..4347..4348..5867..5870..8192..8204..8206..8293..8294..8305..8308..8319..8320..8335..8352..8383..8448..8486..8487..8490..8492..8498..8499..8526..8527..8544..8585..8588..8592..9211..9216..9255..9280..9291..9312..10240..10496..11124..11126..11158..11160..11194..11197..11209..11210..11218..11244..11248..1

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Term\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.668181166308871
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7aKcrFTioRUD3uRb2bWQ9/k90yoyqQwcS7uGLPZYahPJ:0z+XnEnxKcrFuN3JNpePWcyLuiB
MD5:	2DFBA14683DF434DD85DB753BED9C365
SHA1:	A7806D6CEB90B3A5B38CE508347961962285E34C
SHA-256:	1B20449196303A4294911516B1EE2D9A993AEB4EBF88798D77DFFFE05A79AC93
SHA-512:	984397FB831145A8A34545BD86FF911FCD14EFE032B58407A069D5FA5ED5A43C00A60871DD70F93DFBBE1C8EDCD409FB5BD099010FC3AAE469DAADF49A32AFA6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V180..33..34..44..45..46..47..58..60..63..64..894..895..903..904..1417..1418..1475..1476..1548..1549..1563..1564..1567..1568..1748..1749..1792..1803..1804..1805..2040..2042..2096..2111..2142..2143..2404..2406..3674..3676..3848..3849..3853..3859..4170..4172..4961..4969..5741..5743..5867..5870..5941..5943..6100..6103..6106..6107..6146..6150..6152..6154..6468..6470..6824..6828..7002..7004..7005..7008..7227..7232..7294..7296..8252..8254..8263..8266..11822..11823..11836..11837..11841..11842..12289..1229

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\UIdeo\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.170349368439208
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP74mVWDto8sEFRZ5:002+XT731GRnXE74kwlRP
MD5:	87CBF64A2EAB60147ECCD6B2FDDF472B
SHA1:	970E71ABF4642B8A8D1C0C5461853AF51159D71D
SHA-256:	965967897B390CFDE7BC6F53A68A12F38864680BB6D7BC7EA6A1E538FCD4F359
SHA-512:	3266BF15E046A6533682162B54DED8AA48C0BA798EC8195993FED250AB398D22F5606C0EC03422C3B70C6707014AC479C63F8A61693407AD96BFDE6AE486F4E1
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V26..13312..19894..19968..40918..64014..64016..64017..64018..64019..64021..64031..64032..64033..64034..64035..64037..64039..64042..131072..173783..173824..177973..177984..178206..178208..183970..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\Upper\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8205
Entropy (8bit):	3.8109444310732665
Encrypted:	false
SSDEEP:	192:iZSmBlzvjEFnyQH3Z4+BTp45rVdQ0thDiZ33fpE9s:iZSmB9L+TTKV7DC3B7
MD5:	E86C70B5658329A131B4E7498EEB5280
SHA1:	D7F6BB2B2E34E99992E770DE638DE97B538077D6
SHA-256:	859F3C15A9247E19DAA6A22EC6AE655A4E7B17E3DBE58245D492D8DA5C1387B1
SHA-512:	0A44E4516B7183BE93B53CED06ADE93AA1A7D22496E00A225919C0F72712B72D3DCFA7988304CD1B644C73445D7F4A012DCD3BB6967935BD29121176B52DEFC9
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1260..65..91..192..215..216..223..256..257..258..259..260..261..262..263..264..265..266..267..268..269..270..271..272..273..274..275..276..277..278..279..280..281..282..283..284..285..286..287..288..289..290..291..292..293..294..295..296..297..298..299..300..301..302..303..304..305..306..307..308..309..310..311..313..314..315..316..317..318..319..320..321..322..323..324..325..326..327..328..330..331..332..333..334..335..336..337..338..339..340..341..342..343..344..345..346..347..348..349..350..351

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\EX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.107602858232499
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7ib+guHh:002+XT731GRnXE7uJM
MD5:	202254752111AD3A9602AF96DC1A545F
SHA1:	2C03501E29DA263A21E5637C2307BDE4347ABB0E
SHA-256:	D96AE03E269E3BF7A7FE06F98A2A266BB4472181A02AF5AD8952E926CBFE8C92
SHA-512:	71A278525D18ADC5C5B04974F89A9DDAAE5DD9C0519089FFBDB4CD3E294152419940304AD36D59005A92170E5ACFF23EFCB884EE0B2EC19E159990CF036FD986
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..95..96..8255..8257..8276..8277..65075..65077..65101..65104..65343..65344..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\FO.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.168445605314091
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7MDnIPsYO/eQQC1hU6Gz4:002+XT731GRnXE77hOjzjGzQaM
MD5:	43A55A14841A8DA8489D675C2B9622E8
SHA1:	BACF931C0B364AA049B96CE91F871D4AD9F195F5
SHA-256:	FCF796347F938DC33AEE6A2400D9C0781353B81F8AEB34E99233C8FFFDB73DC2
SHA-512:	D355AE587A11E5FA2435D7B6DC57DCEFFB412299BCC7C4E51396AB85E67B73EEA97C5E464451FC59DFBD969C156732F8AC3BAAB758FB7C035DECFB9AFF59645D
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V34..173..174..1536..1542..1564..1565..1757..1758..1807..1808..6158..6159..8206..8208..8234..8239..8288..8293..8294..8304..65279..65280..65529..65532..69821..69822..113824..113828..119155..119163..917505..917506..917536..917632..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\HL.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	643
Entropy (8bit):	5.150485117017561
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7HBu/PydW2UVL0:002+XT731GRnXE7H2PycA
MD5:	A65DF59904689529F0715178B652F704
SHA1:	078914B1B2DD3BDC3D0DBF893E77B86AFE2D0589
SHA-256:	DFF7C09F8FF8CBAE47A6293D99A3AA98F9B1E615BF64EDE68A3128965676287B
SHA-512:	C0CF88BB65D9C6B66A8B5D1EEEB461B1B0555BA9ACA7008AEFF867132F26A514D2890F67B3DE66C00B72F9678458840A47EE19DFA438BDD34C42B535035662D6
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V20..1488..1515..1520..1523..64285..64286..64287..64297..64298..64311..64312..64317..64318..64319..64320..64322..64323..64325..64326..64336..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\KA.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	635
Entropy (8bit):	5.149469655041852
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Kfo77FrcIWv:002+XT731GRnXE74K7RcIo
MD5:	6519879072A6B63EF179609777CEA0D7
SHA1:	1817DC8D1A52EC97C6358FD2813F1BFCE8FDCB2B
SHA-256:	C6D0B9DE645DE17576998A4E34A7D22377C7E28106B45D3E7C35C7A0B10600E3
SHA-512:	6C9DC188BF784312B037EE061A859AD2C77D2A8F6788527A0C0C84D43DAF1D4EF459E9258C8F7DE1AD6B98957F33223E2756994C06EE19F8EE312530673C733E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..12337..12342..12443..12445..12448..12539..12540..12544..12784..12800..13008..13055..13056..13144..65382..65438..110592..110593..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\LE.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6944
Entropy (8bit):	3.9282754926417747
Encrypted:	false
SSDEEP:	192:iZgLpqTXlkQftxxk/sVtAClWOc5TS5mlqbLMb:iZglIXlkQf++tAClWOeggZb
MD5:	19FA6E5F0E386AFAAACD6CE9B2265913
SHA1:	3D863703C96A833EE3E562B9456C11724C87BAA9
SHA-256:	A1BDFC4A5410E214ED06F9B0844BF3D3F2CA6DA4E6C41F9CA3B9B470AE7149C1
SHA-512:	96E01C11E4FFA8C4038102D1734DCF715CD3D9A8963EA0FC6F38FB59741E41603650C5288E138519DC4A76C360C7D47CECAD8ED0935D4E439FA92A6034F4664C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V970..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..880..885..886..888..890..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1523..1524..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074..2075..2084..2085..2

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\MB.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.090151970990816
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Fy:002+XT731GRnXE7c
MD5:	AF8E09DF494AC5160DE073B4BFF6EAFA
SHA1:	A7AAA5ECF4BD67F6029437C18C80A6F3F812E7A4
SHA-256:	381C66D82EE591706957046EBFDE65EE764FDF4B4A6E56FA34F7138BB77FC867
SHA-512:	3620CD214E0CA096208A052FD5B2648DDF4EA583DE20925CA3AADECCEA0DEA7A653324241593BE8078F83FB0C94E28F0C2CE2BB23B5B711306D79D5EAFE0AC76
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V12..46..47..8216..8218..8228..8229..65106..65107..65287..65288..65294..65295..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\ML.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	611
Entropy (8bit):	5.1402848713388005
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7Rr/+8Z8i4M:002+XT731GRnXE7pP4M
MD5:	E298206229D86020B5A5D66E8B2A2BB7
SHA1:	7A6ABFA69A2451967170344F39F7CB6BEC289B0B
SHA-256:	4D7742FD8BE929B1914E9016DEFEFEB868FA2414385C03B01218A7428057AC58
SHA-512:	B4B04961E7CBD74289099D3A9EDE588D2B21B9F50EC2F46630C8F708B9A19825B3C3986F23BAA553F2AAFBC9C813D3CEBDFB693AFF12FEBA9EB494FF11A4637C
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V18..58..59..183..184..727..728..903..904..1524..1525..8231..8232..65043..65044..65109..65110..65306..65307..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\MN.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	677
Entropy (8bit):	5.136573928300634
Encrypted:	false
SSDEEP:	12:00tE98NXT75pdhFE0X2h0e27E9SUXACF+9HWRrZ5faP7PyY22eErYolKeXylo:002+XT731GRnXE7Pyk/YzIylo
MD5:	733F27BD191563DEF7D8F23DD4CA8231
SHA1:	E86F49C62CB43D8C58455C23D7084475428B4325
SHA-256:	C1F90C080F928F475DA5253B6A2A4A862ABE4B6929AA97A067E17F11A6363109
SHA-512:	4C711D2FD78AF90A8998D364369E791241DC8365F73A9A3197705FCC7A7715199B1861A49F2AEC648CF3B518F31C52E2C7F250DCC3B07CB3C8469C933E64984E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V28..44..45..59..60..894..895..1417..1418..1548..1550..1644..1645..2040..2041..8260..8261..65040..65041..65044..65045..65104..65105..65108..65109..65292..65293..65307..65308..END..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\NU.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.913600761545611
Encrypted:	false
SSDEEP:	24:002+XT731GRnXE7ONc3g7+dy3O2ezqa7mctVdg4Pa+7Q:0z+XnEntcG53erg4vQ
MD5:	83B53BD46E9A9F58FDAC47DD52D452B9
SHA1:	20719E1631871DDF2B63157ED4E509C989CA7485
SHA-256:	13307CB3D319126A23724B308B329A7467306CDA4A4884492422D7BF9EEEBDE9
SHA-512:	E069B2638D34C630A72C1C30A4501D99268AD45A4062E33CF66C639F588FB54312521DD8E90DDB0D9620A430B15DF1F96D01AD841CE610686E36D7F8EC63E01A
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V102..48..58..1632..1642..1643..1644..1776..1786..1984..1994..2406..2416..2534..2544..2662..2672..2790..2800..2918..2928..3046..3056..3174..3184..3302..3312..3430..3440..3558..3568..3664..3674..3792..3802..3872..3882..4160..4170..4240..4250..6112..6122..6160..6170..6470..6480..6608..6618..6784..6794..6800..6810..6992..7002..7088..7098..7232..7242..7248..7258..42528..42538..43216..43226..43264..43274..43472..43482..43504..43514..43600..43610..44016..44026..66720..66730..69734..69744..69872..69882..6

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\WB\XX.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9336
Entropy (8bit):	3.8340956380211337
Encrypted:	false
SSDEEP:	192:iZQjWEJjvimpLaxAbMftgGkxC/qWHfvqJliO+ao6JnNLqSLMNJ:iZQKIj6mpLaxAbMVP1UJliOKOkP
MD5:	53609B96C6A19AF50A235A81777E266F
SHA1:	F21B9E89A3B001D4F1DB698C1B36038974BA1250
SHA-256:	5560372649C5FE08A1A409D7C065C90F37CD4D042A9E29351CB59203BB2D451E
SHA-512:	FD7EB16567B733F91F58ACD6B49B56FB3B2F254914B5988868B1BBF95DCAD8746CE38A0EEBD88F89375331568A8AC205FD07091554A507E25E404D4B058EA08E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1341..0..10..14..34..35..39..40..44..45..46..47..48..60..65..91..95..96..97..123..133..134..170..171..173..174..181..182..183..184..186..187..192..215..216..247..248..706..710..722..727..728..736..741..748..749..750..751..768..885..886..888..890..896..902..907..908..909..910..930..931..1014..1015..1154..1155..1328..1329..1367..1369..1370..1377..1416..1417..1418..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1525..1536..1542..1548..1550..1552..1563..1564..1565..1568.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\XIDC\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9203
Entropy (8bit):	3.8391025249619166
Encrypted:	false
SSDEEP:	192:iZPjWEJjvimpLaxAbMftLRXx5/es8VfVKGJliO3aoBJmuLqSLMM:iZPKIj6mpLaxAbMVLRHmlKGJliO9ZkM
MD5:	4EBBEBBA5383E26BA8CB97E4C28C50A2
SHA1:	2A7F35403ACDAB4404B5B00A5137828CA223270A
SHA-256:	67DF3464D40B18DF7A9F9F5788ABC6A700EA84C92B67BC6A1107C7236FD21C66
SHA-512:	F33056D41AC453A2A6C438AB11C4E08C5E8D17F63675E5CAB4A777B326E4511E0EDE2A31F8B2B038C32723B600BFD3160E22D7946D96FD8652F89704DB3CEDB5
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1316..48..58..65..91..95..96..97..123..170..171..181..182..183..184..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..768..885..886..888..891..894..895..896..902..907..908..909..910..930..931..1014..1015..1154..1155..1160..1162..1328..1329..1367..1369..1370..1377..1416..1425..1470..1471..1472..1473..1475..1476..1478..1479..1480..1488..1515..1520..1523..1552..1563..1568..1642..1646..1748..1749..1757..1759..1769..1770..1789..1791..1792..1808..1867..1869..1970..1984..20

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\lib\XIDS\Y.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7955
Entropy (8bit):	3.883537081310317
Encrypted:	false
SSDEEP:	192:iZiLpqTXlkKo+ttxxD//m8VtN9mw9ClWOc5TS5N/qbLMs:iZilIXlkKftxnNtvmw9ClWOeg5Zs
MD5:	EAF2DFCD6582A26AFBF013694017DD39
SHA1:	ED51932712D819ABE0E7075E1C6A6528F927F9A6
SHA-256:	E6297660611A8F5DD1859F9D45A34955F533DADD6CD690441A5823E18858B84B
SHA-512:	73FB8602D2B0DFC718C048F30FFAEE76C70BD53E5E916EE096389B9F816E602991CCFF159C09EF157B95A6DC0D50974277874127A0C7ACCF6A9FF9844DCD474E
Malicious:	false
Preview:	# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!..# This file is machine-generated by ..\lib\unicore\mktables from the Unicode..# database, Version 8.0.0. Any changes made here will be lost!....# !!!!!!! INTERNAL PERL USE ONLY !!!!!!!..# This file is for internal use by core Perl only. The format and even the..# name or existence of this file are subject to change without notice. Don't..# use it directly. Use Unicode::UCD to access the Unicode character data..# base.......return <<'END';..V1124..65..91..97..123..170..171..181..182..186..187..192..215..216..247..248..706..710..722..736..741..748..749..750..751..880..885..886..888..891..894..895..896..902..903..904..907..908..909..910..930..931..1014..1015..1154..1162..1328..1329..1367..1369..1370..1377..1416..1488..1515..1520..1523..1568..1611..1646..1648..1649..1748..1749..1750..1765..1767..1774..1776..1786..1789..1791..1792..1808..1809..1810..1840..1869..1958..1969..1970..1994..2027..2036..2038..2042..2043..2048..2070..2074..2075..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\unicore\version

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.9182958340544893
Encrypted:	false
SSDEEP:	3:bhv:9
MD5:	6D3EFC4134921F59243BD62F7F1E96C3
SHA1:	760DA1F392017331848960E60AC3B41616A14D7E
SHA-256:	462C9AAA608FB2014CD9649AF1C5C009485C60B9C8B15B89401FDC10CF6161C6
SHA-512:	F076CB31425EF6D621EE007684B53725C18846457FDA772353806BF713708F1E874366822B4885D8AEAA8C929CF46D5DA94ADA39904147D14C9D62AADBDE5D5B
Malicious:	false
Preview:	8.0.0.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\utf8.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	370
Entropy (8bit):	5.2529828679727615
Encrypted:	false
SSDEEP:	6:TFC4ttQl0CUsFYusQFa4dln0dUswYyd3UswYwyFoWeT7CFqlQ00wQy0+VAKkm+e4:TFLG03sFYusQU4D0ystyystwlxGFqlfu
MD5:	B102073FD9B1B3F60C821042C5FE88C9
SHA1:	C381ACE58ADCA32949F0653ED9B6866FC80396C1
SHA-256:	16988B3E6B271FBC462D3746894603EDEF5DF22404E9398C1279EC44D5F58C80
SHA-512:	BF88AEB343DC9C5E320694D0123B8E5F851D6BA2D7DB02A6CF66CEE79F570DE17D4CE9F5C0703030EE031CFECB38B81342741ACC54EEE135AAC0534660EEE605
Malicious:	false
Preview:	#line 1 "utf8.pm".package utf8;..$utf8::hint_bits = 0x00800000;..our $VERSION = '1.19';..sub import {. $^H \|= $utf8::hint_bits;.}..sub unimport {. $^H &= ~$utf8::hint_bits;.}..sub AUTOLOAD {. require "utf8_heavy.pl";. goto &$AUTOLOAD if defined &$AUTOLOAD;. require Carp;. Carp::croak("Undefined subroutine $AUTOLOAD called");.}..1;.__END__..#line 246.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\utf8_heavy.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	31639
Entropy (8bit):	3.8706094891414176
Encrypted:	false
SSDEEP:	768:iW1ntovg3Hk9mRw2xG7f7Fsl+QwM2ekxJ:Pnivg3c2xGTpsMLBekxJ
MD5:	3E2B8488936CF0A5392FEC7E3772716F
SHA1:	FEECCFBF1BE523AB9F02E3D83D4FACA1206268E7
SHA-256:	80AB0F6EB34720CECB5A000184B529EFD0526CC2A92D4638A36C200BC165667B
SHA-512:	3ABA4B547A0915007934D58646BD6895085A348A15CCF84998C798E672CC667CCC257C2F1CB76F2BE273706F697AB71DCE7237800175B53FFC39E14D157D0853
Malicious:	false
Preview:	#line 1 "utf8_heavy.pl".package utf8;.use strict;.use warnings;.use re "/aa"; # So we won't even try to look at above Latin1, potentially. # resulting in a recursive call..sub DEBUG () { 0 }.$\|=1 if DEBUG;..sub DESTROY {}..my %Cache;..sub croak { require Carp; Carp::croak(@_) }..sub _loose_name ($) {. # Given a lowercase property or property-value name, return its. # standardized version that is expected for look-up in the 'loose' hashes. # in Heavy.pl (hence, this depends on what mktables does). This squeezes. # out blanks, underscores and dashes. The complication stems from the. # grandfathered-in 'L_', which retains a single trailing underscore... (my $loose = $_[0]) =~ s/[-_ \t]//g;.. return $loose if $loose !~ / ^ (?: is \| to )? l $/x;. return 'l_' if $_[0] =~ / l .* _ /x; # If original had a trailing '_'. return $loose;.}..##.## "SWASH" == "SWATCH HASH". A "swatch" is a swatch of the Unicode landscape..## It's a data structure that e

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\vars.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	5.096962149194179
Encrypted:	false
SSDEEP:	24:TVXKKQUAwXd/pM8ZQoW98JMY6W/UZ93XBAXPU5Am45sZ3XwN3XwY4:cKQUAwXd/pMaQoWKJMrWcZRXBAXPBytX
MD5:	70C87A5E4506EB501957C542F5FC2C0E
SHA1:	62391C89B61EA534CE462A3D02A7A0A8B0311299
SHA-256:	C57A154AD04CC0F68BA07A8C3F704931A30463FEC2039CD54CF127A70A4206AB
SHA-512:	7FE1E2BD6E9C6340224859D64650B79921F9D76F9C2AD5A94D18CEF5BD31FE077AE6C8470F263E5752B1D5B10306E876A855FC11C1E088C79B4F60F09291CC67
Malicious:	false
Preview:	#line 1 "vars.pm".package vars;..use 5.006;..our $VERSION = '1.03';..use warnings::register;.use strict qw(vars subs);..sub import {. my $callpack = caller;. my (undef, @imports) = @_;. my ($sym, $ch);. foreach (@imports) {. if (($ch, $sym) = /^([\$\@\%\\&])(.+)/) {.. if ($sym =~ /\W/) {...# time for a more-detailed check-up...if ($sym =~ /^\w+[[{].[]}]$/) {... require Carp;... Carp::croak("Can't declare individual elements of hash or array");...} elsif (warnings::enabled() and length($sym) == 1 and $sym !~ tr/a-zA-Z//) {... warnings::warn("No need to declare built-in vars");...} elsif (($^H &= strict::bits('vars'))) {... require Carp;... Carp::croak("'$_' is not a valid variable name under strict vars");...}.. }.. $sym = "${callpack}::$sym" unless $sym =~ /::/;.. $sym =...( $ch eq "\$" ? \$$sym... : $ch eq "\@" ? \@$sym... : $ch eq "\%" ? \%$sym... : $ch eq "\" ? \*$sym... : $ch eq "\&" ? \&$sym ... : do {... require Carp;...

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\warnings.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	21607
Entropy (8bit):	4.636390927982016
Encrypted:	false
SSDEEP:	192:zspqfWO3DzdF/x7czS45Cgk8v4BRWyzy5YdkYWoxjjrPb5oRzRQRIRE4:z4ZQ9F/x4G+CvWVswW0NyKE4
MD5:	9B4BAE3B40D206F95B263200859E2675
SHA1:	6B0084F47BCE666DD876F2C599182FC7A7D8F5B1
SHA-256:	73F0F75E6D4E375B5643680BAC2C6E8102CB811BA3E51725B54A5E2D258DA7E0
SHA-512:	BCFFB8681DC10C77137D24F38C78B05AAD4575B67927E5C51A331167F9F5E7568A38CF233C765F604ECA5881F478B37E3567FC473E00CA6E0495433D50D2359A
Malicious:	false
Preview:	#line 1 "warnings.pm".# -- buffer-read-only: t --.# !!!!!!! DO NOT EDIT THIS FILE !!!!!!!.# This file is built by regen/warnings.pl..# Any changes made here will be lost!..package warnings;..our $VERSION = "1.36";..# Verify that we're called correctly so that warnings will work..# Can't use Carp, since Carp uses us!.# String regexps because constant folding = smaller optree = less memory vs regexp literal.# see also strict.pm..die sprintf "Incorrect use of pragma '%s' at %s line %d.\n", __PACKAGE__, +(caller)[1,2]. if __FILE__ !~ ( '(?x) \b '.__PACKAGE__.' \.pmc? \z' ). && __FILE__ =~ ( '(?x) \b (?i:'.__PACKAGE__.') \.pmc? \z' );..our %Offsets = (. # Warnings Categories added in Perl 5.008. 'all'....=> 0,. 'closure'....=> 2,. 'deprecated'...=> 4,. 'exiting'....=> 6,. 'glob'....=> 8,. 'io'....=> 10,. 'closed'....=> 12,. 'exec'....=> 14,. 'layer'....=> 16,. 'newline'....=> 18,. 'pipe'....=> 20,. 'unopened'....=> 22,. 'misc'....=>

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\warnings\register.pm

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl5 module source, ASCII text
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.94556306826316
Encrypted:	false
SSDEEP:	12:TFtQLJfnwBGsQUzMEAqXN56R6lz2KIFMXQlVBt6A4JhfnwGB96nwGBYM+HwJv:TjQJwBhQUwEAqdC6plIJRMAOwWgwWh+c
MD5:	6EEED6FD5AF98E2896DE7FB75D53DCFF
SHA1:	841E79BC2591263AFB248F80D57C07E5528FA8D8
SHA-256:	4E37A95AAF7F6F53576F955826B91770155AEF3087D2C0D6A3548E7FDC1B10F8
SHA-512:	7F6813092E16C0C8DC3C1331147498AB2A69A5A42F257C2255F23689277AA27087F3E391ED168E4B67145349863A9538FAED082B360F4A37838A0BAE21E765E5
Malicious:	false
Preview:	#line 1 "warnings/register.pm".package warnings::register;..our $VERSION = '1.04';.require warnings;..# left here as cruft in case other users were using this undocumented routine.# -- rjbs, 2010-09-08.sub mkMask.{. my ($bit) = @_;. my $mask = "";.. vec($mask, $bit, 1) = 1;. return $mask;.}..sub import.{. shift;. my @categories = @_;.. my $package = (caller(0))[0];. warnings::register_categories($package);.. warnings::register_categories($package . "::$_") for @categories;.}.1;.__END__..#line 47.

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\script\exiftool

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	Perl script text executable
Category:	dropped
Size (bytes):	293426
Entropy (8bit):	4.598418731137928
Encrypted:	false
SSDEEP:	3072:bW7XQgmRCEZMl9O+s7RYq8/7p+oUw2XF6arA6X3UwDmzH+qNMAdDDS9eTwOtJ7:b4X7+MSxmNzNGFPrAgzmZxdfB7
MD5:	0ECFD955F2761682ED31A0A499F86002
SHA1:	D70E9F8A185E5A7A8D61A4F82AA9B0C9EE2F0912
SHA-256:	90BE173280B19E1E8E61A41671EFEE9C5A3F598656874F994EDA2C80A98633B1
SHA-512:	0FA098353457512DB3FE4036A8095199100ADE4102EA50A4DACB929089AF0D39D27F95B323BBDF250CA06C6251DD60A76A77070554471434081DBDEA580D66F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/perl -w.#------------------------------------------------------------------------------.# File: windows_exiftool.#.# Description: exiftool version for Windows EXE bundle.#.# Revisions: Nov. 12/03 - P. Harvey Created.# (See html/history.html for revision history).#.# References: ATV - Alexander Vonk, private communication.#------------------------------------------------------------------------------.use strict;.require 5.004;..my $version = '10.96';..# add our 'lib' directory to the include list BEFORE 'use Image::ExifTool'.my $exeDir;.BEGIN {. # get exe directory. $exeDir = ($0 =~ /(.*)[\\\/]/) ? $1 : '.';. # add lib directory at start of include path. unshift @INC, "$exeDir/lib";. # load or disable config file if specified. if (@ARGV and lc($ARGV[0]) eq '-config') {. shift;. $Image::ExifTool::configFile = shift;. }.}.use Image::ExifTool qw{:Public};..# function prototypes.sub SigInt();.sub SigCont();.sub Cleanu

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\script\main.pl

Download File

Process:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	686
Entropy (8bit):	5.253865902477614
Encrypted:	false
SSDEEP:	12:sN25UyVMGHwqAGHmEoRtz+Fr3MkxWVVG78ItIDjSSFTWrL/Mwc6AODNan:sNkVMGH6CzUz+Fr8kIVYQIt4SShOg7O8
MD5:	9717D8F526501BDCC54E24383A99E190
SHA1:	EF1FA2B1E5B0E1F0D0986887E1C22B16254EF886
SHA-256:	A3289C568354C385B9AED167529B7179359D4DC22A11892832B8A011CFDCF2E2
SHA-512:	288EEB963847A33EB06655804C351B888E032C9E6B14DFE0611D66B65905D266AFC658AA8DF70F20EA99A6BC076FC2EF98698437190AFD2126D86804B8718125
Malicious:	false
Preview:	.if (defined $ENV{PAR_APP_REUSE}) {. warn "Executable was created without the --reusable option. See 'perldoc pp'.\n";. exit(1);.}...my $zip = $PAR::LibCache{$ENV{PAR_PROGNAME}} \|\| Archive::Zip->new(__FILE__);.my $member = eval { $zip->memberNamed('script/exiftool') }. or die qq(main.pl: Can't open perl script "script/exiftool": No such file or directory ($zip));..# Remove everything but PAR hooks from @INC.my %keep = (. \&PAR::find_par => 1,. \&PAR::find_par_last => 1,.);.my $par_temp_dir = File::Spec->catdir( $ENV{PAR_TEMP} );.@INC =. grep {. exists($keep{$_}). or $_ =~ /^\Q$par_temp_dir\E/;. }. @INC;...PAR::_run_member($member, 1);..

C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\perl524.dll

Download File

Process:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1932800
Entropy (8bit):	6.087794812055642
Encrypted:	false
SSDEEP:	49152:GhT2+Z2W7pVIZuoDtFDp4Z/x58SVLFC/KnfzNg1mPvKQ2jptOjt6N8qQRdLlO3vo:GhT227p+ZuoDtFDp4Z/X8SVLFC/KnfzF
MD5:	8C356C17C26109175105543EF9289C3A
SHA1:	2EA5887BB8649D412BF6AF0EFB69B09A03465409
SHA-256:	E7BB8D0C256FFD88D050620D3817EA1699CA4EFAD5D3B4904A854EE88985104C
SHA-512:	81269F456F36BBEEEAB7E646B250E7740E86D68B6C041C25A9AAF2DB8700A3988B34C0CF03B52AFDF85C2F4877DF4F5F3C4837970051165484F731785F11647F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..W...........#.....P...z...... ........`.....m................................f......... ......................P.......................................@...............................0......................d................................text....O.......P..................`.P`.data....X...`...Z...T..............@.`..rdata..`c.......d..................@.`@.bss.........0........................`..edata.......P......................@.0@.idata........... ..................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..reloc.......@......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\config.ini

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.458103180234289
Encrypted:	false
SSDEEP:	3:1C8WUbgu:1qUcu
MD5:	ECB2500162EA2BA426E67E5BA11B1E94
SHA1:	5CC73C4CD8F1F5DD06C4B720CFA8D738BBAE20F6
SHA-256:	DFED9DBE58EB2A6CCD770025D1A5C92697BF11EDF2AB614AA89E7BF12E4FB417
SHA-512:	BE6970BA052366ECDA355D87CD4E210A351E1514E936E54F1127877581FF845D73476B98858163CC103DA3E215E0AE7EC9F45040EFE6F2B9908404F59026546C
Malicious:	false
Preview:	[ExifToolCommands]..DefaultsCreated=1..

C:\Users\user\AppData\Roaming\GeoSetter\locale\cs\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1918 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	162185
Entropy (8bit):	5.466401330534276
Encrypted:	false
SSDEEP:	3072:t3rjKZ6CcP9Ih3e8/rn2wrhvRlk0bLQC/JXDU6TC9IA:t3qZ61P9Ih3e8v1vn/JXD3C9h
MD5:	0BB7FFFC0D4958BD5D5877E74ED4E256
SHA1:	A9A121CEDE14DFF01B14B6E6A4D2F33234383808
SHA-256:	CF9075FA417755F459F66C614601B38D3778127787F8327643FCF65DEC7EA771
SHA-512:	C1ED2C7FC0E23E2A11B4190213CCB4462DAC34AA6843ADDCC6EA07D12CF66F749597267D628E5532F802DA77748311E059A4821AC7400EBF513A54352C9CA705
Malicious:	false
Preview:	........~........<.......w....................................-...............................5.......?.......[.......d.......{...........1.......(......'.......D...3...#...x.................../..............................,...........K.......T.......m.......t........................................................................................................................................%.......3.......A.......K.......R.......e.......o.......z...................................................................G.......O.........B......m...........,.......i......'...9...,...a.................................................................%.....................$...................2.......<...6...@.......w................... ..............&..........................)...;...4...$...p...........E.......#..............!..........?......j........................................3...........4.......=.......T.......l.......\|...........$.........................

C:\Users\user\AppData\Roaming\GeoSetter\locale\cs\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: Time Zones 'Abidjan'
Category:	dropped
Size (bytes):	16104
Entropy (8bit):	4.724354920868901
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZjsjWLHWAFQ6CbBwp+1iMnbmji:WyayF1tXGBwg1FnCji
MD5:	0CFF70F60DEAE422703790898CCDFB71
SHA1:	B8FCB6A220510C544AAF3C2A249829C52510058D
SHA-256:	9C9F5D243EFF49D8ABE918B7E7E71D831454629C4EFCDC6B8C8E462A610D256D
SHA-512:	1FEDF2D50FA13FE6FA5FF87F8171EC66FB74414D12F71E4F3E2BB5655938D08A08CEA5A622CB77426F0159CACA2154D67B635D8DC47A36D3E30CF32BE4E273BA
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Users\user\AppData\Roaming\GeoSetter\locale\cs\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.379006389034776
Encrypted:	false
SSDEEP:	12:Kf2jojn2ns9RrzfLsxnvjRdEm7+p1PHHlw3:K+Nns9RrzoDEm7QvFw3
MD5:	DBCD37F15A404C9D4F72CE563DDC679E
SHA1:	6B5DAFED9642473B1A38EABCBAF3A5024F4BBEA3
SHA-256:	15C1FC8CC964A8536CC7B15B24F0ED3FA4740EBE6A74AE1554FFC905CDAC4081
SHA-512:	7CB07C24D133F384298042BF94B6EA4EAEB9DFA90F82070DBBDD06D206D95CD8C7D3AFDE9A71C10472E044D9B555D1A0F1224CAD851EAEF91E81F1875C25A464
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................9...]..........................................A......XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,....G....q.k.::.44....)).##................//....M...u.q.l.::.44.//..$$.............22....Q...z.v.q.m.:;.55.//..$$..........66....U...}.z.v.c......................Y.....~.m.................................].....s...................................._...y........................................]............................................._..............................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\cs\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.456564762130953
Encrypted:	false
SSDEEP:	3:dayWLRLUU:daxmU
MD5:	097587A54608593CBA3CC1467439823A
SHA1:	4E6B28FE47DF537585054C55F98BB583E67DD8E1
SHA-256:	244EA0F40E26BC3C5B1AE1DCD8C1DE6678FF9CD983612E139D6BFE83ADC8F954
SHA-512:	152729B2EE709E4FC006A89076743C5CB27D6FD78661FA843D2C2BBC3C75CADFAC4DB183161D9955BA1B627A9E44D78BB1FEDC0F588E436170E5952349E8D60D
Malicious:	false
Preview:	Czech..3.4.13.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\da\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1242 messages, Project-Id-Version: ' (%dx%d)'
Category:	dropped
Size (bytes):	87685
Entropy (8bit):	5.216188358713261
Encrypted:	false
SSDEEP:	1536:FjvZgkQrLMkm0Bb4Z9hMnh3WjdI64hyyuiSEfa7aINpj7RGkkK:9hgAzKh3YWSEfNINF8kx
MD5:	7B8617120F684BC6B54D30071AE6B768
SHA1:	98D26FE5C0A6EC1F98C67AB15D0CEA37051581C4
SHA-256:	6ED52ABEDF4090F593C6A937287281137CF9E38A54AE44F4B19CFB828C1AC141
SHA-512:	977E38DD20EF52BDF2F78C281D8BE7F0853C534071C45209476099E2CA23346E714A24AF8B421D8CA0339F622CC9CAC880E16E7E4820590C8E25F1084129A5AF
Malicious:	false
Preview:	.................&..y....M.......g.......g.......g.......g.......g.......g.......g..(....h..'...0h..#...Xh......\|h.......h.......h.......h.......h.......h.......h.......h.......i.......i.......i.......i......!i....../i......5i......;i......Ii......Oi......Wi......\i......`i......gi......mi......ri.......i.......i.......i.......i.......i.......i.......i.......i.......i.......i......i.....&j..,...Qj..'...~j..,....j.......j.......j.......j.......j.......j.......k..$....k......7k..6...;k......rk.......k.......k..;....k..$....k..E....l..#...Gl......kl..!...\|l.......l.......l.......l.......l..3....l......,m......5m......Em......`m......hm......qm.......m......*n......>n..h...Vn.......n.......o.......o.......o.......o.......o.......o.......o.......o.......p.......p...... p..g...)p.......p.......p.......p..e....p..X...$q......}q.......q.......q.......q..5....q.......q.......q..0....q..%.../r......Ur.......r.."....s..6....s.......s.......s.......t.......t.......t......,t......5t......Jt......

C:\Users\user\AppData\Roaming\GeoSetter\locale\da\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZDATA
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.261277754950746
Encrypted:	false
SSDEEP:	6:ilijD6YYOxfbXsxfp0tfq+PU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLijn:i4D6xOyx2TPU//IMBivXmBQWiRc5lHa9
MD5:	E10F7E59DD86B9D710BAC02662BDDFD4
SHA1:	CBE47FA99CE804755A160EFFD1B85DBE6A626897
SHA-256:	0BD5365D643D61611F66CAB51D25BECAB9E2E419C2553AC3F08582333B8EDDE3
SHA-512:	C211EC41861EE9F9A697ACAFEFBFCCCA0BF61CB02F98CCCCABAA472BA0BB0D2EF4E43B1EEDFF422AA522CD2EC3F99E04B4A78C3EF33B903A6875BCA26706A9E4
Malicious:	false
Preview:	................$.......,.......8...c...9................Project-Id-Version: TZDATA.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-01 12:26+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Danish.X-Poedit-Country: DENMARK..

C:\Users\user\AppData\Roaming\GeoSetter\locale\da\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.9319938079394685
Encrypted:	false
SSDEEP:	12:Kf2qkoXi+xxSi+DYcBF53ATpl4ZzM7AqSeU0zuYRJlo2acq:K+q7Xxx9+kcBFKTQNMgeFTi2al
MD5:	D98D57C887E126559E2822BAC8749769
SHA1:	62B1105333FED93FB966305268C4CB226077A642
SHA-256:	485651EB621A5A26AC8A26A196DD8657E64E134AA479EB7F8D32935FF959E9BE
SHA-512:	BD52230A2FE88C902CE2922B06B6E222CA191D9664A74409BC7BB52767D5D4F1A4A61A9760949EB1FA99D86D11364790287B8ED60A8BDE77FE5FDAF35E97B517
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.......NN.BB.==.99.55.22.//.,,.......ff.DD.??.::.......11.##................//.......jj.II.EE.??.......87.**.$$.............22.......................................................................................................vv.XX.TT.PO.......AA.<;.66.00.++.%%. .??.......yy.\\.YY.TT.......NN.BA.<<.67.11.++.&&.DD.......z{.__.\\.YY.......TS.GG.BB.=<.77.11.,,.II.......{{.{{.yy.ww.......st.ii.ee.``.\\.WW.SS.NN......................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\da\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.5898980954642865
Encrypted:	false
SSDEEP:	3:BKo9LThn:BKop1
MD5:	9129F564F95C8EEC90CCACB2379D5FC1
SHA1:	F10D80D80905480064CCBE4C339A35ADBC1548B3
SHA-256:	7CB5063EA3C2B7000E1112D1A8E4BE912F8D0273C6715320C62166CC0D5A5F48
SHA-512:	472B21016F28DFBC54EED06E51FCA7DCCE46E922B820AC0A4C4EB483B53C023626A44F93C0FE0BA618FA86B2E8826B4686C3B65CB724CCA2386E89886D4EB0E7
Malicious:	false
Preview:	Danish..2.4.6.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\de\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 2018 messages, Project-Id-Version: Delphi7 german ' (%dx%d)'
Category:	dropped
Size (bytes):	177595
Entropy (8bit):	5.273330607826139
Encrypted:	false
SSDEEP:	3072:VCPZ2J3ghh3x8Lrn2NDkgsxrf7qohl3nkMWe3+:cUwhh3x8KkZxrf7XnHW3
MD5:	39B3DC9F66903D213C1F49A0711C972E
SHA1:	D8C0CB7E9E4D86C468A2DEEA0AF4732832B15978
SHA-256:	1890A57728393FB8427705C04D105957F6C02DF1599F6B046A5A0B1B465ED0AD
SHA-512:	1D810C0381D521405878E0B3BCC6B22E8C021CD906797C299461AE9203C598FA73BEA59619AF69336C15C869A4DF5B20FF66E9CB699701EE64535D86E3471978
Malicious:	false
Preview:	................,?......<~......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...........D.......#....................../...........N.......g.......r...,.................................................................................".......(...............<.......B.......J.......O.......S.......Z.......`.......e.......x......................................................................................................................................H.......G...f...O.................).......T...,...^...i.......'.......,...........J.......[......._.......h.......n.......z...................%.......................$.............................6...........3.......C.......L.......a.......t... ...............&.....................................;.......$...L.......q...E...~...#.............!.................F.......q..................................3..........................0.......

C:\Users\user\AppData\Roaming\GeoSetter\locale\de\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 28 messages, Project-Id-Version: Olson TimeZone Data 'Afrika'
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	4.872972236742063
Encrypted:	false
SSDEEP:	24:N0lUIbqmLswTJWCaTl17XSJbOphvJtlORxhIxSXmRIoWsUZ95e:WKIbqmLsUJenGetMHhmPQsSu
MD5:	E1C4B2E31A54853D5F87084B5F2B7AAB
SHA1:	CAFF24752342F5882239C47C12B1FA6DA876E030
SHA-256:	B934BAA0B9E7D77049D76803DE01494DCC9FB3D7B3E2E806E76524BBFC8F1150
SHA-512:	DF22BFEE804CAE87A7B1130F99BFD6C612F0DBF9B89274C1627CDBC60CE47A701616CBBD35A208903B2EDFD144BB92797222558FCDC4F8AF4AEE3BE720E5FE2C
Malicious:	false
Preview:	....................%...........p.......q.......x...............................................................................................................................".......).......4.......;.......C.......J.......O.......V.......].......d...p...k............................................... .......5.......;.......A.......J.......U.......].......f.......o.......u........................................................................................................................................................................................................................................................Africa.America.America/Argentina.America/Indiana.America/Kentucky.America/North Dakota.Asia.Athens.Atlantic.Australia.Belgrade.Brussels.Bucharest.Cairo.Copenhagen.Europe.Indian.Lisbon.Luxembourg.Moscow.Pacific.Prague.Rome.Tirane.Vienna.Warsaw.Zurich.Project-Id-Version: Olson TimeZone Data.POT-Creation-Date: 2008-04-13 02:04.PO-Revision-Date: 2008-04-13 02:05+0100.Last-Tran

C:\Users\user\AppData\Roaming\GeoSetter\locale\de\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.693621110700182
Encrypted:	false
SSDEEP:	12:Kf27+3Bip2evmV79s96URrmFDJTfH7m7ocRm:K+7s4zvmVpsI6CFDJTfH7m8
MD5:	50EB0FBC70D7442F4DA7F3CF20C20C45
SHA1:	8716C581CAC0A2805D512DC13C7F71F106DC5D8C
SHA-256:	CCB658E975BA5B94D607FE2C10B6CEA695485D55E8BD14C78D8D158665C1DA48
SHA-512:	EABF29E49CADAD86FCDE5DE3173D04F67AC71CA3437207A85D99BDA1799025E47A30B2AE84D0F8235881E28690C093AB721D986AE2B4315C9E12E6E02FA96D80
Malicious:	false
Preview:	BM8.......6...(......................................................................................................................................................................................./../../../../../../../../../../../\|./~./v./y./s./..........................z..v..s..o..k..i../y./.....h..a..Z..S..K..E..=..7../..)..".....m../../y....k..d..]..V..O..G..A..9..2..*..$.....l../?./?....mm.ff.__.YY.QQ.II.BB.;;.22.+,.$$....k\|./?./?....ss.nm.ff.``.YY.RR.JJ.CC.<<.33.,,.%$.p../?.5D....yy.ss.nn.hh.aa.ZZ.SR.KK.DD.<<.53.--.v../?.<If...~~.zz.tt.oo.hh.aa.[[.SS~KLxDEq<<l56ez../??<II......~~~zzzuuuoooihibbb[[[TTTMMMEEE==>.../??:GG........................................../??CLL:IL8GL<JL:FF6A@1??/??/??/??/??/??/??/??/??/??..................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\de\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.4565647621309536
Encrypted:	false
SSDEEP:	3:BoOwn:eNn
MD5:	2DB77D0C34EEA75A688EC70872A15737
SHA1:	45803D47AC49DF5BF97F2025ECC6EB6721F435C1
SHA-256:	7489DA20362D7D793AE41301A6D0DCFE0944E6F129F91733F99CFA747DDA3D94
SHA-512:	4B6CC63107ECBB60CED874589319B77D55582D6F21DAB0F4701176B3A76800228DE444A531D70060C32E80453A6B1D0DEB3629A9D297F61757F2542EDE57EE25
Malicious:	false
Preview:	German..3.5.1.1

C:\Users\user\AppData\Roaming\GeoSetter\locale\en\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 26 messages, Project-Id-Version: GeoSetter 'Add Group'
Category:	dropped
Size (bytes):	5386
Entropy (8bit):	4.971120159095264
Encrypted:	false
SSDEEP:	96:BQZ+Och/TURMmOEWb9e3QZTLI5Auch/xQURomOM219u3QZz:BQ+hIbAbaPAh5jPk1WM
MD5:	AEFC2485130B6DAAA5D1EA92CA44AE94
SHA1:	E7DFDEA2E0F600F8A218B569BE0498DFDBC40358
SHA-256:	C7DAD3C66CD429CBAEE9D832622201CB3EB30C265E533CDE9643D7EEAB06344A
SHA-512:	86B0EB35B1C24F7B351B5897F2F4F3C5060AEECA8DF1A45ED524169353D76B3713FDE2168E6514A6EE0B7DD2BA86997E5CBEA09238735BCB214BED288ACB5AA2
Malicious:	false
Preview:	....................%...........P.......Q...$...[...#...............5.......+.......".......1...;...*...m...............................................m.......x...R....................... ..................."...+...9.......e...........h...........b.......l...................5.......+.......".......,...<.......i.................../..........................._.......p...R....................... ................... ...&...7.......^................................................................................................................................................................Add Group.Add Offset Values to EXIF Taken Date.Add Time Zone(s) to EXIF Taken Date.Album Description.Always update EXIF data (GPS and taken date) in image.Assign Position and Data to Selected Images.Assign Position to Selected Images.By disabling this option, changed GPS data and EXIF taken date.will only be written to the sidecar file. The EXIF data won't be.updated in the image itself and the changes m

C:\Users\user\AppData\Roaming\GeoSetter\locale\en\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	421
Entropy (8bit):	5.291366276156011
Encrypted:	false
SSDEEP:	6:ilijGYYuVsxfp0tfqqPS/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLidAwIB:i4Gxuyx2la/IMBivXmBQWiRc5lCCB
MD5:	D41BC29EEE6ACFB71174B159D46A9AB6
SHA1:	195B504265202D2C9A10EFBCC7A95E80E361D861
SHA-256:	90730C9A4FC8286B3A25D73841B873961C4B41D7ED9747428BC5FEC9E6A99251
SHA-512:	D7BAA18A692E8CF571857A8B3AA45354D73F91A1FE494F86567099B685A84D6E176A5541A7A151BCC1E5BBB564F0D23343D6BE5638D6E08A0C05CA866E7C0215
Malicious:	false
Preview:	................$.......,.......8...k...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:34+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: English.X-Poedit-Country: UNITED KINGDOM..

C:\Users\user\AppData\Roaming\GeoSetter\locale\en\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.912371847252986
Encrypted:	false
SSDEEP:	12:Kf2MQNBQdutoHLyPu8F/1ROtcfrUiCRow4CZqha2TPX:K+MFrym4/1ROtMrDCRoBHha2j
MD5:	74A3030A545945A1E4B88F7F70EFB621
SHA1:	8C1565BE61BC98B52FD91B7479B5FD4B59679878
SHA-256:	915580C56BE994363C08E3DFF542C32A75756817018849E8EA80094F845522DE
SHA-512:	C59F89BA9544D1372A61A2E258DA2A5B1296237B925D92742734246B13931FCF5E784656B85AAD1D4F9ED99766DAD12549196EB268EE7EBEC26E3DB367B7B3A3
Malicious:	false
Preview:	BM8.......6...(.........................................................................................................................................................................................zcD..iC.,..(..%....8..4.....s..p..m..~1...n5E.....x.......q.n...HT.CR.....fW.^U.....M`.rk.V7.....~....t\...-+.+).....?:......\`...g...^?...fZ......_c....42.1/.......AB......`Tk.......................==.86......................}a....dd.__.YY.TT.NN.LL.EE.??.99.44....++.FS.:.......................UU.NN........................b...~...........\\.XW....im.......IA.r.-...b................ie.a`.....t..........4...................................\|.............{.d.d..a...c.~`....kI.fH.\=..ZoQ..{..................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\en\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.8077635764171953
Encrypted:	false
SSDEEP:	3:OCCWZUbV:OCC3x
MD5:	5D7335F5595D01C708EAA7CDC456940A
SHA1:	140046C930892288DCB7435702342205CC719DCB
SHA-256:	ACBC7F519259F914707880A4DBD26FBE57BBEC5248D68578F55206271A1A2C4B
SHA-512:	98623DF9B9DFEA087D0990FEC36EB429B2DBC0074FE34AD21D2D3ED91669724C2E798CC082803BAEF40597131B1C6EA04A4D3D3F41C1F654C98D6897F18389AB
Malicious:	false
Preview:	English..3.4.12.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\es\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1918 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	164654
Entropy (8bit):	5.240844332815449
Encrypted:	false
SSDEEP:	3072:t3rjK3BPOHLQ0cP9Ih3e8/rn2wrhvULtEb+zcMy:t3qxCMP9Ih3e8v1ULtar
MD5:	967A95F7C67CEF8E975CDEC3399E45FB
SHA1:	2BBF32698370C456EEC6E11B53CB3EDE87EC5974
SHA-256:	EDCFCC7DD149F79711F4620A6D1E86B4877B0F810FB1D17E7C58E40ADE24F078
SHA-512:	1342FA062404D7BC68928D645924BCB1B2B7B91CBDFC1F142EBC6264ABCBFF3F63C8AD74D4FC857FF1DD8555DEBE9EFF8A4CB24B70AFBF395CB272D288C0292A
Malicious:	false
Preview:	........~........<.......w....................................-...............................5.......?.......[.......d.......{...........1.......(......'.......D...3...#...x.................../..............................,...........K.......T.......m.......t........................................................................................................................................%.......3.......A.......K.......R.......e.......o.......z...................................................................G.......O.........B......m...........,.......i......'...9...,...a.................................................................%.....................$...................2.......<...6...@.......w................... ..............&..........................)...;...4...$...p...........E.......#..............!..........?......j........................................3...........4.......=.......T.......l.......\|...........$.........................

C:\Users\user\AppData\Roaming\GeoSetter\locale\es\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: 'Abidjan'
Category:	dropped
Size (bytes):	16124
Entropy (8bit):	4.729328831147774
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZDrtk66eA/hCbBwp+1JKvlw9u:WyayjYhGBwg1JKvC9u
MD5:	33480CBED156BF1BE423390FD30AD585
SHA1:	B0D11AD456B113E3BD5EFBCBFE635E5CCBADCC4A
SHA-256:	4D9F116C2F8713F8CCF0E79350F7FE706E717D0AB8AC1FA46564238F10674684
SHA-512:	85BB071C7236A1A5ED610572D77EA6B2188517B77C57320A92F132E90A850A1C51CC8B2468BB0AD778AF35F6E4C675BF0BC9EBFD901BE6D6934558B5D647BB9B
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Users\user\AppData\Roaming\GeoSetter\locale\es\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.8893313659364415
Encrypted:	false
SSDEEP:	12:Kf26IfHVTolfp/i+LqmocqUVDlLFFyrNb8IL0ND08Nqqvmmf9:K+6Y+lR6uqmomxLTsb8g0NwAqqvmmf9
MD5:	4E21B7BEC4E946A209DBE9AE5B78C962
SHA1:	091B50B811A6C29CC890E366145F3BBE2D95A3AB
SHA-256:	01477A887317D76E4AC5EBB35FEDE25997C661C81E30A3DE5DEBE2C505F62A0A
SHA-512:	2A01AC11AD9D6391E663CC578723E306FD0D484E3A3973069BE6D3E61BD018C14088B5B7218C0AB6F3F2353963BCE4861423D7FFC5DC5D2D1DA6F65F3C9A2CA1
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//.......j..I.....K..J...=....$..............2........o..O.....Q..QS....H../....$...........6........s..S.....Sg.....B..6..0..+..%........;........v..X..U..W~.Wi...A..<..6..0..+..%.. ..?........y..\..Y..W..S..K..G..B..<..6..1..+..&..D........z{.__.\\.YY.TT.QQ.LL.GG.BB.=<.77.11.,,.II.......{{.{{.yy.ww.tt.qp.mm.ii.ee.``.\\.WW.SS.NN......................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\es\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.640223928941851
Encrypted:	false
SSDEEP:	3:XLMiUW:X43W
MD5:	4DDB90B0FB38947220D256CD27E00C8F
SHA1:	BA757CEE8157F78370257D28FA4CA2C4FFE564C5
SHA-256:	01B1EFD9569C1451C2EB57BB2A1F5F5E9331CA3DA603443CE8DDF5CFCD169D31
SHA-512:	416BAE46D3FCCA7237BD2296893544C9AFCA3E32F275372375579D257065A4ED19332103667127579510DD2F9215C83374948DB3D4AF530C47B25FBCD8D913C5
Malicious:	false
Preview:	Spanish..3.4.13

C:\Users\user\AppData\Roaming\GeoSetter\locale\fr\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1724 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	141963
Entropy (8bit):	5.239576176013512
Encrypted:	false
SSDEEP:	3072:yBsYbksSISh3D8N8fi0WmqJCubZwHGibeGZrYzpX3j7pyWg5rmz:ms+kDISh3D8lrbZAAtD7pyWg5ry
MD5:	081454744BE57525215F7BA047533C6E
SHA1:	11AF27C30B3751D29A898BD0E3202EBBDB33D38D
SHA-256:	1E6886A96FC7567E0429FE5543E53B4652B1EABB54C1B40403139FDC6BE4250B
SHA-512:	84BEAFE843547B3C6306AA5221001FAF506CE87A625B81B6D67D240E9337C8D95291A697FF7ADECE08200708963888D8C65DC959C4A2FA8685E7261F52C3607B
Malicious:	false
Preview:	.................5.......k.....................................-...............................#.......?.......H...(..._...'.......D.......#...................%.../...2.......b.......{...........,.......................................................................(.......6.......<.......B.......P.......V.......^.......c.......g.......n.......t.......y................................................................................................................... .......".......$......'......R.......}...,.......'.......,..................................'.......-.......9.......?.......F...%...U.......{...$.............................6..................!.......6... ...I.......j...&...~..........................;......$.........../...E...<...#...............!.......*..........................2.......D.......U...3...o..................................$.................. ..................h..........R.......H.......V......._.......k.......y...........I.......9...

C:\Users\user\AppData\Roaming\GeoSetter\locale\fr\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 46 messages, Project-Id-Version: 1.0 'Afrique'
Category:	dropped
Size (bytes):	2244
Entropy (8bit):	4.8007217768548385
Encrypted:	false
SSDEEP:	48:ZcDgjfKOEpGbsGnBpDKTVRN1z2g2g761+stoODwG3:Z1OOeGVpG31z2swn73
MD5:	DFFA07656814FF3DCB7F0FF0FE954069
SHA1:	C7A90E25135D7E10064A24C29F406A767926D067
SHA-256:	F3F5E52946D3B7B13AAE4F1452076FC70E923F0A8A5B0522380D881CE18C75A1
SHA-512:	7BF0EF0A184184FEB456B55BB6BFEA2091822A9B9F027B86B1F160FAD72A4DB93E6D39B7F16C095FFBF9A876A50F7E77F928CE3AD7F22137427C5A32B58AFD85
Malicious:	false
Preview:	....................=..................................................................?.......G.......R.......W.......^.......g.......q.......x....................................................................................................................................................................... .......'......./.......6.......;.......C.......Q.......Y.......`.......l.......s.......z.......................................3.......E.......^.......f.......q.......v.......................................................................................................................................!..............0.......8.......>.......D.......L.......T.......[.......c.......k.......s.......y...............................................................&...)...................(...*... ..............."...........................#...........................................................'...........+...................!.......%...............-.......................,.......

C:\Users\user\AppData\Roaming\GeoSetter\locale\fr\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.333268573172441
Encrypted:	false
SSDEEP:	12:Kf2G63wUxklEfRM4N7oJA0VJgy2yAxJdfEdi:K+GAkMhR0VuyExfKi
MD5:	CC233735CD2BB52C34895096CE45230F
SHA1:	52839F26BF574C65F1073D41A94B7B5C5DD39952
SHA-256:	D77DCB40B079A27ABCB880675F4527697426B773997128A53AB4D057F4A33C9D
SHA-512:	0F9703DC57E72CD2A7E7E293341820412860DBCED9B793960869328BD3344E3ADF4B48794D43D38D1D95E1FE8275FEF3C08DE7B75290386B37FA68D7831BC07E
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................g?._5.W-.O#.G..................................qI........................am.]i.Yf.Uc.....wS..........................HV.CR.>M.Zf......[..........................O].HW.CR.]j.....c.........................Uc.O].JW.bn.....i.......................\i.Vd.P^.ht.....o.........................cp.\j.Wd.lx.....s............................jw.dp.]l.r~.....s...........................r}.kw.dq.x......s.....................................~......s.s.s.s.q...................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\fr\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:llLXUn:lK
MD5:	964511F91DC995C8253ED6AEB89E3096
SHA1:	1C311CF49B2FFD02B470642A2462F078107EAC2C
SHA-256:	18851AAF26AA2C4994237EFC70C9E1C597D15F6B0BCE730B87C6503B2CD40EF9
SHA-512:	F0F0F46C49966ACD98B2F87CB2F939CC46FC7AFCC643951A596DEB15D4584EE1D7AC739B704B4C3F0D98B315F3E8C548C51FEE51674AFB846A45E1608D6DB61A
Malicious:	false
Preview:	French..3.4.23.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\it\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 560 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	40677
Entropy (8bit):	5.042438905090378
Encrypted:	false
SSDEEP:	768:QgoIj4Eq0GhC8u6MDChswBZcmIT6gn/9hfF62/X4vb:QgoIjnpf8/5Tgn/9hRwz
MD5:	4968E8C6F4E68CB4EFBC0373325BB043
SHA1:	7C66017278CADEC409B201F948A9BAD246BE7D02
SHA-256:	4D6451A3DFE104500B3BFEC42592A79A29F06CED8A720DECAEDBBC9576CAB381
SHA-512:	7EC2B3838717556C5B61614DF359E1B9DCFFACD031D622DB440CA3618EC001FF2C23CB6FE609933C628130715BFDA0E366072780AED3054EF8013E695AA1C1E2
Malicious:	false
Preview:	........0................#......................................./..(..../..'...H/..#...p/......./......./......./......./......./......./......./.......0.......0.......0......%0......00......90......G0......M0......S0......a0......g0......o0......t0......x0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......0......0.....)1..'...T1..,...\|1.......1.......1.......1.......1..$....1.......1.......1..!....2......$2......<2......R2......[2......w2......{2.......2.......2.......2..e....2.......3.......3......33..%...<3.."...b3..6....3.......3.......3.. ....3..)....3..4...%4......Z4......l4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4.......4..0....5.....65......a5..e...h5..)....5..!....5..5....6......P6..+...c6..2....6.......6..&....6..#....7.."...+7......N7......^7......t7.......7.......7.......7.......7.......7.."....7.......8......48......98.. ...Y8......z8.......8......8.......8.......8.......8..!....8......

C:\Users\user\AppData\Roaming\GeoSetter\locale\it\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.236617838318599
Encrypted:	false
SSDEEP:	6:ilij+6YYuVsxfp0tfqqPC9/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLinlrj:i4Nxuyx2la9/IMBivXmBQWiRc5lij
MD5:	A209065AE65E16352E79CD2FEF035ABF
SHA1:	ABB87F144197D21C3CA48204CF461C3038319DD0
SHA-256:	07275F78A7D9C9610EAE8AF7C60F5A045C2C31EDD3050479C7CA4753DBBC5ABD
SHA-512:	D9B7C397FE5FA69563639CBFEE4576FD7C5E2F84DBDAC51627BCEE5A56571E112197EB1A980F811446DE9DED8EF92EE12A6C439440846DCE8410D080039F4227
Malicious:	false
Preview:	................$.......,.......8...b...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:36+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Italian.X-Poedit-Country: ITALY..

C:\Users\user\AppData\Roaming\GeoSetter\locale\it\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.9389029282422054
Encrypted:	false
SSDEEP:	12:Kf2H+POaN1Ul3BXv0YcvYqgdHxAxuh2BZwuwBgsWXP:K+eGaHUl3Rv+Y/dHxUuhnLeP
MD5:	9BF9BD10952818C23190FB20E927D166
SHA1:	DDB85D65F1181C593378341A216299B05A888E3E
SHA-256:	E547DCFD0AEC6A37E8D35494F55871972023A6A730EE3E82F337F6762D9A479F
SHA-512:	F1C499457678B30DA0BADB8F824043A35BE3A779808708692F0A2738CBF5401D9EEACBA78CF4B6476EE724AA05C48D170159B032C4D86E2CFD8015608C565AB3
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................u..g..c..[..S...................................o.b.a].]X.XU.T..................55.22.//.,,.....w.f.fD.D?.?:.:...........................//.....{.j.jI.IE.E?.@...........................22.......o.oO.OI.IE.E...........................66.......s.rS.SO.OK.K..................%%.......;;.......v.vX.XT.TP.P..................++.%%. .??.......y.y\.\Y.XT.T..................11.++.&&.DD.......z.{_._\.\Y.Y..................77.11.,,.II.......{.{{.{y.yw.w..................\\.WW.SS.NN......................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\it\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2806390622295662
Encrypted:	false
SSDEEP:	3:wErHLC:wErrC
MD5:	E34E561EA5CA7B66CB1FA5847079580F
SHA1:	68F7766F67C807F56AD1A66F6292CC6A632F1008
SHA-256:	5E7086C30617CC6276860FFE2836746395A35905CCB7A97AD28FAE5DE48BDB3A
SHA-512:	158DC02AF1D44D65B2381DFE0211281CFFDC735953D6D6A764AD7973BC7140C86206277FE15FE61077578B34F0D7F5046375190DA867A70325161AE6541EC84F
Malicious:	false
Preview:	Italian..1.3.1.1

C:\Users\user\AppData\Roaming\GeoSetter\locale\ja\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1910 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	168645
Entropy (8bit):	6.0594262578368605
Encrypted:	false
SSDEEP:	1536:xCAVtOwTmdwZMQaG7yh3c4F8/rnmDiwwTlsoo/52u+q3NFNgBY8i9APJQ6WnX6:8wTLbaLh3H8/rn7ww5MGBY8i9APJc6
MD5:	0414CDF5E1F98C2EB9E374E4CA2DC3A4
SHA1:	507006083D862C49522B470D4120BE32B7E5BE93
SHA-256:	79D821E1CBF5480EB2B9B299851A318FC60D32B5CD17A85147E6085DBA312F0F
SHA-512:	ECE5687B7E61F387941B437F4BBFDD8E3934DABCE2F817236326D59B4E2A81BA9441645E2988EFF7310AE03B48D3A6CE1867AB977CADEF19F896043CBA1CDC42
Malicious:	false
Preview:	........v........;......\|w......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...D.......#....................../...........E.......^.......i...,...~...........................................................................................%.......3.......9.......A.......F.......J.......Q.......W.......\.......o..............................................................................................................................G.......O...R................,.......i...%...'.......,..................................................................!...%...0.......V.......7...$...K.......p...................6............................ ...........&...&...:.......a.......k...........;.......$.............E.......#...>.......b...!...s............................................+.......<...3...V................................................$...................6..............

C:\Users\user\AppData\Roaming\GeoSetter\locale\ja\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: GeoSetter '\343\202\242\343\203\223\343\202\270\343\203\243\343\203\263'
Category:	dropped
Size (bytes):	19164
Entropy (8bit):	5.003037096965352
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZqfvxzeJcIWwhCbBwp+1CCyFjRxygPV3Rx5H:WyayQfvEJ+whGBwg1xCjREw
MD5:	40E49FE0580708654345A373C813F1A1
SHA1:	0980D9A1873C3A4F14FF85E98FDCEE2423BC1F74
SHA-256:	E349DFE22F8234E31D37BA84665F5EE3E1912ACCC55BB206E4DF1EC5F0A89E39
SHA-512:	F810ED7783D709815F9ECDD4B9CA731DBB1EA22C9F74F318FD4825D05D15D814EFD96CDC1EC6AD523B13B7F7276F61BDEF9CD5F733591AF0095F6B88A069F7AF
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Users\user\AppData\Roaming\GeoSetter\locale\ja\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.66315474899585
Encrypted:	false
SSDEEP:	6:Olfam6B/jcOEqs/39Sdj+xvFe0fGTrI5TfHTNgIlgFhXZs8yhiefI8CN86l:Kf2VoP9ujswdrI5TzV+F1ZsjhzI8o
MD5:	C9B4440CD2F0D4ADD52C0A704AC2EB91
SHA1:	49700DAD879843140F8A7E7AF6F3B4832DBD741C
SHA-256:	36EB4A9A89FCDEB82806645EF7DFC24D814EC8825368BABEC67BC5CBA1575996
SHA-512:	66FA0143DB3CA3C12948CBAB05FB4643661EEC2F7FE9DE2FAB995CE9D298E64613A8E17188946D67813E4826D36D938B8B3E068F436D4B0F051E98A1175FE6F4
Malicious:	false
Preview:	BM8.......6...(............................................................................................................................................................................................................................................................................................................[[.UU........................................44.//..$$.}}...............................HH.:;.55.//..**...............................FF.@@.;;.66.00.++...............................UU.FF.AA.<;.66.77..................................KK.GG.BA.<<.........................................~.yy........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\ja\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.6835423624332306
Encrypted:	false
SSDEEP:	3:NvNvLbV:Nxx
MD5:	7CFFBED956BBD012517068418E68DDBB
SHA1:	3C1CEEEEA90A47692D0264F9E7B4E38F373D37FE
SHA-256:	9FE98BEFE4855EB15B67B9B876127207E9317F0302F50B53BA9E781FF36D747E
SHA-512:	C55E23B41206BC080E8F037242ED32BF166CC045CAB58AF5CDE1675B6AA53D294B0B51BB71F8B430AF4775015E855CBDFE6E2483455697629EAE3475EDE11906
Malicious:	false
Preview:	Japanese..3.4.12.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\nl\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1217 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	91028
Entropy (8bit):	5.1624873222411045
Encrypted:	false
SSDEEP:	1536:5NUj8tpx6uVilyPkh3fZasCgcsewFuiDIzorQ98Nv:GA75VCh3wucCvrS8V
MD5:	76D8239CB5A25D77EA264E90C0668871
SHA1:	1086F61E8A480ED848D35017D4970F192FEB1D21
SHA-256:	ED80B3A5BEBEE6B9DF834277CB5C9732DF7990956A6BC974F3702E713381559F
SHA-512:	CA4E2F1D112A647E4259D3ECE59F16F55FBF300C03CA43F74641ABAAFBF258C620DFC57F894E723A08B3C7FC9BBF6CF71119A444BCBBAD0AF73ADF3AB5411331
Malicious:	false
Preview:	................$&..[...,L.......e.......e.......e.......e.......e.......e.......e..(....e..'...(f..D...Pf..#....f.......f.......f.......f.......f..,....f......+g......4g......Mg......Tg......kg......pg......wg.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......g.......h.......h.......h....../h......9h......Dh......Ih......Kh.....eh......h..,....h..'....h..,....i......=i......Ni......Wi......]i......ci..$...ji.......i..6....i.......i.......i..&....i.......j..;....j..$...[j..E....j..#....j.......j..!....j.......k......5k......Kk......]k..3...wk.......k.......k.......k.......k.......k.......l.......l.......l..h....l......5m......+n......7n......En......Mn......Un......Yn......fn......tn.......n.......n..g....n.......o.......o.......o..e...2o..X....o.......o.......p.......p..5....p......Ip..%...Xp......~p......!q.......q.."...gr..6....r.......r.......r.......r.......r.......r.......r.......s.......s...... s......(s......

C:\Users\user\AppData\Roaming\GeoSetter\locale\nl\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.287219724318624
Encrypted:	false
SSDEEP:	6:ilij+EYYuVsxfp0tfqqPC9/RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLi8ljp/:i4Bxuyx2la9/IMBivXmBQWiRc5l/BpCY
MD5:	891B5BA6BDF84EDC59B7B7D6A6920721
SHA1:	F88D6B2B215877C6468416BD4291C4EA715A2223
SHA-256:	71F60753289DA459F81FF0FAF66DFE4D79F66C3FE76C62282FEAFECEDD918565
SHA-512:	2B170320D1DCE4D8D6D1822260D5C27865A45E5CD67C430AF9F775E38DC4EB0C59190EA11AD092D22A2664E0B4376ADED4E8AE254702DF8072EB2A8D6039477C
Malicious:	false
Preview:	................$.......,.......8...f...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:36+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Dutch.X-Poedit-Country: NETHERLANDS..

C:\Users\user\AppData\Roaming\GeoSetter\locale\nl\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.03755437579034
Encrypted:	false
SSDEEP:	12:Kf2v+CPsiDUDnx1Z4x9sokeNskdwy11AgYPhosNeqfXqqvmmf9:K+v+OlgDnx1yxWSdRnANOweoqqvmmf9
MD5:	619FF3D50095D8A47915EBB4D32D70CC
SHA1:	2666E31C035EB8E1AB0855A37E18DE0F81CCA271
SHA-256:	B69B7568637923F15417934995C4C1AE7A63B616D72DED2C48750870C1622025
SHA-512:	8B64011DAB60F2C3DAAA9727B0A8E09BE8C855D1364FF12D49A01B55F0C378DA470C15F43D63FE2EE1D34A679370E95AD4CC6D3A3F94824B6410AFC898006A03
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................................................{..u..o..k..e.._..[..W..Q..M..G..C..A..=..;..=......a.].X..T..P..K.\|F.xB.u=.q9.o5.l2.j/.g,;......f.zD.v?.s:.o4.j..f).b#.^..Z..V..R..P..i/;...!..w.Y..T..P.~J.{E.w@.s;.o6.k1.g,.c(.`#.wCM..................................................................................................................................................1............{..x..t..p.}l.zh.vd.r_.nZ.jV..m........{.l_.i\.gY.cT.^Q.ZL.VG.QB.M<.G7.B1.<,.WI........{..{..y..w..t..p.{m.xi.te.p`.m\.hW.eS.`N......................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\nl\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.4677201004745006
Encrypted:	false
SSDEEP:	3:rSV:q
MD5:	35B74A6A2E7827D1F7EA72D44435A8D2
SHA1:	411C4756744CFA089ECB65D0C027FCFE92683339
SHA-256:	4404D9ED5F0C7D181B23F32CE85B25D3233D58C92D41D0F47B0F3C04D2E8C4D9
SHA-512:	1794C1E1C63C70D9B3FF902FACC6C05875888EDE09EFC4310918000560D448362BEA0CCB85B9B405845AF8605F82BBFF00A9C2BB8855740857C334E2B936B086
Malicious:	false
Preview:	Dutch..2.5.1.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\no\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1802 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	144896
Entropy (8bit):	5.235451761284087
Encrypted:	false
SSDEEP:	3072:K1X/jqUQ6yOLwh3z8qBzmOhN5EBp+RTCNeY6S1xihAk76u/11XZ:K1Pjqqch3z8VD2036+xihTp
MD5:	0623B2A7DA74AE7DF9E0C919B90DBC16
SHA1:	EF8AB56DA17D94E3D9DC73B65BECF6A27A38E72B
SHA-256:	D92D47185990605804DC3C60A2D37E93D55C00CAF68CEDEC27D3D43079F45B05
SHA-512:	4AB77FDA5CEE5FC7C5373F22063F85F0EAE568E4E5C712665F1D0C5841824007EFA3E9D2F88DDB6A2F1079A12C183682A79E4C0E9F3F5AD9BDCEF1BAA6BA6F04
Malicious:	false
Preview:	................l8..k....p......h.......i.......r.................................................(.......'.......D...G...#.............../..............................,...%.......R.......[.......t.......{.........................................................................................................................................$.......2.......<.......C.......V.......`.......k.......p.......r...................................................G.......O.........3......^...,.......i.......'... ...,...H.......u...................................................%.....................$..............................6...#.......Z... ...j...........&............................;......$...+.......P...E...]...#..............!................%.......P.......h.......~...................3..................................'.......7.......R...$...Z.......................8.......L...h...d.............................................I.......9...J...............

C:\Users\user\AppData\Roaming\GeoSetter\locale\no\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.284304086390274
Encrypted:	false
SSDEEP:	12:i4Y86xuyx2lP9/IMBivXmBQWiRc5lK5ajl:RYBuyx2ttxOXmX
MD5:	5A029D448ABC53DB7B15A5C8D34C53EE
SHA1:	F3DE89C95C931B632AF843CF100DF49E009026F0
SHA-256:	472A2CCA2FE4BA22A8B82E559ED6F4856B6671D3ABB63FD2462DD1FDCD876C06
SHA-512:	F26A3D487FD7A278F45C396D764A3DC5C88B1C5E3103F3FB8079CC5750B3767E66753E6E3799C11CC2D9F92AC6693A34440DB2B6E0AFDE608798AF3EA52AA5C9
Malicious:	false
Preview:	................$.......,.......8...m...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:37+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Norwegian Nynorsk.X-Poedit-Country: NORWAY..

C:\Users\user\AppData\Roaming\GeoSetter\locale\no\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.240830750551435
Encrypted:	false
SSDEEP:	12:Kf2aaNBKc7KsVOdfD9W+6d/8Z7k6AbF3ev+KyTaUfVl:K+aaPpadf5Y/8lkjx3tKyWUfj
MD5:	2C56B966554D05EADCA65DFB1045023A
SHA1:	A29D70DE7FDA85A22C4F9656CEF829C7999955ED
SHA-256:	6AFE58B6D723EA8FC6890892EA7D35F8409F7060731209F9AF5BE21D252DC453
SHA-512:	1062BF68AB4B6A39EEE46A43754378494E756C22008D29756CEB8BEE72A51EB32BA18E7BAC6A682AE410A6D47B0A1F895CD5EE0A5D977683F831BB5C3F119BD3
Malicious:	false
Preview:	BM8.......6...(.........................................................................................................................................................................................................................................bd.]_.....z...KL.FI.BD.=@.9;.57.24./1.,........fh.DF.....e....0.)+.#&..!............./1.......jm.IK......j...47./1.*,.$'..!..........25.................o..................................S...z.w.s.o..k.f.b.].Y.T.P.K.e................w....................................yz.\].....{...KN.GI.BC.<>.69.14.+..&).DF.......z}._a.....~...QR.LN.GI.BD.=?.7:.14.,..IK.......{}.{}........qr.mo.ik.eg.`c.\^.WZ.SU.NP.................Y....................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\no\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.8924071185928786
Encrypted:	false
SSDEEP:	3:ISMiyMdeV:ISxyMdeV
MD5:	ACC6366C2B62DE2B702D7E02A9F6506E
SHA1:	393FC3997BF6EEA199272A0BCD5EDD2066F5F3B9
SHA-256:	DB4909E34537991879B60F399A5EB9BC502C62F14FFF696A471720A5DE51DF3E
SHA-512:	8E8E7D19EA12C53D93F7333545703530FD7F2A9756BEE4F84CCEA05410D8968FF3AE219425F66CABC94AA338EE6DA83CA52EC9B64D4EEB89193C689404DA9B5D
Malicious:	false
Preview:	Norwegian..3.3.95.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\pt\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1578 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	127752
Entropy (8bit):	5.252274356465809
Encrypted:	false
SSDEEP:	1536:lL9y0xUTHaTJnUILB6HVbh3BTN8D1dHg4LyJ/u+tu808gSzk3jhIZfWpD:l9FxUTyJnRB6xh3D8DfgZuszytIZfG
MD5:	5F5DC0DC12E6C021736B83460CA77119
SHA1:	1354B7E22749DEB39635DA77155FD58DFD1FEEDA
SHA-256:	2F8886757D471D4320B828C340A3333A62B63CE5A77D910334D071685164E8AE
SHA-512:	C5709536E70FE14F995BD0F576679F2EE1F33662401A418181C4DE16620AA439A6BFC5046C6A9EBF840BF3835E2C036DD7D0423ABD50B58628FDA46153FD7B34
Malicious:	false
Preview:	...............l1..?....b............................................................&......./...(...F...'...o...D.......#..........................%.......0...,...E.......r.......{...........................................................................................................................................#.......6.......D.......R.......\.......c.......v...................................................................................G.......O..........S...*...~...,.......i......'...@...,...h.........................................................%..............$...........<.......T.......^...6...b...................&.....................;.......$...5.......Z...E...g...#..............!..........................2.......D.......U...3...o..................................$.................. ..................h..........R.......H.......Q.......].......k.......s...I.......9..........................................(.......G.......U.......d.......u.......

C:\Users\user\AppData\Roaming\GeoSetter\locale\pt\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.22948500718895
Encrypted:	false
SSDEEP:	12:Kf2SevlOMfRcTolfVZP8i+LGCdm0xogm4dxvhszwoOa70zn06TF/wlhf9:K+SClOMRjlff5uxxVVxXDrF/wvf9
MD5:	7F5D0827AC7B79F62F4BC26F44DA453A
SHA1:	667C9AD732C2F3848B47620393FDB9D1438813D1
SHA-256:	E73355D0418BC192F47E3F5DB934C605A3C87A8E31FC0941F2111A5532596DD7
SHA-512:	15E993EC9A06222850760ED6A4FAB77E9C11B77831FDA09FC2FACAD34A84B73358D0B61A09BA73AAF643CCE06B2A37616DDCD3D176B9310F01F16446D3CA613C
Malicious:	false
Preview:	BM8.......6...(........................................................................................................................................................................................3..!............................................+.b.a].]X.XU.TP.PKK.FF.BB.==.99.55.22.//.,,.....5.f.fD.D?.?:.:4.A...)5.##................//.....;.j.jI.IE.S@..<..7..2..i.$$.............22.....?.o.oO.OI..F..Xx.v..9..0../.$$..........66.....E.s.rS.SO..Kv.......`x.6..0A.++.%%.......;;.....K.v.vX.XT..Q........[v.=..6<.00.++.%%. .??.....M.y.y\.\Y..U..Qp.Lg.G..B..<<.67.11.++.&&.DD.....M.z.{_._\.iY..T..Q..L..GS.BB.=<.77.11.,,.II.....K.{.{{.{y.yw.wt.tqp.mm.ii.ee.``.\\.WW.SS.NN.....Y..M..M..M..K..O.................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\pt\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.7841837197791883
Encrypted:	false
SSDEEP:	3:yMT:yMT
MD5:	AC5AA633EF1AE5294F8CA4A99FEB09CD
SHA1:	C6FDFC4663EADAB1F6D8CD22F766BF09DA11E297
SHA-256:	D7C34BEE058789C1C730BDC4CD03D83BF925F12557B417B2E21AF35DCA23BE59
SHA-512:	42E47CC24621EC532C77CB1DECA6D8D84BDE6DF876D142BFDF40BA01CDB124B7812C41B913542215ED229EF0CF909BB71A88BF7C03BC5C9422220D9FFA131722
Malicious:	false
Preview:	Portuguese..3.1.20.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\rs\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 944 messages, Project-Id-Version: GeoSetter ' (%dx%d) '
Category:	dropped
Size (bytes):	77900
Entropy (8bit):	5.378577000709878
Encrypted:	false
SSDEEP:	1536:XQ7WXcQYNuvboRmmMxaw9XzYFPUOYn8KO421e:XQCXcZqkMxrtzYFPUOYn3OT1e
MD5:	5FFB9FE33AB2CE6EA38645DF9279D624
SHA1:	2AD1E941B367F2D43D237562CD99AA9B6F7A4DAF
SHA-256:	4562E81EB6320FCAB160805AFF2DEF3C659DB08AB92D47D7ADE8C899EFADDF74
SHA-512:	5F3564853D727C00D4BECA77FB06EC2D22C23C75BFD19D910E7268A3086A2CA29A5A2632936C9E920D02D862425D37C5DAAE5165FC31EE4B09887EB8D2A70ED3
Malicious:	false
Preview:	.........................;.......N.......N.......N.......N.......O..(....O..'...8O..#...`O.......O.......O.......O.......O.......O.......O.......P.......P......!P......8P......=P......DP......OP......XP......fP......lP......rP.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......P.......Q......Q.....HQ..'...sQ..,....Q.......Q.......Q.......Q.......Q..$....Q.......R.......R..!...!R......CR......[R......qR......zR.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S..g....S.......S.......S.......S..e....S.......T......*T....../T......8T..%...GT.."...mT..6....T.......T.......T.......T.......T.......T.......T.......U.......U......&U.......U.. ...4U.. ...UU..)...vU.......U..4....U.......U.......U.......V.......V..I....V......xV.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......V.......W.......W.......W......6W......;W......@W......LW......

C:\Users\user\AppData\Roaming\GeoSetter\locale\rs\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.290170436958179
Encrypted:	false
SSDEEP:	6:ilij36YYuVsxfp0tfqqPnU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLiV+Rc:i436xuyx2lvU//IMBivXmBQWiRc5l01
MD5:	39101C20FEC81388B6EC5DFD1A203BE0
SHA1:	F648C6E187A4DC85BB08BF68555FEC5363C349A4
SHA-256:	978370CCA3D0DE4F198D7E367B01EA2B9FA1E6C7BDA5EF104B8ADBF1BDFF22EF
SHA-512:	76DEB3D9FA7DAA3AA7BE4A371BD2AD6EF4694F8822621FC96D940CB13FD12205985A1731FAAAA438B509153D4CECF4B14616DD4F8AB8842C52131A60A0B1E5D4
Malicious:	false
Preview:	................$.......,.......8...o...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:38+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Russian.X-Poedit-Country: RUSSIAN FEDERATION..

C:\Users\user\AppData\Roaming\GeoSetter\locale\rs\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.913567323630911
Encrypted:	false
SSDEEP:	12:Kf26IfHVTolfp/i+L1CQU2fzHfz3/T9Xc9au:K+6Y+lR6u1s2z7TeF
MD5:	F7A56F3F48B51FB335A9BD519663DB48
SHA1:	67E6F1A2CBCB430C9C6122A09169C2DFD9A82444
SHA-256:	2CCAFEC967418B040C2AE79667FEF29FC3806745FB53C1B7F5436B9CE46D5826
SHA-512:	53011C375F5BDF0F3CCB697760402B416D5C3A9F48785760207859754AAC63EBB8A38EF3CD2D8813EB540AA6F617DA0F18D998995E0EFDB5589843515D5D5C60
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//........j.rI.nE.j?.f:.a4.]/.X.S$.O..K..F..C..^2...{....oo.OO.JI.EE.@@.;;.55.//..$$..........66.......rr.SS.OO.JK.FF.@@.;;.66.00.+.%%.......;;.......vv.XX.TT.OP.KK.FF.AA.;;.66.00.++.%%. .??....II.....................................}}........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\rs\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4104172527605203
Encrypted:	false
SSDEEP:	3:TwLxULV:kLxSV
MD5:	0F1E5AA0BC50A749B845E7AF76098CF5
SHA1:	BD0C749C30728CD4112FCB356B3896E75FF81C7D
SHA-256:	20C07E43922AF063322174E3831ED11A9A8E766357A877E120A22B1CA6EDB476
SHA-512:	736116A792B99137C3CB9EA92AB1ACED6147EBB22FB3062A800353836A0B216784379127615C5EAAC6AAE03B2903C8618D25155DAFB1F3F22375AB42DA624588
Malicious:	false
Preview:	Russian..3.1.11.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\sv\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1203 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	85301
Entropy (8bit):	5.262831745834831
Encrypted:	false
SSDEEP:	1536:AX15IKyacafSQTA8icS80w/Oeh3WU+0JE5yBuiLf4+K5XL8JvwP/aK:M1tyahaGuwph35BL4+K5XQSd
MD5:	3B159C607A965E08D66C9B2429E74D1E
SHA1:	87EE1F96D920BEF44D31A5F205068B921463C614
SHA-256:	71521829D64DD667DA5385552313917AA52FC6F9A81727C1B2E57F801FA65166
SHA-512:	84C89BB650254D7F5FA3B63EFD052425C424D32FBF7B9A8A2DDE208732667E3EF66648D1E32FB3068259D5FC2CE242938326DB41A0F10AC2B3BED6A28D3C739E
Malicious:	false
Preview:	.................%..G...LK......hd......id......rd.......d.......d..(....d..'....d..#....e......$e......0e......Ie......Te......ie......re.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......f.......f.......f.......f.......f......-f......;f......If......Sf......Zf......mf......wf.......f.......f.......f......f......f..,....f..'...&g..,...Ng......{g.......g.......g.......g.......g..$....g.......g..6....g.......h......#h......7h..;...Ah..$...}h..E....h..#....h.......i..!....i......?i......Wi......mi.......i..3....i.......i.......i.......i.......i.......j.......j.......j.......j..h....j......Pk......Fl......Rl......`l......gl......ol......wl......{l.......l.......l.......l..g....l.......m......#m......-m..e...Am..Y....m.......n.......n......)n.......n..5...7n......mn......\|n..0....n..%....n.......n......\|o.."....p..6...Bp......yp.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p......

C:\Users\user\AppData\Roaming\GeoSetter\locale\sv\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: TZData
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.251051164897462
Encrypted:	false
SSDEEP:	6:ilijD6YYuVsxfp0tfqqPnU//RKMT1lXmzGSvXmBQ8KMW0YEiRc5tuAFlwuLiTA1e:i4D6xuyx2lvU//IMBivXmBQWiRc5l/bq
MD5:	AE93145DAD53FA65F2CBCA2872AA2F69
SHA1:	98B7A1EE27FFBBD2784F40FFA0D4B8A447715DEA
SHA-256:	BCF5441450E97C6A8B18EDFCAF38AE3155E04E88762343D0ADA2A39B238491F3
SHA-512:	49024822169B4510BC304208738F9B2946E4407D8E74C004572E522FAD563DE353B26F64CD7482A7F381F06AE0FF7EC7401392E5499F193A5B21BA0E24EE86AE
Malicious:	false
Preview:	................$.......,.......8...c...9................Project-Id-Version: TZData.POT-Creation-Date: 2008-04-21 20:51.PO-Revision-Date: 2008-05-12 13:38+0100.Last-Translator: Friedemann Schmidt <post@friedemann-schmidt.de>.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Generator: dxgettext 1.2.1.Language-Team: .X-Poedit-Language: Swedish.X-Poedit-Country: SWEDEN..

C:\Users\user\AppData\Roaming\GeoSetter\locale\sv\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.593387401137585
Encrypted:	false
SSDEEP:	12:Kf2/i0ASYS0CqwaCv/Nh73YCe3PQKdTP8PO8r0mpxt6RLZFKu/73:K+cRCEo/Nh7HYPjj4OOReRLZFJ/L
MD5:	8FB6C32243D7C0CF255D78BA96F77F74
SHA1:	8CC6258FFFBDC810FC0F9C54FF40D27CC0EEA19D
SHA-256:	2944DFA3FF38066F090C76D7EBF29FC5BFD4281AD5A641F9B28A8AD92DC76D4D
SHA-512:	3654BC2DBB19867F900192F7CAE1A64BD0AC67F6757303D4B7ADCB459B0C207D47A85C3A5724DEBD111728E7F6445F74D4658049C98281A4A541067F3A70EBEC
Malicious:	false
Preview:	BM8.......6...(.......................................................................................................................................................................................c..]..Y..S...........=..9..3..-..'..%..!........i!...a..]..XU..P..K....F..B..=..9..5..2.\|/.{,...o'...f..D..?:..4......{).w#.t..p..l..j..g..}/!..s/..j..I..E?..:..4..../.{.x$.p..l..i..e..{3=.....o..O..I..E..@..:..5../....$...........6........s..S..O..K..F..@..;..6..0..+..%........;........v..X..T..P..K..F..A..<..6..0..+..%.. ..?......A..y..\.XT..Q..K....P..B..<..7..1.\|+.z&..D;...C..{.._..\Y..T..Q....L..G..B..=..7..1.\|,..IA...C..{.{.yw..t..q...m.i..e..a..\..X..S..NG...C..C..C..C..........u3.s-.m'.i!.c..]..Y..S..M....................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\sv\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:	3:K6LVhn:VD
MD5:	3055DF4B5AE6CFAFDC25B07795EB59B1
SHA1:	EDE1A4DB7CDC03073CDD6A3756DF5E0B81BF6446
SHA-256:	5E517E50BBFCEE244673125B767BA5DCA2BFA9A814B9799EEBC01CE21D361BBB
SHA-512:	48970A67A791417423EE095F4D8C5CB3A869FBA65307A9BC85D1553299353FBD00FFB53D868D65E17F856EC641927A608F4D07D649F6D443C3B6B9F2D5092FB2
Malicious:	false
Preview:	Swedish..2.4.0.0

C:\Users\user\AppData\Roaming\GeoSetter\locale\zh\LC_MESSAGES\default.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 1910 messages, Project-Id-Version: GeoSetter ' (%dx%d)'
Category:	dropped
Size (bytes):	148890
Entropy (8bit):	6.129193608576821
Encrypted:	false
SSDEEP:	3072:i5vibaLh3H8/rn7ww5MfcIfin7pgOmoxJS:iV9h3H8x2fcIfin72uk
MD5:	6BB92F6B3BA345CE7B45DAB9CBF9F02C
SHA1:	D348C7D73C0B5A6E666207CBBE220204E0321FCD
SHA-256:	BC211B92ACA1BD25ABC019D2D93279A457FA09B09EEA49479A1AEB9FB1AB33EF
SHA-512:	3A99146137FE6B7F95719A0B1A3E136E2E2E9AEBDCC5A406353228134A3105545727CE9F9AA93CB932FF92811DFF596B82DFDF0FEFE1D87EC52249CF3A756C5E
Malicious:	false
Preview:	........v........;......\|w......P.......Q.......Z.......v..............._.......j.......y................................................1.......(...B...'...k...D.......#....................../...........E.......^.......i...,...~...........................................................................................%.......3.......9.......A.......F.......J.......Q.......W.......\.......o..............................................................................................................................G.......O...R................,.......i...%...'.......,..................................................................!...%...0.......V.......7...$...K.......p...................6............................ ...........&...&...:.......a.......k...........;.......$.............E.......#...>.......b...!...s............................................+.......<...3...V................................................$...................6..............

C:\Users\user\AppData\Roaming\GeoSetter\locale\zh\LC_MESSAGES\tzdata.mo

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	GNU message catalog (little endian), revision 0.0, 407 messages, Project-Id-Version: GeoSetter '\351\230\277\346\257\224\350\256\251'
Category:	dropped
Size (bytes):	16337
Entropy (8bit):	4.843944614214454
Encrypted:	false
SSDEEP:	384:u2Vuxnyv//rNTqfgG4QWNCqHv+WzZlg5B1FLVCbBwp+1uWhws+ME:WyayDgtxVGBwg1Zw1ME
MD5:	1B1F3745862A141ECA10BB5B63BB4991
SHA1:	7791C72B2D7F96C719FFB1CFE09A195B24777246
SHA-256:	8FF5356B192804EEF408020E0A3C088D8517740E8C70B67064AEC048BAAE95AE
SHA-512:	A80B1DE7DDE48C8BBE226B15691B53DD7EDFDD22B32200605E6A840657B18AE5EB305F964AA3C9EBE6CD34D54DB518093145A2C562F8E30AAA68C98B6977012E
Malicious:	false
Preview:	....................#............"......."......!"......'"......,"......8"......A"......F"......M"......U"......\"......d"......v".......".......".......".......".......".......".......".......".......".......".......".......".......#.......#.......#.......#...... #......)#.......#......5#......>#......E#......N#......W#......`#......j#......q#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$......&$....../$......;$......B$......K$......U$......^$......k$......u$......y$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......$.......%.......%.......%.......%......$%....../%......9%......C%......I%......Q%......X%......`%......k%......s%......~%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......%.......&.......&.......&.......&......

C:\Users\user\AppData\Roaming\GeoSetter\locale\zh\flag.bmp

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 770, resolution 2834 x 2834 px/m, cbSize 824, bits offset 54
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.198147678266805
Encrypted:	false
SSDEEP:	24:K+fT9AlcnudJp7HGYhQGWj6YhenBYdCd0y:RfpAGe77HtPWjaBus0y
MD5:	8EDF8AA53810DF0F766D9FD9B0F165AE
SHA1:	F3013D94420D754100BD056659F0E40E1319D910
SHA-256:	56AD9629CA37D5977480C493A3CED11011B9D2955262FDCF3A75ACBCAB07F895
SHA-512:	765EB617EBB0082FE79C9E72A4D9BF81FDF716F2D79F1C01F6A8D3C4F8AEF63019A0A4B961A218C93A51CA0E07EA1497823E0BAC8A2A04A9D636A9B6B19667AA
Malicious:	false
Preview:	BM8.......6...(..........................................................................................................................................................................................................................................ba.]].XX.UT.PP.KK.FF.BB.==.99.55.22.//.,,.......ff.DD.??.::.44....)).##................//.......jj.II.EE.??.::.44.//..$$.............22.......oo.OO.IJ.EE.@@.:;.55.//..$$..........66.......sr.SS.OO.KR.F..@@.;;.66.00.++.%%.......;;.......vy.XX.TW.P..K..F..AB.<;.66.00.++.%%. .??.......y..\..Y..TT.Q..K..G..BA.<<.67.11.++.&&.DD.......z.._..\..Y\.T..Q..L..GG.BB.=<.77.11.,,.II.......{..{..y..w..t..q..mo.ii.ee.``.\\.WW.SS.NN....................E.................................................................................................................................

C:\Users\user\AppData\Roaming\GeoSetter\locale\zh\info.txt

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.5724694587701364
Encrypted:	false
SSDEEP:	3:LzNgbV:2
MD5:	4F3B56109AA385E87B17DD8BE01DA0C3
SHA1:	B8C13386207D574965BC53F123A8693208BBEBD6
SHA-256:	B6B0ED129D9845475BE345990E930EA24F3B1B92427F7804317F7A297BE75D3E
SHA-512:	6932029836654ED8AB0CF241D7B9BECD0435D531D9E8A2CEA725B692ADB0158FD8CFDD7262879E0A457040E122F00036B580ED9A016DB97B454292D21BA75954
Malicious:	false
Preview:	Chinese..3.4.22.0

C:\Users\user\AppData\Roaming\GeoSetter\tools\.ExifTool_config

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.798195437385917
Encrypted:	false
SSDEEP:	12:bo4BXmsTo5FGv17T/7DzSGTVMuc/xhVSmFI465K4tAQsHYNM1dNgPybSt:xmaobGvhT/7D9TRSbHFI4+K4tAQTYsD
MD5:	2AC4F720B6BE1BA346522BA8C0C093F2
SHA1:	108F607D110C0D4F4FCA2408073E51743F281D6F
SHA-256:	9431CB310309A9D49510E44FC45B2D468E8E9ED544EEF3CEC19996152E0F8319
SHA-512:	1392B881D51A5D41E2650D9124E217C9AEB06ED64CED57B31AFE65C05A61D15996E8F8457BC53632DD72E73A280C062BB4148844C872C30162076B53BF17015F
Malicious:	false
Preview:	# exiftool config file..%Image::ExifTool::UserDefined = (.. 'Image::ExifTool::XMP::Main' => {.. geosetter => {.. SubDirectory => {.. TagTable => 'Image::ExifTool::UserDefined::geosetter',.. },.. },.. },..);....%Image::ExifTool::UserDefined::geosetter = (.. GROUPS => { 0 => 'XMP', 1 => 'XMP-geosetter', 2 => 'Other' },.. # (use whatever URI you want in the next line).. NAMESPACE => { 'geosetter' => 'http://ns.geosetter.com/1.0/' },.. WRITABLE => 'string',.. ForeignKeys => {.. Name => 'ForeignKeys', # (specified only to get proper capitalization).. Writable => 'string',.. List => 'Bag',.. },..);..1; #end

C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe

Download File

Process:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8340681
Entropy (8bit):	7.6374125796179735
Encrypted:	false
SSDEEP:	196608:rhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vklt4qqkGwFirGi8XxlV:7Jhlt4qqkGwFirGixuWl2
MD5:	CB2157B42F3AB50ED1A1977F995223E4
SHA1:	AC92CD9AB5480F6AAF321BF99541B311B7ED9DFC
SHA-256:	37E911F909D4EC025B9B3A4D3DF9D890B47992BD4CF4EC946BB1377C7105AE20
SHA-512:	BAC51CB2ADF092CA1B0E336DD38BA531A029614E347A264846A3CB8179432E8B3495647DC21F437E6A2AE6DEB86436864E2AFAED49C9F5A01ED12C493882377B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....%X.................B...................`....@..................................d........ ..............................p..(........#...........................................................................q..`............................text...dA.......B..................`.P`.data...Hj...`...l...F..............@.`..rdata..............................@.0@.bss..................................`..idata..(....p......................@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc....#.......$..................@.0.................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999936596860416
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	geosetter_setup.exe
File size:	24'564'453 bytes
MD5:	6c8aac98ac0f743037c412b513a6a3a6
SHA1:	e9b08b023e456bb39a20209e4a288cab1740b0a5
SHA256:	64d508b33c50c5a9fd695c0b328dab5519703db96c6e4580b8934c39431876ab
SHA512:	210337336089f955092d5286fb4d2a39de478f867fbebefb0af1593c7464ee5919eb58ac44090f8f6ec286d639aace4e236fd7ed504f7178422266cfc6a46322
SSDEEP:	393216:3veQ4U/SH6v/Kwy+K3GabfShmv5Yw02mgBe0xh7n9Ww//oBx/QUSZH:3m/oSGc+KPbfSh05YAnrAX/QR
TLSH:	AA37330741589872E390CE7DFD879461DEAAE053E036E69633052DBF899E1502E9FFC2
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x40aa98
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	2fb819a19fe4dee5c03e8c6a79342f79

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F9124F1F083h
call 00007F9124F2028Ah
call 00007F9124F205F1h
call 00007F9124F20A0Ch
call 00007F9124F229ABh
call 00007F9124F25342h
call 00007F9124F254A9h
xor eax, eax
push ebp
push 0040B169h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040B132h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040D014h]
call 00007F9124F25F7Bh
call 00007F9124F25B66h
cmp byte ptr [0040C234h], 00000000h
je 00007F9124F26A5Eh
call 00007F9124F26078h
xor eax, eax
call 00007F9124F1FD79h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F9124F22FBBh
mov edx, dword ptr [ebp-10h]
mov eax, 0040DE30h
call 00007F9124F1F11Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040DE30h]
mov dl, 01h
mov eax, 00407808h
call 00007F9124F23876h
mov dword ptr [0040DE34h], eax
xor edx, edx
push ebp
push 0040B0EAh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F9124F25FD6h
mov dword ptr [0040DE3Ch], eax
mov eax, dword ptr [0040DE3Ch]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe000	0x97c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x10000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xa1d0	0xa200	b7ea439d9c6d5ec722056c9243fb3054	False	0.6025028935185185	data	6.643749028594943	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xc000	0x250	0x400	9b2268ed5360951559d8041925d025fb	False	0.3037109375	data	2.740124513017086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xd000	0xe94	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xe000	0x97c	0xa00	df5f31e62e05c787fd29eed7071bf556	False	0.41796875	data	4.486076246232586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x10000	0x18	0x200	14dfa4128117e7f94fe2f8d7dea374a0	False	0.05078125	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x11000	0x91c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x2c00	0x2c00	4715e0a1c5700e9b8f2f00ea3fe6c560	False	0.3328302556818182	data	4.584657973977152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x12354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1247c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x129e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x12ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x13574	0x2f2	data			0.35543766578249336
RT_STRING	0x13868	0x30c	data			0.3871794871794872
RT_STRING	0x13b74	0x2ce	data			0.42618384401114207
RT_STRING	0x13e44	0x68	data			0.75
RT_STRING	0x13eac	0xb4	data			0.6277777777777778
RT_STRING	0x13f60	0xae	data			0.5344827586206896
RT_RCDATA	0x14010	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x1403c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1407c	0x4f4	data	English	United States	0.2689274447949527
RT_MANIFEST	0x14570	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T22:22:30.938036+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.5	49705	TCP
2024-10-31T22:23:10.163143+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.5	49918	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 22:22:55.433685064 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:55.438699961 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:55.438776016 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:55.440166950 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:55.445080042 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.279966116 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.279989958 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.280010939 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.280023098 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.280045033 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.280071974 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.280108929 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.280255079 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.280714989 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.280759096 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.280791044 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.280834913 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.281023026 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.281064034 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.281302929 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.281352043 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.281946898 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.282135963 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:56.407521009 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:56.407588959 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.209213972 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.210150957 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.214150906 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.215025902 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.215096951 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.215462923 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.220664978 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.459532976 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.459660053 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.459780931 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.459817886 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.459835052 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.459918022 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.460004091 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.460035086 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.460071087 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.460088015 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.460089922 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.460161924 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.460607052 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.460635900 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.460659027 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.460681915 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.460974932 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.461020947 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.461365938 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.461874008 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.461949110 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.462055922 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.462428093 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.587291956 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.587363005 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.587737083 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.593467951 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.837655067 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.837696075 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.837713003 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.837730885 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.837734938 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.837776899 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.838278055 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.838319063 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.838385105 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.838413000 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.838488102 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.838887930 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.838936090 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.839019060 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.839068890 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.839267969 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.839286089 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.839315891 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.839325905 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.839790106 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.839803934 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.839842081 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.839858055 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.840267897 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.840320110 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.840323925 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.840414047 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.840663910 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.840730906 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.841059923 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.841111898 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.841396093 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.841449976 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.841855049 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.841908932 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.842540026 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.842601061 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.842823982 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.842869997 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.844167948 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.844209909 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.844271898 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.844341993 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.844355106 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.844407082 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.952749014 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.952828884 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.965451002 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965517044 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965554953 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965557098 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.965594053 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.965617895 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965667009 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965706110 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.965708017 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965862036 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965889931 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.965930939 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.965961933 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.965991020 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966021061 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966048002 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966294050 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966309071 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966324091 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966346979 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966373920 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966408968 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966418028 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966444016 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966516018 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966543913 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966561079 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966573000 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966583014 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966622114 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966768026 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966834068 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966931105 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966937065 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966953039 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966970921 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.966979980 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.966989994 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.967000008 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.967035055 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.967035055 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.967288971 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:57.967390060 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.968592882 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:57.973809004 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047349930 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047368050 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047420025 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:58.047456980 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:58.047635078 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047667027 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047693968 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:58.047734976 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:58.047866106 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047883034 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.047944069 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:22:58.218626976 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:22:58.218775034 CET	49849	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:23:44.232709885 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:44.232741117 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:44.232798100 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:46.303503036 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:46.303524017 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.235691071 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.235814095 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:47.239666939 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:47.239675045 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.239902020 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.240334034 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:47.283341885 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.409986019 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.410036087 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:23:47.410258055 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:47.416255951 CET	49980	443	192.168.2.5	130.15.24.27
Oct 31, 2024 22:23:47.416271925 CET	443	49980	130.15.24.27	192.168.2.5
Oct 31, 2024 22:24:03.174741030 CET	80	49855	185.30.32.197	192.168.2.5
Oct 31, 2024 22:24:03.174884081 CET	49855	80	192.168.2.5	185.30.32.197
Oct 31, 2024 22:24:03.347544909 CET	80	49849	185.30.32.197	192.168.2.5
Oct 31, 2024 22:24:03.347641945 CET	49849	80	192.168.2.5	185.30.32.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 22:22:55.404400110 CET	53813	53	192.168.2.5	1.1.1.1
Oct 31, 2024 22:22:55.429100990 CET	53	53813	1.1.1.1	192.168.2.5
Oct 31, 2024 22:23:44.183433056 CET	49642	53	192.168.2.5	1.1.1.1
Oct 31, 2024 22:23:44.232108116 CET	53	49642	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 22:22:55.404400110 CET	192.168.2.5	1.1.1.1	0x95de	Standard query (0)	map.geosetter.de	A (IP address)	IN (0x0001)	false
Oct 31, 2024 22:23:44.183433056 CET	192.168.2.5	1.1.1.1	0x59b	Standard query (0)	owl.phy.queensu.ca	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 22:22:55.429100990 CET	1.1.1.1	192.168.2.5	0x95de	No error (0)	map.geosetter.de		185.30.32.197	A (IP address)	IN (0x0001)	false
Oct 31, 2024 22:23:44.232108116 CET	1.1.1.1	192.168.2.5	0x59b	No error (0)	owl.phy.queensu.ca		130.15.24.27	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

owl.phy.queensu.ca

map.geosetter.de

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49849	185.30.32.197	80	2300	C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 22:22:55.440166950 CET	238	OUT	GET /v3/map_google.html HTTP/1.1 Accept: / Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Oct 31, 2024 22:22:56.279966116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 21:22:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Sun, 27 Nov 2022 22:51:17 GMT ETag: W/"9e27-5ee7b97be6ce7" Content-Encoding: gzip Data Raw: 35 38 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 57 dd 72 da 38 14 be 4e 9e 42 f5 4d d3 06 30 49 da 6e 42 43 67 08 90 86 59 08 4c 71 4a bb db 9d 8e 6a 0b 5b c5 96 bc 92 1c 20 9d be d9 de ed 8b ed 91 fc 83 21 4e 76 b6 7b b1 7b 83 a5 f3 fb 7d e7 1c 4b e6 fc 49 6f dc 75 3e 4e fa 28 50 51 88 26 37 17 c3 41 17 59 75 db 9e 9d 74 6d bb e7 f4 d0 87 2b 67 34 44 47 8d 26 9a 2a 41 5d 65 db fd 6b 0b 59 81 52 b1 6c d9 f6 72 b9 6c 2c 4f 1a 5c f8 b6 f3 ce 5e e9 30 47 da 2f 5b d6 a5 71 6a 78 ca b3 de ec 9f 9b 2c ab 28 64 b2 5d 15 e1 e8 ec ec 2c 75 34 c6 04 7b 6f f6 f7 ce 23 a2 30 d2 d6 75 f2 7b 42 6f db 96 cb 99 22 4c d5 d5 3a 26 16 ca 76 6d 4b 91 95 b2 b5 f3 6b e4 06 58 48 a2 da 89 9a d7 4f 2d 64 57 86 21 ab 98 0a 22 4b 11 5e 35 5f 9c 36 9b 56 a5 f5 87 fa 4d a7 de e5 51 8c 15 fd 12 96 f3 0e fa 6d e2 f9 c4 b8 85 94 2d 90 20 61 db 92 6a 1d 12 19 10 a2 2c 14 08 32 6f 5b 0d 3b 24 78 1e 12 95 3f 1b ae 84 ec 14 c2 f8 82 aa 35 f8 04 f8 f8 e5 ab fa 62 88 9d e3 b7 e3 69 7c 45 dc 20 90 fc ee ee e2 70 1e b2 de e1 dd cd fa 6b [TRUNCATED] Data Ascii: 580Wr8NBM0InBCgYLqJj[ !Nv{{}KIou>N(PQ&7AYutm+g4DG&A]ekYRlrl,O\^0G/[qjx,(d],u4{o#0u{Bo"L:&vmKkXHO-dW!"K^5_6VMQm- aj,2o[;$x?5bi\|E pkxgb=Wp)>em+c^G# H&5OP(QCS)tBb?YdCz//g'Y9JNtXb"6bI$>vE{"$lG3P?PJ_^s4r2{8$BX=J$A[@Xbw%%.O@0 O`h4>OM+qD!CBA#bA3'W1ac/37b'q'4ikn<K@80,p`EV)aajUFmL[%"EdOsVFK{]0J'GYz!P4f.bc~N0%uskH)eIZep;,(T,VS&8Fh\8Z%bfVAhImH"R1oZ(#hJp?osfCr'dIi4~J~(O5t
Oct 31, 2024 22:22:56.279989958 CET	1236	IN	Data Raw: 0f 8f a9 12 c9 d6 84 6e 90 55 cd e9 71 b3 79 f2 4f a7 b4 28 44 47 4a ea 33 e2 fd ab 6a e0 2c c8 ff a9 24 2f 1e 2f 89 99 9d 72 5d b2 a3 b1 33 e8 d5 50 27 dd c0 a2 8b 63 ad 85 95 13 24 d1 17 06 c7 ef 25 d5 e7 60 a7 07 55 34 a9 3b 97 dc c5 e1 90 30 Data Ascii: nUqyO(DGJ3j,$//r]3P'c$%`U4;0_N7L_\_\|Yu!kqh-nW7 ._oFZ"FV})g^8_G`wxYO=\2;;BAU9k3/-\|()2
Oct 31, 2024 22:22:56.280010939 CET	705	IN	Data Raw: 94 19 d9 87 06 30 bb 77 c7 ec 4f 91 0e 55 43 48 53 5c d9 a0 93 f8 6b b7 fc e6 dd 58 5e f4 9f 4d e6 87 e1 6a 0f 39 1a 77 fa d2 7c 7c 02 3b 3d e2 fa e2 e2 01 dc 99 a3 fa e6 e5 a2 c6 64 8b 7e 21 cc b1 72 41 5a 67 6d 60 dd c2 9c da 0f d4 2a d6 ab 3b Data Ascii: 0wOUCHS\kX^Mj9w\|\|;=d~!rAZgm`;c(cNN0kMrJfMG%gIdd2j193eHfV_eVAW5roH>m'rE893^KZT{h(k$}8;>N>a]hNER
Oct 31, 2024 22:22:56.280108929 CET	853	IN	Data Raw: 33 34 65 0d 0a cc 1b cb 6e db 30 ec bc bf d0 7c 28 62 a0 69 b2 63 1a 2f 40 b6 1d 3a 60 dd 0e 1b 7a 2a 30 a8 89 d3 1a f3 0b 96 dd 3d d0 fd fb 44 3d 2c 5a 96 fc e8 30 60 87 00 8e 4c 91 94 f8 10 49 53 2e bb 6e f1 68 80 76 a0 9b bb 28 5e 66 27 2e 55 Data Ascii: 34en0\|(bic/@:`z*0=D=,Z0`LIS.nhv(^f'.UaGNn,3+W<Q73I\:l{`!SR)lpXzgU1yOmo{ec,~YtW2^[O_@\TIe8]oEoZohv%a<B+
Oct 31, 2024 22:22:56.280714989 CET	594	IN	Data Raw: 32 34 62 0d 0a b4 5c 4b 4f c3 30 0c 3e b7 bf 62 9c 06 17 d8 ca 91 1b d2 c4 ef 00 89 03 07 86 c4 06 e2 e7 93 c6 8f 38 8d ed 24 1d 4c 9a 36 a5 49 9c 87 9d 2f 7e 95 29 72 aa 94 35 cb b0 f9 2d 74 42 35 65 11 43 a9 bf 86 19 53 35 90 a1 fa 9b b9 81 35 Data Ascii: 24b\KO0>b8$L6I/~)r5-tB5eCS55,%+?-Ik4"Fxs<2;e:8(AhO>q+0r!.(Q!l>Me.dFk9IJzu>H)]@Md5u-d`Vd?(TYO
Oct 31, 2024 22:22:56.280791044 CET	728	IN	Data Raw: 32 64 31 0d 0a c4 1c cb 4a 03 31 f0 ec 5f ac ed a1 2d 94 a5 bb 45 10 f4 52 90 82 17 7f a0 f4 50 75 f1 52 7c d0 8a 5e fa ef 26 99 64 32 93 99 ec 6e 1f a0 88 ac 79 6d 32 ef c9 cc ce b1 96 4e 7f a5 00 ea 80 9d 2a 09 4a 33 a8 df 73 4d 96 d3 10 46 20 Data Ascii: 2d1J1_-ERPuR\|^&d2nym2NJ3sMF @YrEK+N@FY.G$dV,zZPd8+5+78so 9,znqS9aN/-R[(=Fh$Vc}z=5?l )I:D0.Q['fc
Oct 31, 2024 22:22:56.281023026 CET	720	IN	Data Raw: 32 63 39 0d 0a d4 5d 4d 6f c2 30 0c 3d 6f bf 02 71 81 03 82 69 e7 6d 12 6c c7 21 4d 1a 3b ed 84 20 62 54 e3 43 b4 eb e0 df 2f b1 d3 c4 69 ec b6 74 e3 b0 d3 50 49 d2 60 3b ee b3 6b bf f9 22 34 d1 78 1b ee a8 34 ab 76 5b e5 13 1b ef 0d 44 6b 74 6b Data Ascii: 2c9]Mo0=oqiml!M; bTC/itPI`;k"4x4v[Dktk+iUk+61@07Z'i"]pgWw(^D)L<7zJF\{\U,k?C/tyTSM{0) 6&6u1d`n,'@Q+
Oct 31, 2024 22:22:56.281302929 CET	809	IN	Data Raw: 33 32 32 0d 0a bc 5d 4d 6f db 30 0c 3d af bf c2 c8 61 71 d1 2e 89 9c a4 40 d3 0f 60 87 dd 86 15 58 0e 3b 0c 43 e1 62 de 66 c0 8b 0b c7 e9 b6 16 f9 ef 13 25 4a b2 24 5a 76 bc 76 87 f6 10 c9 d4 b3 44 d3 a2 4c 3e 7a e6 63 80 01 e9 65 42 82 46 a4 8f Data Ascii: 322]Mo0=aq.@`X;Cbf%J$ZvvDL>zceBFaHv ~YVf3ns"TCVt]0F)g5aoy-w?!]o{42B%ivQM(E{A*A(DS:dp(VGgHQ1ZiiQ]sPEv
Oct 31, 2024 22:22:56.281946898 CET	694	IN	Data Raw: 32 61 66 0d 0a cc 5d 3b 6f c2 30 10 9e e1 57 04 75 a0 4b 23 ca 82 44 45 97 76 2a 12 a9 5a a9 1d 2a 54 21 6a 09 c4 2b 4a 02 ed c0 8f af 7d b1 93 73 7c 76 0c 44 55 17 c2 e3 b0 cf e7 4f 3e fb 7c 0f 83 cb 5b 9a 4b ae 99 b9 e6 58 7e 7d ce 17 fc 0c c5 Data Ascii: 2af];o0WuK#DEvZT!j+J}s\|vDUO>\|[KX~}E.y7YY0mlqa^{ffi,`Hw*ho/.U<.".[MWyv#xWU~tvor:F%{m!z}42
Oct 31, 2024 22:22:56.407521009 CET	688	IN	Data Raw: 32 39 35 0d 0a c4 5d cd 52 83 30 10 3e b7 4f 11 73 d2 71 5a 6a 3d e8 50 e0 e4 d1 77 70 b0 85 96 19 04 a6 d0 4e f5 e9 cd e6 8f 10 42 da 80 33 de aa ed b7 bb 21 c9 e6 67 3f 76 0d 71 52 c3 cc ff f7 39 1f 2a c4 09 a2 ec b6 69 0e 0f f8 41 af 03 61 77 Data Ascii: 295]R0>OsqZj=PwpNB3!g?vqR9iAaw[Ipu-IS-0kzFKWSv)F;"!$W;{4va6*t#t6Xtk0&?#]^y62G`"!3lV4%.e-
Oct 31, 2024 22:22:57.209213972 CET	284	OUT	GET /v3/json3.js HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Oct 31, 2024 22:22:57.459532976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 21:22:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Thu, 03 Oct 2019 06:29:40 GMT ETag: W/"9c82-593fbb5de0ea5" Content-Encoding: gzip Data Raw: 36 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 84 57 db 72 db 36 10 7d cf 57 6c d4 99 58 f2 50 b4 2e 75 9c c4 75 a7 ad e3 4c 93 34 49 a7 72 1f 32 51 66 08 92 2b 09 36 09 b0 00 68 59 4d fc ef 5d 00 bc e9 92 c6 0f 1e 91 00 0e ce 1e ec 9e 05 4f 8e 1f c3 9b d9 87 f7 70 37 0d 27 e1 53 f8 0a 2b 63 8a 17 27 27 31 6a c3 f1 46 87 4b 6e 56 65 1c 72 79 72 a3 a5 98 d2 8c 4b 59 6c 14 5f ae 0c 4c 46 e3 c9 90 fe 4d 03 78 cb 0d 5c b2 3c 56 3c 5d 62 0b 73 cb 4d 98 73 33 cc 78 82 42 63 28 d5 12 8e 4f 1e 9d f7 17 a5 48 0c 97 02 fa 6b 2e 52 b9 1e c0 97 47 00 27 27 84 2e ee 50 70 14 09 02 cb 38 d3 a8 43 1a b9 63 0a 96 68 2e 33 a6 35 5c c0 97 87 d0 c8 99 51 5c 2c 03 e0 fa 4f 25 0b 54 66 13 c0 42 aa 2b 96 ac 02 28 45 8a 8b f3 47 1e f4 25 1a 4c 0c 98 15 42 44 af b9 c0 08 1a 06 78 5f 48 8d 29 c4 1b 60 7a 23 92 95 92 42 96 1a 72 99 96 19 42 26 59 8a 4a 87 70 bd 42 8f a6 69 5f 42 6b 90 92 15 26 b7 c4 02 04 26 a8 35 53 1b 4b 03 12 99 17 cc f0 98 67 dc 6c 60 4d 3a 42 a4 c2 1b 1d d5 f1 70 fd 87 c3 a6 78 cc a6 40 b9 00 8f 08 17 17 [TRUNCATED] Data Ascii: 66aWr6}WlXP.uuL4Ir2Qf+6hYM]Op7'S+c''1jFKnVeryrKYl_LFMx\<V<]bsMs3xBc(OHk.RG''.Pp8Cch.35\Q\,O%TfB+(EG%LBDx_H)`z#BrB&YJpBi_Bk&&5SKgl`M:Bpx@j dyx^d0.i=m Bp]<CerS.Xns) "#18luq;2kZw}F9W% 7p.JH\MLLijy6tw2:6l}}v^9v]1Xi=K/qZR;j.3"Ks1TW(_?P1}}yAf%SBT6s7Hep??M?M''l^YIaVqjBSl',2tN(RZr/`<O^-C?0ON'6f:nprcvLq&(}Iyq$-J$S?-Z\H2^x7}m%iJM1AA.Z(vt2}X2KFN0AX-wY5%3=;8g<LS5lWi
Oct 31, 2024 22:22:57.459780931 CET	699	IN	Data Raw: c2 4c b2 82 3e de 27 58 58 97 20 ff a9 53 ff 75 25 f3 0b e7 da 2a b7 b5 09 eb 15 c9 43 e6 df 75 a1 6d 87 d8 b5 a2 03 46 c4 14 82 2e 30 19 da 66 43 dd 52 98 03 75 f4 16 05 cc c4 86 2a dd 0a d8 f4 bd 15 d3 7d 6b ed b5 51 5a 1f a5 77 9f ec bb cf f0 Data Ascii: L>'XX Su%CumF.0fCRu}kQZwbs=v#K{,#y-m_Uys<+d7ru&+2x~"!%[;`Xblfy['i^b?#_T6Bqq6P{idoEhoS;
Oct 31, 2024 22:22:57.587737083 CET	327	OUT	GET /v3/leaflet/leaflet.js HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Origin: http://map.geosetter.de Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Oct 31, 2024 22:22:57.837655067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 21:22:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Sun, 27 Nov 2022 02:20:23 GMT ETag: W/"23d1b-5ee6a65b7019a" Content-Encoding: gzip Data Raw: 37 30 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 57 7b 53 23 37 12 ff 3f 9f 42 4c 71 2e 09 8b b1 cd 5d 6d d5 0d 3b e5 f3 41 f6 95 2c 64 49 d8 4d ca eb 73 89 99 b6 2d 76 2c 79 25 0d 86 80 bf fb b5 e6 6d c2 55 1d 65 3c 9a 56 77 ab d5 8f 5f b7 07 47 e4 5f 1b 03 16 cc 1d fc 40 8e c8 cf 20 16 19 38 32 0a ff 19 fe 9d 13 41 3e fc 4a 32 79 63 84 79 20 0b 6d 88 54 0e 8c 48 9c bc 03 b2 16 1b 1b 92 95 73 1b 1b 0d 06 59 29 79 6b c3 44 af bd 2a 9a 30 72 32 1c 0d 8f 4f 86 27 27 e4 73 26 52 b9 96 86 4c 96 62 a1 d5 37 a9 78 97 63 34 22 67 99 ce d3 8f 22 f5 76 0c 7e 38 58 e4 0a 8f d1 8a 3a 0e ec 31 d0 37 b7 90 b8 20 8e dd c3 06 f4 82 c0 fd 46 1b 67 7b bd 20 57 29 2c a4 82 34 38 a8 37 d7 3a cd 33 18 03 ad b8 58 14 d4 ea 5a 0d a5 54 af 57 3e 43 b1 4e c7 e5 92 4e 83 4a 2e 98 e1 d9 11 50 ea e2 97 8e 59 66 fa 46 64 bf ad a4 1d b7 cb c8 3d 3d 59 c8 16 2c ac 3c 12 3f ee d8 8e 3a dc e2 ed 9d f0 46 b9 05 62 9d 91 78 ab d3 7a 83 64 7e 0b 1d 4d ef 84 21 c0 25 57 f1 88 eb 58 98 65 be 06 e5 2c 2a 55 4b b7 3a 55 af f5 a9 ea f7 99 [TRUNCATED] Data Ascii: 70eW{S#7?BLq.]m;A,dIMs-v,y%mUe<Vw_G_@ 82A>J2ycy mTHsY)ykD0r2O''s&RLb7xc4"g"v~8X:17 Fg{ W),487:3XZTW>CNNJ.PYfFd==Y,<?:Fbxzd~M!%WXe,UK:Ug-T,ujFab@8xzZTq^wW%w(U{S'V<L Pl6J0YF/UzSgO%Poxa{U`^o.1.~=R[.K(;CQS/fq9D>o-tP`lWF30qz=9v1_Z,@=@QU[:;-S2,^Ehog4VuGZo:YB,\|P&<:_:^Wh7tt[R]WTI+a/7`CZzURj\|RY@5e[FkLSo6:MnWTSz01Z{&,qy`xtLrAqA/[->Nnxgnl;AvX3x(J.h#B?.4YCs'SHHq]A"WV%m\|i{
Oct 31, 2024 22:22:57.968592882 CET	293	OUT	GET /v3/img/crosshair.gif HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Oct 31, 2024 22:22:58.218626976 CET	307	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 21:22:58 GMT Content-Type: image/gif Content-Length: 73 Connection: keep-alive Last-Modified: Thu, 03 Oct 2019 06:29:41 GMT ETag: "49-593fbb5e67ae3" Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 10 00 10 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 10 00 10 00 00 02 20 8c 1f 00 c8 ac 0d d3 8a 6e d2 f3 2e b6 3a 57 05 86 e2 48 82 90 d7 71 17 ba aa 14 fb ba 11 1c 14 00 3b Data Ascii: GIF89a!, n.:WHq;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49855	185.30.32.197	80	2300	C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 22:22:57.215462923 CET	295	OUT	GET /v3/leaflet/leaflet.css HTTP/1.1 Accept: / Referer: http://map.geosetter.de/v3/map_google.html Accept-Language: en-CH User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0) Accept-Encoding: gzip, deflate Host: map.geosetter.de Connection: Keep-Alive
Oct 31, 2024 22:22:58.047349930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 21:22:57 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Sun, 27 Nov 2022 02:20:23 GMT ETag: W/"36b1-5ee6a65b57afb" Content-Encoding: gzip Data Raw: 34 65 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a4 57 6d 6f db 36 10 fe 5c ff 8a 6b 8b 61 69 60 c5 72 da 74 89 82 6d 1f 86 06 e8 b0 01 05 06 ec eb 40 49 b4 c5 99 12 39 92 b2 1d 07 fe ef bb a3 2c eb 3d c9 b0 00 49 24 f2 e1 bd f1 ee b9 d3 e2 12 0c ff a7 14 86 a7 60 dd a3 e4 16 2e 17 b3 d9 95 e4 6c 25 b9 0b 34 2b f8 bc 79 75 42 b6 5f 73 66 36 dc 04 22 51 c5 70 d5 66 2c 55 bb de e1 00 a1 8e 89 82 9b 79 57 09 fc 04 76 bb 1e 2e 26 ac d8 32 db 5a 3f 28 95 07 b1 da b7 96 44 ce d6 3c 90 ec b1 23 d5 bf c3 d3 ec 8d 56 56 38 a1 8a 08 58 6c 95 2c 1d bf 9f bd 91 7c e5 22 08 f1 c9 29 5d 3d 1c 9b b3 67 2b e9 bc da 72 b3 92 6a 17 41 26 d2 94 17 5d e8 7f 0f 09 c9 0c 76 3c de 08 17 94 96 96 b9 e4 09 5a 53 a8 82 4c 03 80 20 57 87 a9 3d ff 33 be d7 91 9a 1a b6 3e ef 1d 67 8b 4b f8 66 f8 96 17 ce c2 d7 2f cb 25 ac 8c ca d1 a3 75 26 f1 d7 89 62 0d e4 8a 05 51 40 2c 4b 4e 79 d0 71 32 8a 2a 7d 18 49 f2 20 66 c9 66 6d 54 59 a4 11 38 c3 0a ab 99 41 e1 f7 33 af ea 0f b6 62 46 60 6e 15 29 37 96 ac 08 0c 47 25 cc 2b 01 14 71 7a 8d [TRUNCATED] Data Ascii: 4e0Wmo6\kai`rtm@I9,=I$`.l%4+yuB_sf6"Qpf,UyWv.&2Z?(D<#VV8Xl,\|")]=g+rjA&]v<ZSL W=3>gKf/%u&bQ@,KNyq2}I ffmTY8A3bF`n)7G%+qzspL9_24SvmmdPF&:GCi'rqr0xdetl>o,ML2v/@R;%y"X~CG2No-peZ`}ej'U{$"=B7RHnu(0C~-\YW{i<<X*2Q(OndD4%\+?e~.j,W}<hoB+7X#L2Or{ZaIEm=O]JOQQ@ILJb02$e"dWc\oYwbi=4UX-N30!RkH`/0],?ws>}o%$R}e!CSVm=NhIoAm8AKu{=>06S)sNhAH$FT#A.lvU?0pjpOp6m`1]ud(pm)%mM.p?]Sa]MG
Oct 31, 2024 22:22:58.047368050 CET	289	IN	Data Raw: 03 d4 60 b7 b9 24 ef 35 6f 37 f7 6e 67 f7 6f 24 1e b1 7e 68 e2 d8 e6 04 15 4e 69 e4 c5 fb 94 af 58 29 dd fb 3f 7f ff 0d 4b a6 e9 d6 a2 90 58 7f 41 dd b4 47 07 58 b4 84 f2 cf cf 34 4a 42 8d a1 01 a5 33 c1 d7 80 ce 20 6c b8 c4 96 be e5 c3 a4 d6 4a Data Ascii: `$5o7ngo$~hNiX)?KXAGX4JB3 lJXA5EkNo{@_]l;7uO}aWrbQ775fIXoZh4p3zhk!`z7v'{ygNVtt>}cC
Oct 31, 2024 22:22:58.047635078 CET	1236	IN	Data Raw: 33 62 62 0d 0a ac 59 6d 6f da 30 10 fe 2b 56 d1 d6 21 05 06 81 b4 08 3e 55 fb b2 0f db fe 83 93 38 c1 5a 4a 50 5e 5a 3a a9 ff 7d e7 b7 c4 8e ed 24 95 0a 42 02 e7 72 be 17 e7 ee 79 0e 53 92 bf a6 25 df 47 2d ee 6a cd 88 0f 5b 47 83 13 41 11 2d 71 Data Ascii: 3bbYmo0+V!>U8ZJP^Z:}$BryS%G-j[GA-q2 V=zI9Jcuh2k,Q6&(mxr]zrhVc%WLPn;&KK12\Bj`3/~!Xm3yc]HyO^/W1S54ej'
Oct 31, 2024 22:22:58.047667027 CET	650	IN	Data Raw: ab b7 a9 c8 15 e5 a6 5e 3a e1 f9 d3 9c c6 e5 1a aa 8c 52 c8 3f e8 fe 44 e1 72 6c f8 96 6e d5 9a eb 10 15 41 1a cf 00 13 58 e9 14 a9 e0 b5 73 c8 81 f3 b3 c1 05 11 8e f4 c1 db a1 7b 3d 70 49 8f 6a c1 a6 b7 ce 05 8e 49 80 d1 f6 62 c6 ed ec bd 40 35 Data Ascii: ^:R?DrlnAXs{=pIjIb@5%laXX}FiuD&Pbnw5ndw$q[9'X%7VCdL CB/R;_<fd"y=P30^C17J$\*NU_M
Oct 31, 2024 22:22:58.047866106 CET	419	IN	Data Raw: 31 39 63 0d 0a 94 5b c1 6a c3 30 0c 3d b7 5f 51 7a cf 60 29 14 c2 2e 63 df b0 1f 48 89 4b 53 08 85 a4 2b bb ec df 27 4b 8e 6d 29 52 9d 5e 6d 45 71 a4 58 7a 92 9f 4d a9 45 9e 5e e3 c4 92 f8 1c 27 c2 f6 cb 6a c6 a6 69 52 ca ee fa 07 d5 84 2c 6b c3 Data Ascii: 19c[j0=_Qz`).cHKS+'Km)R^mEqXzME^'jiR,k(fVT8<)&V`~O <~q;:}i'(ep@)[K;kc?al;?qm_a28s!9K)m[F"wycdutgAtw6
Oct 31, 2024 22:22:58.047883034 CET	20	IN	Data Raw: 61 0d 0a 03 00 fc 79 07 af b1 36 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ay60

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49980	130.15.24.27	443	2300	C:\Program Files (x86)\GeoSetter\GeoSetter.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 21:23:47 UTC	236	OUT	GET /~phil/exiftool/rss.xml HTTP/1.1 Pragma: no-cache Host: owl.phy.queensu.ca Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: identity User-Agent: Mozilla/3.0 (compatible; Indy Library)
2024-10-31 21:23:47 UTC	292	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 31 Oct 2024 21:23:47 GMT Server: Apache/2.4.37 (Rocky Linux) OpenSSL/1.1.1k mod_fcgid/2.3.9 mod_perl/2.0.12 Perl/v5.26.3 Location: http://exiftool.org/rss.xml Content-Length: 235 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-10-31 21:23:47 UTC	235	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 65 78 69 66 74 6f 6f 6c 2e 6f 72 67 2f 72 73 73 2e 78 6d 6c 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://exiftool.org/rss.xml">here</a>.</p></body></html>

Target ID:	0
Start time:	17:22:10
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\geosetter_setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\geosetter_setup.exe"
Imagebase:	0x400000
File size:	24'564'453 bytes
MD5 hash:	6C8AAC98AC0F743037C412B513A6A3A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:22:10
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp" /SL5="$20442,24249229,57856,C:\Users\user\Desktop\geosetter_setup.exe"
Imagebase:	0x400000
File size:	713'728 bytes
MD5 hash:	832DAB307E54AA08F4B6CDD9B9720361
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:22:48
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll"
Imagebase:	0x830000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:22:48
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll"
Imagebase:	0x830000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:22:48
Start date:	31/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	/s "C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll"
Imagebase:	0x7ff63df30000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:22:50
Start date:	31/10/2024
Path:	C:\Program Files (x86)\GeoSetter\GeoSetter.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\GeoSetter\GeoSetter.exe"
Imagebase:	0x400000
File size:	11'988'480 bytes
MD5 hash:	010F18D793587CEB5E31D53455F461A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000007.00000000.2454380438.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:22:53
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -listx
Imagebase:	0x400000
File size:	8'340'681 bytes
MD5 hash:	CB2157B42F3AB50ED1A1977F995223E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:22:53
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:22:53
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -listx
Imagebase:	0x400000
File size:	57'856 bytes
MD5 hash:	44D73F3664153A38A9CD02F9DE9C3E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:23:46
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -lang
Imagebase:	0x400000
File size:	8'340'681 bytes
MD5 hash:	CB2157B42F3AB50ED1A1977F995223E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:23:46
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:23:46
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -lang
Imagebase:	0x400000
File size:	57'856 bytes
MD5 hash:	44D73F3664153A38A9CD02F9DE9C3E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:23:51
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe" -ver
Imagebase:	0x400000
File size:	8'340'681 bytes
MD5 hash:	CB2157B42F3AB50ED1A1977F995223E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:23:51
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:23:51
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GeoSetter\tools\exiftool.exe -ver
Imagebase:	0x400000
File size:	57'856 bytes
MD5 hash:	44D73F3664153A38A9CD02F9DE9C3E69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.9%
Total number of Nodes:	1539
Total number of Limit Nodes:	24

Executed Functions

Function 00404654 Relevance: 42.2, APIs: 7, Strings: 17, Instructions: 174
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,004048EE,?,?,?,?,00000000,?,0040AAB8), ref: 0040466F
GetVersion.KERNEL32(kernel32.dll,00000000,004048EE,?,?,?,?,00000000,?,0040AAB8), ref: 00404676
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040468B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004046B3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004048B5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004048CB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,kernel32.dll,00000000,004048EE,?,?,?,?,00000000,?,0040AAB8), ref: 004048D6

Strings

userenv.dll, xrefs: 0040473F
propsys.dll, xrefs: 004047A8
dwmapi.dll, xrefs: 004047CB
setupapi.dll, xrefs: 00404762
oleacc.dll, xrefs: 00404811
uxtheme.dll, xrefs: 0040471C
clbcatq.dll, xrefs: 0040489D
comres.dll, xrefs: 0040487A
SetSearchPathMode, xrefs: 004048AF
SetDefaultDllDirectories, xrefs: 00404685
SetDllDirectoryW, xrefs: 004046AD
SetProcessDEPPolicy, xrefs: 004048C5
profapi.dll, xrefs: 00404857
cryptbase.dll, xrefs: 004047EE
kernel32.dll, xrefs: 0040466A
apphelp.dll, xrefs: 00404785
version.dll, xrefs: 00404834

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 3297890031-2388063882
Opcode ID: 6206738d1768993a266272c574535deacfcb651ff371490375f42cd1ba234e07
Instruction ID: 9e7baa03e94b680687c531d55c537e9110a8ac934c54f9465d7227ec1282235b
Opcode Fuzzy Hash: 6206738d1768993a266272c574535deacfcb651ff371490375f42cd1ba234e07
Instruction Fuzzy Hash: B2611070600149AFDB00FBF6DA8398E77A99F80309B2045BBA604772D6D778EF059B5D

Function 0040A018 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 0040A02A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 0040A035
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 0040A076
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 0040A0A8
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 0040A0B8

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 9ac3e84cebc6f461d525c38fea5a33ab6cb0156132446b09103c7350edb016b4
Instruction ID: f5309bbdda193f62b4be3c179e768a57e3f3f612c04de257546ab44ee606f1f6
Opcode Fuzzy Hash: 9ac3e84cebc6f461d525c38fea5a33ab6cb0156132446b09103c7350edb016b4
Instruction Fuzzy Hash: 142190B1240308ABD6309E69CC85F5777D8DF85354F08493AFAC5E33C2D63DE860866A

Function 0040565C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,00405727,?,00000000,00405806), ref: 0040567A

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7459d56e7c64c485d498697c6eb088ce7aaa21e11ea95b6c07db09bb75ef8263
Instruction ID: d14b50eaf9df709ed1cf3d56deeb77a2084f63d122e7671578114c6bad5e918b
Opcode Fuzzy Hash: 7459d56e7c64c485d498697c6eb088ce7aaa21e11ea95b6c07db09bb75ef8263
Instruction Fuzzy Hash: 68E0D87170021427D711A9699C86EFB735CDB58314F4006BFB909E73C6EDB59E8046ED

Function 00409520 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004095DE,?,?,?,?,00000000,00000000,?,0040AACC), ref: 00409542
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409548
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004095DE,?,?,?,?,00000000,00000000,?,0040AACC), ref: 0040955C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409562

Strings

Wow64DisableWow64FsRedirection, xrefs: 00409538
shell32.dll, xrefs: 0040959F
kernel32.dll, xrefs: 0040953D, 00409557
Wow64RevertWow64FsRedirection, xrefs: 00409552

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 9711803e7e97600f978dac47126909fe1692835b2a3da83a2610dda9fb37f9b7
Instruction ID: 3d1781b746021e9606986d5b6d55f7cbde73f6a932e0ba52378b2443c6d91f24
Opcode Fuzzy Hash: 9711803e7e97600f978dac47126909fe1692835b2a3da83a2610dda9fb37f9b7
Instruction Fuzzy Hash: 79115470908244BEDB01FBA2CD43B5A7B68D784744F204477F501762D3DA7D5E08DA2D

Function 0040AF57 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409AE8: GetLastError.KERNEL32(00000000,00409B8B), ref: 00409B0C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AF9E
SetWindowLongA.USER32(00020442,000000FC,Function_00009E00), ref: 0040AFB5

Part of subcall function 00406FCC: GetCommandLineA.KERNEL32(00000000,00407010,?,?,?,?,00000000), ref: 00406FE4

Part of subcall function 00409E8C: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000,00409F5F), ref: 00409EFC
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000), ref: 00409F10
Part of subcall function 00409E8C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F29
Part of subcall function 00409E8C: GetExitCodeProcess.KERNEL32(?), ref: 00409F3B
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78), ref: 00409F44

RemoveDirectoryA.KERNEL32(00000000,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0A1
DestroyWindow.USER32(00020442,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0B5

Strings

InnoSetupLdrWindow, xrefs: 0040AF92
STATIC, xrefs: 0040AF97
/SL5="$%x,%d,%d,, xrefs: 0040AFF5

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryErrorExitLastLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 849423697-3001827809
Opcode ID: 08113ef3ce2da518920d8c13058acc363925f6704d668fbfbfd076efd3cb2295
Instruction ID: d96ad4f456555d006dfdd6a111ba55fa130d32b67bbf9cfe256734ebf9c0f5f1
Opcode Fuzzy Hash: 08113ef3ce2da518920d8c13058acc363925f6704d668fbfbfd076efd3cb2295
Instruction Fuzzy Hash: 95413070A006449BD711EBE9EE85B9A77E4EB58304F10427BF514BB2E1C7B89C49CB9C

Function 0040AF42 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AF9E
SetWindowLongA.USER32(00020442,000000FC,Function_00009E00), ref: 0040AFB5

Part of subcall function 00406FCC: GetCommandLineA.KERNEL32(00000000,00407010,?,?,?,?,00000000), ref: 00406FE4

Part of subcall function 00409E8C: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000,00409F5F), ref: 00409EFC
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000), ref: 00409F10
Part of subcall function 00409E8C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F29
Part of subcall function 00409E8C: GetExitCodeProcess.KERNEL32(?), ref: 00409F3B
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78), ref: 00409F44

RemoveDirectoryA.KERNEL32(00000000,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0A1
DestroyWindow.USER32(00020442,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0B5

Strings

InnoSetupLdrWindow, xrefs: 0040AF92
STATIC, xrefs: 0040AF97
/SL5="$%x,%d,%d,, xrefs: 0040AFF5

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: 3e82f52e343573e9ee8ccf82fbc097b32b2466bbbc9497f93a956efcdcfa5545
Instruction ID: 22e85acea042a1c9b241f29fbd05952515ad99a43a6683ef4ce3977848861488
Opcode Fuzzy Hash: 3e82f52e343573e9ee8ccf82fbc097b32b2466bbbc9497f93a956efcdcfa5545
Instruction Fuzzy Hash: 00410971A006049BD710EBE9EE85BAA77A4EB58304F10427AF514BB2E1D7789C48CB9C

Function 00409E8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000,00409F5F), ref: 00409EFC
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000), ref: 00409F10
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F29
GetExitCodeProcess.KERNEL32(?), ref: 00409F3B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78), ref: 00409F44

Part of subcall function 00409AE8: GetLastError.KERNEL32(00000000,00409B8B), ref: 00409B0C

Strings

D, xrefs: 00409ED6

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 7df226d52587f770460e981b15b5d19bc6ab37567cde566df4420800d0169a2d
Instruction ID: c83664c5db2498e28503e3c1fa1a9009394fa647db11d74ebe1f458a85c7f7ae
Opcode Fuzzy Hash: 7df226d52587f770460e981b15b5d19bc6ab37567cde566df4420800d0169a2d
Instruction Fuzzy Hash: 19113DB16042096ADB00EBE6CC42F9EB7ACEF89714F50017AB604F72C6DA789D048669

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040D41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040D41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040D41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 15ada844baba389fd7ade49cb76aeb00e47773f80fc89bec03b8d509a4e9cc02
Instruction ID: 2a1e8c518b16d72ac75c21d19d034316e64e92064156904d4596c6339aa50fda
Opcode Fuzzy Hash: 15ada844baba389fd7ade49cb76aeb00e47773f80fc89bec03b8d509a4e9cc02
Instruction Fuzzy Hash: 65114274B422805ADB11EBE99EC6F5276689785708F44407FF448B62F2C67CA848CB6D

Function 0040ACB4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040AD18

Strings

.tmp, xrefs: 0040AD5E
@z@, xrefs: 0040ADCC
d~@, xrefs: 0040AE21

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Message
String ID: .tmp$@z@$d~@
API String ID: 2030045667-2080866987
Opcode ID: 2b85bf55d00087c4ee4d3d53e5bb2d438756d7f2ac1061807f4f56549d36f6d1
Instruction ID: dd76c9251985b1ff4450233ddc9785193850427026a6d5c0e90a1b5537d094b7
Opcode Fuzzy Hash: 2b85bf55d00087c4ee4d3d53e5bb2d438756d7f2ac1061807f4f56549d36f6d1
Instruction Fuzzy Hash: 4B419570A046009FD705EFA5DE91A2A77A5EB59304B11447BF804BB7E1CA79AC04CB9D

Function 0040ACCF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040AD18

Strings

.tmp, xrefs: 0040AD5E
@z@, xrefs: 0040ADCC
d~@, xrefs: 0040AE21

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Message
String ID: .tmp$@z@$d~@
API String ID: 2030045667-2080866987
Opcode ID: 81bdbc4c120031e8217955485f9b4631603aba5f155e491865d52178ba1ca84f
Instruction ID: bf9d77eae5c07405b3109107b1835c74e23881a639ebcc62aff07684a9841850
Opcode Fuzzy Hash: 81bdbc4c120031e8217955485f9b4631603aba5f155e491865d52178ba1ca84f
Instruction Fuzzy Hash: BF419570B006019FD705EFA5DE92A6A77A5EB59304B10447BF804BB7E1CBB9AC04CB9D

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 06c1af3a807ed13e53e556f1551eab319716f56e5b0a099a7904d38b73613604
Instruction ID: 19c161ad1fd1f445befe0ff666437f64548d8e35ccd3b0abec794ae5707e41c3
Opcode Fuzzy Hash: 06c1af3a807ed13e53e556f1551eab319716f56e5b0a099a7904d38b73613604
Instruction Fuzzy Hash: 0421C834E152418AE714EFE59A817153E989B5930DF04817BD504B73E3C67C9A4EC36E

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040D41C,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040D41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 8414f493d6facd55d67710fc415b07d88c3ef9d9c2abb5a5bebd487d02bb0f40
Instruction ID: ca3d82fa79822ebb621977d4c6345e30539334a4bf25a92a69ec079a2ec9ab95
Opcode Fuzzy Hash: 8414f493d6facd55d67710fc415b07d88c3ef9d9c2abb5a5bebd487d02bb0f40
Instruction Fuzzy Hash: F20192B4E442405EE715ABFA9A56B253BA4D789704F1080BFF044F72F2C67C6458C75D

Function 004097D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004098BF,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409816
GetLastError.KERNEL32(00000000,00000000,?,00000000,004098BF,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040981F

Strings

.tmp, xrefs: 004097FF

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: bcfdd319b68c6234bb3b3c2b6e0791bb6992f3f2d01426f3b13c32e67b0b1ca6
Instruction ID: 48b9f2fdce89366346d31e95a36bae064327856a755920fc8e2ea7d65379a348
Opcode Fuzzy Hash: bcfdd319b68c6234bb3b3c2b6e0791bb6992f3f2d01426f3b13c32e67b0b1ca6
Instruction Fuzzy Hash: 23211575A10208ABDB05FFE5C8529DFB7B9EB48304F10457BE901B73C2DA789E05CAA5

Function 00409978 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 00409997
Sleep.KERNEL32(?), ref: 004099A7
GetLastError.KERNEL32(?), ref: 004099BA
GetLastError.KERNEL32(?), ref: 004099C4

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 1c248293a53693e5016b31d34f136ae5d975e0b827204b722e02cf7f87de802c
Instruction ID: 55ccdd2d2ee1bdbcd31af2ea42c7aee1c1b219f05c386506858fe4dd166fe014
Opcode Fuzzy Hash: 1c248293a53693e5016b31d34f136ae5d975e0b827204b722e02cf7f87de802c
Instruction Fuzzy Hash: 6AF090B2A0511856CA25A6AE9881B6FB28CEAC0368714413FFA44F7383D43DDC0152BA

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040D41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040D41C,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040D41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: f63e8093b7c21695f3c5f0f727b66ad92d47f8bd02e6a7dbcfb51ec74dbfdd03
Instruction ID: 72c497f3d878e3d6a4a9583ee00a9bb41c235ef620702b970aaba137d6b92855
Opcode Fuzzy Hash: f63e8093b7c21695f3c5f0f727b66ad92d47f8bd02e6a7dbcfb51ec74dbfdd03
Instruction Fuzzy Hash: 2341C2B2E007019FD710CFA9DE8561A7BA0EB58314B15817BD549B73E1D378A849CB48

Function 00409438 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00409495), ref: 0040946F
GetLastError.KERNEL32(00000000,00000000,00409495), ref: 00409477

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: cef11d40a142b83803210e371880030b93b56e60c6b6d61991ebac398e5bf5ba
Instruction ID: 3a2bfa3924d7da3ec485a5c2eebce42195f764b2344cc107bbad9e5710e02f6c
Opcode Fuzzy Hash: cef11d40a142b83803210e371880030b93b56e60c6b6d61991ebac398e5bf5ba
Instruction Fuzzy Hash: 3EF0AF71A08608ABCB01EFB59C4159EB3A8EB8831476045BBF808F32C3E6395E018599

Function 0040741C Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 00407426
LoadLibraryA.KERNEL32(00000000,00000000,00407470,?,00000000,0040748E,?,00008000), ref: 00407455

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 7c3291ca482dc4e73124ef6673235b1c1e4da24983ec1cf579c69c8d77eb9c24
Instruction ID: f52ba4a9feec5d4d4615fe406f45eaba014741ff6d770d8a308f032ff20cb8dd
Opcode Fuzzy Hash: 7c3291ca482dc4e73124ef6673235b1c1e4da24983ec1cf579c69c8d77eb9c24
Instruction Fuzzy Hash: 26F08270A14708BEDB025FB68C5282ABAECE749B1475288B6F900A2AD2E53C5820C569

Function 0040B0EF Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0A1
DestroyWindow.USER32(00020442,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0B5

Part of subcall function 00409978: Sleep.KERNEL32(?), ref: 00409997
Part of subcall function 00409978: GetLastError.KERNEL32(?), ref: 004099BA
Part of subcall function 00409978: GetLastError.KERNEL32(?), ref: 004099C4

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: 42b787c3d9f5bd55058fd6c8f85d5fac1abeba9ca40111c3c6816528150393fb
Instruction ID: 80fe6e0f7824975e72fa29ef6d7a10d3d2514edd0f005a574200bdc13b2d30de
Opcode Fuzzy Hash: 42b787c3d9f5bd55058fd6c8f85d5fac1abeba9ca40111c3c6816528150393fb
Instruction Fuzzy Hash: C9F0CD70A105009BD725ABA9EE99B2632E5E7A4305F04453AA110BB2F1C7BD9C88CA8D

Function 00407AE8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00407B07
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407B0F

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020A03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 1efacffe01c84972d5e79d9e95937cadebc248d177395cf3b78af7fa5ea4bab0
Instruction ID: 2b235249b0a7ee07bcb8c1d8603e448d3cb6330bb11491e7c51f1e2a1a123f33
Opcode Fuzzy Hash: 1efacffe01c84972d5e79d9e95937cadebc248d177395cf3b78af7fa5ea4bab0
Instruction Fuzzy Hash: 13E092767081005FD610E55DC881A9B33DCDFC53A8F004537B654EB1D1D675B8008366

Function 00407AA8 Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407ABF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407ACE

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 62bc4757170e124d293d2e1ae2527044cf5abdc53c736f625f33b9d4ecf98daf
Instruction ID: e15dfe76c2c2153dd18fa5b66318eead10a3336b01bc7908bb5745e2d55223c8
Opcode Fuzzy Hash: 62bc4757170e124d293d2e1ae2527044cf5abdc53c736f625f33b9d4ecf98daf
Instruction Fuzzy Hash: DAE092A17181106EEB20A65E9884F6B67DCCBC9314F04817BF508EB282D6B8DC008777

Function 00407A40 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 00407A57
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407A63

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020A03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0f363b337b605630cba33b2c75e34e58c088fa0b570b5e63e1fb747f55acf4b7
Instruction ID: b2e9c79a061d94bc6c1ac4e6a69a759f2ef78579472dc31f5d333ffaff30462c
Opcode Fuzzy Hash: 0f363b337b605630cba33b2c75e34e58c088fa0b570b5e63e1fb747f55acf4b7
Instruction Fuzzy Hash: C7E01AB1A002109EEB20EBB58981B5662D89B44364B048576A654DB2C6D274E800CB66

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e3bf9ef34a83e5b8d51b462a41b7d68ce2248d991abf67c6f3f1ae437811ef8b
Instruction ID: 66c3474f10fe082fedccbde799efe3bb5b58ff080b56d2e089ed954f0af67306
Opcode Fuzzy Hash: e3bf9ef34a83e5b8d51b462a41b7d68ce2248d991abf67c6f3f1ae437811ef8b
Instruction Fuzzy Hash: DAF02772B0032017DB2069AA0CC1B536AC59F85B90F1540BBFA4CFF3F9D2B98C0442A9

Function 004056D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405806), ref: 004056EF

Part of subcall function 0040512C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00405149

Part of subcall function 0040565C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,00405727,?,00000000,00405806), ref: 0040567A

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: cc3e47e390c1b33211b3d9873ad613d49b391b3cefde462b73c2cd7d0ab13d86
Instruction ID: 82c784cd7830e1ca4cd44457dad2f2fa429cf4e25a926eea24d274db27b93b1b
Opcode Fuzzy Hash: cc3e47e390c1b33211b3d9873ad613d49b391b3cefde462b73c2cd7d0ab13d86
Instruction Fuzzy Hash: C1316F75E00509ABCB00EF95CC819EEB379FF84304F508577E819BB285E739AE058B98

Function 004079F2 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407A34

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5bc26aafbd8d3cc7e99f1b4789c5f450247a7b7967715b9db18694e2d0d8c5c5
Instruction ID: 042ae40820150c0b4851109f40d588701a9899a67d40570aa5757512981d293a
Opcode Fuzzy Hash: 5bc26aafbd8d3cc7e99f1b4789c5f450247a7b7967715b9db18694e2d0d8c5c5
Instruction Fuzzy Hash: 6FE0ED753442586EE340DAED6D81FA677DC974A714F008132B998DB382D4719D118BA8

Function 004079F4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407A34

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b99464c5deed90c436ccb8039285842caa459c4cfee6896295820f2cd2136feb
Instruction ID: 8ced2eed2e357b00b36525f681a949bcf9e14530d7ff6951507f50c56b932d1f
Opcode Fuzzy Hash: b99464c5deed90c436ccb8039285842caa459c4cfee6896295820f2cd2136feb
Instruction Fuzzy Hash: 95E0ED753442586EE240DAED6D81F96779C974A714F008122B998DB382D4719D118BA8

Function 00406E2C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406E74,?,?,?,?,00000000,?,00406E89,004071E3,00000000,00407228,?,?,?), ref: 00406E57

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8e258e6088ff2729972a65b025d9916a43b1951ab399dc39633550a2ec6328db
Instruction ID: 5d103c24ca312c86e291a35865c809fd23e08ae6a8f6832d02acb9ca341f4446
Opcode Fuzzy Hash: 8e258e6088ff2729972a65b025d9916a43b1951ab399dc39633550a2ec6328db
Instruction Fuzzy Hash: ADE0E530300308BBD301EE72DC42D0ABBACDB89704B920476B400A26C2D5785E108068

Function 00407B44 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407B5B

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020A03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 006c08a2f5d9871c0a1980147acda0c26795bf6e192fd3a261290223f417e960
Instruction ID: 30ae2be02b9f15b9cba2c15a2490e5271afae9e105f225727eb8a6e5b17a7771
Opcode Fuzzy Hash: 006c08a2f5d9871c0a1980147acda0c26795bf6e192fd3a261290223f417e960
Instruction Fuzzy Hash: 3FE06D727081106BD710A65A98C0E5777ECCF85764F00403BB608DB281C574AC01867A

Function 00407700 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004095C3,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0040771F

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: b9ec76e9ce0cf7c9b11fbb0d22c3d5372d7ad8be8fd57ca1cb8678c9dba0653c
Instruction ID: cd8e50964804133df0be52219a4bf40107040f8cbf32d452899ff663d46cfc84
Opcode Fuzzy Hash: b9ec76e9ce0cf7c9b11fbb0d22c3d5372d7ad8be8fd57ca1cb8678c9dba0653c
Instruction Fuzzy Hash: 7CE04FB1B8830126F62519545C87F7B164E47C0B84F64403B7B50EE3D2DABEB94B429F

Function 00407B28 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,020EBEC0,0040AEF9,00000000), ref: 00407B2F

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020A03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 879c3aef20c26933657ab209da42f9acde188edf801b45e7798529f352953bc6
Instruction ID: c094c2b5ec81b014f7647aed55f46f5be6f6c9eff784118cc89584b894c57cec
Opcode Fuzzy Hash: 879c3aef20c26933657ab209da42f9acde188edf801b45e7798529f352953bc6
Instruction Fuzzy Hash: AFC04CB1B141045BDB00A6AA85C2A1672DC5A482083404076B504DB247D678F8504755

Function 00407477 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407495), ref: 00407488

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 3513d2af45e6240a0d0531d222129c39ee3681c2f506e4d79ab3159715fa7836
Instruction ID: fee884e8913e26ea2b20a1c4334648daa9a2c142b99fe0c27f31eb53e83e856d
Opcode Fuzzy Hash: 3513d2af45e6240a0d0531d222129c39ee3681c2f506e4d79ab3159715fa7836
Instruction Fuzzy Hash: C6B09B76A0C2006DE705DEE5645153877D4D7C47103B14877F100D65C1D93C94108519

Function 00407493 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407495), ref: 00407488

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a150b1ccc28004dcf137bb0f7729195edfbe3cd1821f17504bb802deebb031e2
Instruction ID: c7febe38ef9f985557de65a49c8e3beabd1cb56d23a205183508381f5ecd03fa
Opcode Fuzzy Hash: a150b1ccc28004dcf137bb0f7729195edfbe3cd1821f17504bb802deebb031e2
Instruction Fuzzy Hash: EEA022A8C08008BACE00EEE88080A3C33A82A883003C008E23200B2082C03CE000820B

Function 00406DC0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00406DBC,?,00406A99,?,?,0040959C,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004095DE), ref: 00406DC2

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: d44d7a6884596ca32ea416b380b4e8946229468d7e659b1743621721cd4621d4
Instruction ID: 95ac89871b9e49aa2ffc5daef894b278f4bc9d8aafa7dca88aae54a0e9e7edad
Opcode Fuzzy Hash: d44d7a6884596ca32ea416b380b4e8946229468d7e659b1743621721cd4621d4
Instruction Fuzzy Hash:

Function 0040150C Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 00401570

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4069ebeab1ecaaa6227b0d54b40c6f300b7ac340d294d08becb426def254346f
Instruction ID: ed4d65520c00d96bd64096adec8f86249eaccd310614155879460d3c6a05d2ca
Opcode Fuzzy Hash: 4069ebeab1ecaaa6227b0d54b40c6f300b7ac340d294d08becb426def254346f
Instruction Fuzzy Hash: EC21F970608711AFC700DF19C880A5AB7E0EFC4760F14C96AE899AB3A1D374EC45CB9A

Function 0040838C Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0040841C

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4fb7b38294bdf3fcfaab8189c6b2d31175aea6f156bf412ec83bea8fb86574a1
Instruction ID: 68aadeca7c52aa1374545c41b60170f14cbd4c45bc0c673343149efe9cc76684
Opcode Fuzzy Hash: 4fb7b38294bdf3fcfaab8189c6b2d31175aea6f156bf412ec83bea8fb86574a1
Instruction Fuzzy Hash: 7B116D716042059BDB00EF19C981B4B37A4AF84359F04847EF998AF2C7DF78D8058B6A

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ae0a35522eec5974c246f826a8cf4d5dbbbccf5172876aab042d95c32cb5ff07
Instruction ID: d2bd3e7102ef9204b91f8816383c595cec19663beeae75bd92b4ab4675e4226e
Opcode Fuzzy Hash: ae0a35522eec5974c246f826a8cf4d5dbbbccf5172876aab042d95c32cb5ff07
Instruction Fuzzy Hash: E401F772A042104BC310AF28DDC092A77D4DB84324F19497ED985B73A1D23B7C0587A8

Function 004079C4 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004079D4

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b39bb4760bd10523e8477a282be401f25cebef3596302d631dfd489199f81fc2
Instruction ID: 1333f047c66b0d9688efca9d11da816c999e90cdcd736c06211d3ba452c28d9f
Opcode Fuzzy Hash: b39bb4760bd10523e8477a282be401f25cebef3596302d631dfd489199f81fc2
Instruction Fuzzy Hash: B4D0A7D1B00A6007E315F2BF498964B92C85F88655F08843BF685E73D1D67CAC00D38D

Function 00408334 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00408319), ref: 0040834B

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 230c808500062b5c35cb01985a317edf3050be8cd861299b6b1c2025d975cd45
Instruction ID: 2902acfab023b9b2f0de86f7a78627cda5d54dfc4b924a21aa22279fbea0049e
Opcode Fuzzy Hash: 230c808500062b5c35cb01985a317edf3050be8cd861299b6b1c2025d975cd45
Instruction Fuzzy Hash: 64D002B17553046FDB90EEB94DC5B0237D87B48700F14457A6E44EB2C6F775D8008B14

Non-executed Functions

Function 004098E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004098F7
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004098FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409916
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040993D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 00409942
ExitWindowsEx.USER32(00000002,00000000), ref: 00409953

Strings

SeShutdownPrivilege, xrefs: 0040990F

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 76c26366ab73d400da16d1d616fb3f23b1dfff142f9860e5fbeddd1887b8e56a
Instruction ID: c716305aa6b255ea0f8bf04b803605974c64d9a32ef9e4c16490a57abd096404
Opcode Fuzzy Hash: 76c26366ab73d400da16d1d616fb3f23b1dfff142f9860e5fbeddd1887b8e56a
Instruction Fuzzy Hash: 17F062B0284302B6E610AAB18C07F2722885B81B18F40493EB711F52C3D7BDD904866F

Function 0040A0D4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 0040A0DE
SizeofResource.KERNEL32(00000000,00000000,?,0040AB53,00000000,0040B0EA,?,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040A0F1
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040AB53,00000000,0040B0EA,?,00000001,00000000,00000002,00000000,0040B132,?,00000000), ref: 0040A103
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040AB53,00000000,0040B0EA,?,00000001,00000000,00000002,00000000,0040B132), ref: 0040A114

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 5a5895066e8623d9c04d621fb25767811aface55f1ffab09d7e5ea7dbda8e6a9
Instruction ID: 6e0ad9993521ca4487a6dc9182c9ec88a9d7ecf9898e216691337b01ea42cf55
Opcode Fuzzy Hash: 5a5895066e8623d9c04d621fb25767811aface55f1ffab09d7e5ea7dbda8e6a9
Instruction Fuzzy Hash: 92E0EA9078970725EAA136E608D6B6B10884BB578EF40113ABB14B92C3DDBC8C14516E

Function 004056A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004058AA,?,?,?,00000000,00405A5C), ref: 004056BB

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6c93c86b5f3b9f7a8269726404ed0fa1fa14f48feaf77c0ba1f6e5dd371dd8fd
Instruction ID: 0ac2273093169a9723f5a49d7def2a1a0e4efde15c2d8dcba0568209acb81ea7
Opcode Fuzzy Hash: 6c93c86b5f3b9f7a8269726404ed0fa1fa14f48feaf77c0ba1f6e5dd371dd8fd
Instruction Fuzzy Hash: 34D05EA631E6502AE310519B2D85EBB4EACCAC57A4F54483BF64CD7252D2248C069776

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 9ed56ef6959dd8920af8b6d924cbc2bc4732ada3ba303b98172f22f33df6bd3d
Instruction ID: 8398a6df79db6557de4560d78939933842e781e1ed99b38cfbf2fd723ed8f470
Opcode Fuzzy Hash: 9ed56ef6959dd8920af8b6d924cbc2bc4732ada3ba303b98172f22f33df6bd3d
Instruction Fuzzy Hash: 3BE04F21E0010A42C704ABA5CD435FDF7AEAB95604F044172A418E92E0F631C252C748

Function 00408888 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 388b29b0a79f5f19ed4b4953a6a76f47c3e14b9604a8131d453ab3a085cd796f
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: BC32E675E04219DFCB14CF99CA80A9DBBB2BF88314F24816AD855B7385DB34AE42CF54

Function 004074A0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,004075A5,?,00000000,00409DB8), ref: 004074C9
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004074CF
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,004075A5,?,00000000,00409DB8), ref: 0040751D

Strings

Locale, xrefs: 0040750C
Control Panel\Desktop\ResourceLocale, xrefs: 0040752C
kernel32.dll, xrefs: 004074C4
GetUserDefaultUILanguage, xrefs: 004074BF
.DEFAULT\Control Panel\International, xrefs: 004074F4

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 7c066b870a361991bc0752fcd93cb8768e255443e349242cb7f15e42003cd7d9
Instruction ID: b0f7b576ff72b1c2059ac61aa9c71175e867ef76c41006bc9f97b140b7c9741a
Opcode Fuzzy Hash: 7c066b870a361991bc0752fcd93cb8768e255443e349242cb7f15e42003cd7d9
Instruction Fuzzy Hash: 02215470E04209BBDB00EAE5CC55ADE77A8AB44304F508877A900F36C1E77CBA01C75A

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 00405814 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405A5C,?,?,?,?,00000000,00000000,00000000,?,00406A3B,00000000,00406A4E), ref: 0040582E

Part of subcall function 0040565C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,00405727,?,00000000,00405806), ref: 0040567A

Part of subcall function 004056A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004058AA,?,?,?,00000000,00405A5C), ref: 004056BB

Strings

mmmm d, yyyy, xrefs: 0040591F
:mm, xrefs: 00405A10
m/d/yy, xrefs: 004058FD
:mm:ss, xrefs: 00405A2A
AMPM, xrefs: 004059F9

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: f64dfcc9beea8e06f9a7216c135bb3ef8748e57adf0d60dccc58cc6af9805412
Instruction ID: 1f8fb3564ea85801462352e9f704d9e8acf1e4fd8595550e023c4eac14c4b858
Opcode Fuzzy Hash: f64dfcc9beea8e06f9a7216c135bb3ef8748e57adf0d60dccc58cc6af9805412
Instruction Fuzzy Hash: 2B513E34B006486BDB00FAA58C81A8F77A9DB99304F50857BA515BB3C6CA3DDA098F5C

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: a67f2483392f3a9295a6f421ec51b00ba0520a603cf3575c2b5e933881db78c1
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: a67f2483392f3a9295a6f421ec51b00ba0520a603cf3575c2b5e933881db78c1
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 0040A128 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 0040A15D

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 0040A141
Setup, xrefs: 0040A14D

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: ff94df1eb2564fec58b9a221cc3fe3b9cf965a2b136f430670f36a0b3f2e2132
Instruction ID: 9b5d989b58a55d658cadae164e54e3781760331d38193a884cd145b826483737
Opcode Fuzzy Hash: ff94df1eb2564fec58b9a221cc3fe3b9cf965a2b136f430670f36a0b3f2e2132
Instruction Fuzzy Hash: 87E065302443087EE312EA629C13F5E7BACE789B54F614477F500B55C1D6795E10D46D

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040AAAE), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040AAAE), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2462074891.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2462060597.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462089071.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2462111395.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_geosetter_setup.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: 4ac654993ecb6f0c10b1cacd39e13426f3fb1ace3b4aa0046ecf3c9b516135ec
Instruction ID: daea45a2aa12e23edc1a75ca5ccfa9dec32d0aab9986280789c112b27ba3568a
Opcode Fuzzy Hash: 4ac654993ecb6f0c10b1cacd39e13426f3fb1ace3b4aa0046ecf3c9b516135ec
Instruction Fuzzy Hash: 3AC0027894134055D764AFF69E497047594A74930DF40443FA20C7A1F1D67C460A6BDD

Analysis Process: geosetter_setup.tmpPID: 5284, Parent PID: 6300COMMON

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	108

Executed Functions

Function 00471688 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 961COMMON

Download Yara Rule

Strings

-- File entry --, xrefs: 004716DB
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00471C95
Non-default bitness: 64-bit, xrefs: 0047188F
InUn, xrefs: 0047213F
Time stamp of existing file: %s, xrefs: 00471A0B
Couldn't read time stamp. Skipping., xrefs: 00471D15
Existing file is protected by Windows File Protection. Skipping., xrefs: 00471DCC
Existing file has a later time stamp. Skipping., xrefs: 00471DAF
Failed to strip read-only attribute., xrefs: 00471EB3
Version of existing file: (none), xrefs: 00471CDA
Dest file is protected by Windows File Protection., xrefs: 004718CD
Same version. Skipping., xrefs: 00471CC5
Time stamp of our file: (failed to read), xrefs: 00471987
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00471E76
Uninstaller requires administrator: %s, xrefs: 0047216F
Will register the file (a DLL/OCX) later., xrefs: 0047250E
.tmp, xrefs: 00471F97
Skipping due to "onlyifdoesntexist" flag., xrefs: 004719AE
Same time stamp. Skipping., xrefs: 00471D35
I, xrefs: 00471688
Version of existing file: %u.%u.%u.%u, xrefs: 00471B5C
Will register the file (a type library) later., xrefs: 00472502
Non-default bitness: 32-bit, xrefs: 0047189B
Time stamp of our file: %s, xrefs: 0047197B
Time stamp of existing file: (failed to read), xrefs: 00471A17
Incrementing shared file count (64-bit)., xrefs: 0047257B
Version of our file: (none), xrefs: 00471ADC
User opted not to overwrite the existing file. Skipping., xrefs: 00471E2D
Version of our file: %u.%u.%u.%u, xrefs: 00471AD0
Installing into GAC, xrefs: 004726FA
Installing the file., xrefs: 00471EE9
, xrefs: 00471BAF, 00471D80, 00471DFE
Dest file exists., xrefs: 0047199B
Existing file is a newer version. Skipping., xrefs: 00471BE2
Dest filename: %s, xrefs: 00471874
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00471CB0
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00471CA4
Incrementing shared file count (32-bit)., xrefs: 00472594
Stripped read-only attribute., xrefs: 00471EA7
Skipping due to "onlyifdestfileexists" flag., xrefs: 00471EDA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.$I
API String ID: 0-4118084788
Opcode ID: 547f9a19f2b191c17d45b4da37368b8778b6843493a226ab9f6e1117b3136719
Instruction ID: 6bf2baeb3a70bced245c17dd6e1df6b1677c078c0e18323f60fd28fe4f0ee562
Opcode Fuzzy Hash: 547f9a19f2b191c17d45b4da37368b8778b6843493a226ab9f6e1117b3136719
Instruction Fuzzy Hash: 73927134A042889FDB11DFA9C585BDDBBF4AF05304F1480ABE848BB392D7789E45DB19

Function 0042E4EC Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E526
GetVersion.KERNEL32(00000000,0042E6D0,?,0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E543
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E6D0,?,0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E55C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E562
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E6D0,?,0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E577
FreeSid.ADVAPI32(00000000,0042E6D7,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E6CA

Strings

CheckTokenMembership, xrefs: 0042E552
advapi32.dll, xrefs: 0042E557

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: bec140b171ea519891e8f75e6984b41f13cc792e2a5660a755a4f82e4b8777e7
Instruction ID: 33373ee259e646c263c3edb0d375fd355344fbe6f0fea3053a31bb261822ccd7
Opcode Fuzzy Hash: bec140b171ea519891e8f75e6984b41f13cc792e2a5660a755a4f82e4b8777e7
Instruction Fuzzy Hash: 33518371B44619AEDB10EAE69842B7F77ACDB19304FD4047BB500F72C2D57CD904876A

Function 00456DD4 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0049BA74,00000000,00000001,0049B774,?,00000000,0045717F), ref: 00456E1A
CoCreateInstance.OLE32(0049B764,00000000,00000001,0049B774,?,00000000,0045717F), ref: 00456E40
SysFreeString.OLEAUT32(00000000), ref: 00456FF7

Strings

IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 00457066
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 0045702E
IPersistFile::Save, xrefs: 004570FE
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 00456F59
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456FDC
%ProgramFiles(x86)%\, xrefs: 00456ECA
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004570A0
CoCreateInstance, xrefs: 00456E4B
IPropertyStore::Commit, xrefs: 0045707F
{pf32}\, xrefs: 00456EBA
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 00456F8D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateInstance$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 308859552-2363233914
Opcode ID: 07d5a5579f8ca6652d0c1b29a29510edaaf9d516a664dc31519823db798bd8dc
Instruction ID: 02ec3099c1e013a4d2a6014e0405d8002507ef7a0ca247d1a979c15f6e32810c
Opcode Fuzzy Hash: 07d5a5579f8ca6652d0c1b29a29510edaaf9d516a664dc31519823db798bd8dc
Instruction Fuzzy Hash: 57B18071A04204AFDB11DFA9D845B9E7BF8AF08706F5440B6F904E7262DB38DD48CB69

Function 00450994 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 76
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,00450AB1,?,?,?,?,00000000,00000000), ref: 004509BF

Part of subcall function 00450964: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0045097C

LoadLibraryA.KERNEL32(00000000,00000000,00450AB1,?,?,?,?,00000000,00000000), ref: 004509FB
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450A19
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 00450A2E
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450A43
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450A58
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 00450A6D
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450A82

Strings

RmGetList, xrefs: 00450A38
RmStartSession, xrefs: 00450A0E
RmRegisterResources, xrefs: 00450A23
RmShutdown, xrefs: 00450A4D
RmRestart, xrefs: 00450A62
Rstrtmgr.dll, xrefs: 004509E8
RmEndSession, xrefs: 00450A77

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 2754715182-3419246398
Opcode ID: d8d5ff48d6aa38830af6a9e8a73036221bb65f2481768552fb853932befe92ab
Instruction ID: 7e76809d132c55fa29070b713de61cc7a3e08993567f6b48a797f9432d6667d5
Opcode Fuzzy Hash: d8d5ff48d6aa38830af6a9e8a73036221bb65f2481768552fb853932befe92ab
Instruction Fuzzy Hash: 58212AB4A00304AEE710FBA5EC86A6E77F8E764755F50053BB810A71A3D6789D49CB1C

Function 0042405C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6f3cab85cb6cd94dd259e2a1688b0505dda5d67cc9468b745cf4902a0b6c1d
Instruction ID: 43e49367b0b6739e18dd975752e7d81306140be7a57883210305ee73c05c6530
Opcode Fuzzy Hash: fe6f3cab85cb6cd94dd259e2a1688b0505dda5d67cc9468b745cf4902a0b6c1d
Instruction Fuzzy Hash: 59E16E30704124EFD710DB6AE685A5DB7F4EF84314FA540A6F6859B392CB38EE81DB09

Function 00422CAC Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422E44
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,0042300E), ref: 00422E54

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 50d217a044accfbb6ff9672ceaa0ff858f3e4d17f8446c7d09d6d8818b0f9199
Instruction ID: bacc4b86db7cb1d0e13acf93141a7ddfdaa0ad6c2af5cb9121abc77d57b19b6c
Opcode Fuzzy Hash: 50d217a044accfbb6ff9672ceaa0ff858f3e4d17f8446c7d09d6d8818b0f9199
Instruction Fuzzy Hash: 1B916270B14254AFD700DBA9DB46F9E77F4AB04304F5600B6F904AB292C7B8AE01AB58

Function 00468034 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004971B4: GetWindowRect.USER32(00000000), ref: 004971CA

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004683DD

Part of subcall function 0041DB00: GetObjectA.GDI32(?,00000018,004683F6), ref: 0041DB2B

Part of subcall function 00467E10: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467EB3
Part of subcall function 00467E10: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467ED9
Part of subcall function 00467E10: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467F30

Part of subcall function 004677CC: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00468491,00000000,00000000,00000000,0000000C,00000000), ref: 004677E4

Part of subcall function 00497438: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00497442

Part of subcall function 0042F188: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042F1E4
Part of subcall function 0042F188: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042F201

Part of subcall function 00497104: GetDC.USER32(00000000), ref: 00497126
Part of subcall function 00497104: SelectObject.GDI32(?,00000000), ref: 0049714C
Part of subcall function 00497104: ReleaseDC.USER32(00000000,?), ref: 0049719D

Part of subcall function 00497428: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00497432

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00469080
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00469091
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004690A9

Strings

(Default), xrefs: 00469692
STOPIMAGE, xrefs: 004683D2
, xrefs: 0046849E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadProcRectReleaseSelectSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 616467991-770201673
Opcode ID: 7ac9fbee08becc147764038b1422546fa3b2ca02bd56a1ced098e19d100d21d0
Instruction ID: 80892e57212ece105f8354d293749779e47711168eff5a6823bea21c9da9ff55
Opcode Fuzzy Hash: 7ac9fbee08becc147764038b1422546fa3b2ca02bd56a1ced098e19d100d21d0
Instruction Fuzzy Hash: 90F2E7786005108FCB00EB69D8D9F9977F5BF89304F1542BAE5049B36ADB78EC46CB4A

Function 004565A8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,004566E7), ref: 004565D8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004565DE
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,004566C5,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,004566E7), ref: 00456634

Strings

kernel32.dll, xrefs: 004565D3
GetDiskFreeSpaceExA, xrefs: 004565CE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: 25df71702425412e55e0ebe1ec94dd27c79a220fb61393adf873e88db180ab3d
Instruction ID: b48cc3d91c9fc3d8a1033014b63779c50d18bc65ef0bc06e4cd1291adb105b9d
Opcode Fuzzy Hash: 25df71702425412e55e0ebe1ec94dd27c79a220fb61393adf873e88db180ab3d
Instruction Fuzzy Hash: A2417471A00249AFCF01EFA5C8829EFBBB8EF48304F514567F800F7252D6795D098B69

Function 00476120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0047628A,?,?,0049E1E4,00000000), ref: 00476179
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,0047628A,?,?,0049E1E4,00000000), ref: 00476256
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,0047628A,?,?,0049E1E4,00000000), ref: 00476264

Strings

unins, xrefs: 004761CC
unins???.*, xrefs: 00476163

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 4d6b4c78c27d307665df1e659c75eb40dbe6a289c02ca47561d52f2f5fb83ddd
Instruction ID: eb89464c752a784b36226a23c26c23c5edadcf818cb3280f2000aa581376a5b5
Opcode Fuzzy Hash: 4d6b4c78c27d307665df1e659c75eb40dbe6a289c02ca47561d52f2f5fb83ddd
Instruction Fuzzy Hash: 11312E70600548ABDB50EB65CC81ADEBBADDB45314F5180F6A84CAB3A6DB389F418F58

Function 004531A4 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00453207,?,?,-00000001,00000000), ref: 004531E1
GetLastError.KERNEL32(00000000,?,00000000,00453207,?,?,-00000001,00000000), ref: 004531E9

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 1201cac6feb998a2fb112764d438cb0eb727cdb5a4391e78fe092c8218b0a9ce
Instruction ID: d0bf465202dae3429285692917932fac375c13b7b10a14b33624456fe0da4cd4
Opcode Fuzzy Hash: 1201cac6feb998a2fb112764d438cb0eb727cdb5a4391e78fe092c8218b0a9ce
Instruction Fuzzy Hash: FEF02371A046047BCB10DF7AAC0145EF7ACDB4577675046BBFC14D3291DB784F088558

Function 004089B8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049D4C4,00000001,?,00408A83,?,00000000,00408B62), ref: 004089D6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 40f9e6ad7b9874a9b05efedc53f019727417c817c0661ecad43f37488e602a1d
Instruction ID: 37d1d3aac47cb6b8cd62020f591dd9ac8cec50bf03644e7f1bddec785b1dbc63
Opcode Fuzzy Hash: 40f9e6ad7b9874a9b05efedc53f019727417c817c0661ecad43f37488e602a1d
Instruction Fuzzy Hash: 63E0227170021452C315A91A8C82AFAB24C9B18314F00427FB948E73C3EDB89E8042ED

Function 00423FD4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004245A1,?,00000000,004245AC), ref: 00423FFE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 15ec92afe3337674697e5aaff926351660f6d808b83c1ecc1d592f8d8ff41db7
Instruction ID: 626c949ff67c0b5daba62b8ffba664747ea83a29b03f4787c3cb7294a8149fcf
Opcode Fuzzy Hash: 15ec92afe3337674697e5aaff926351660f6d808b83c1ecc1d592f8d8ff41db7
Instruction Fuzzy Hash: 9CF0B379205608AF8B40DF99C588D4ABBE8AB4C260B058295B988CB321C234EE808F94

Function 00455D38 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 00455D4E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: aa3a47175e92b859a3c3631cc0a30abc799c89e82c4a450a6b7a51612d703bec
Instruction ID: 82cf1e81aeab4cdf4c711474db213eebdc1b2e178f500b1422eacd8e28b83923
Opcode Fuzzy Hash: aa3a47175e92b859a3c3631cc0a30abc799c89e82c4a450a6b7a51612d703bec
Instruction Fuzzy Hash: 0AD0C27230460063C700AAA99C826AA359C8B84305F00883F3CC5DA2C3EABDDA4C5696

Function 0046FE70 Relevance: 75.8, APIs: 1, Strings: 42, Instructions: 512
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046FC5C: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,VtG,?,0049E1E4,?,0046FF73,?,00000000,00470532,?,_is1), ref: 0046FC7F

RegCloseKey.ADVAPI32(?,00470539,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,00470584,?,?,0049E1E4,00000000), ref: 0047052C

Strings

HelpTelephone, xrefs: 00470273
MinorVersion, xrefs: 004703A9
Inno Setup: Icon Group, xrefs: 0046FFC5
Comments, xrefs: 00470304
Inno Setup: Deselected Components, xrefs: 0047005F
EstimatedSize, xrefs: 004704A9
InstallLocation, xrefs: 0046FFB6
Inno Setup: No Icons, xrefs: 0046FFE3
Inno Setup: Selected Components, xrefs: 00470040
" /SILENT, xrefs: 004701F2
Publisher, xrefs: 00470239
DisplayName, xrefs: 0047016E
URLUpdateInfo, xrefs: 004702AD
InstallDate, xrefs: 0047036B
Inno Setup: Setup Version, xrefs: 0046FF61
5.5.9 (a), xrefs: 0046FF66
Inno Setup: Deselected Tasks, xrefs: 004700A6
Inno Setup: User Info: Name, xrefs: 004700BE
URLInfoAbout, xrefs: 00470256
VersionMinor, xrefs: 004703CD
UninstallString, xrefs: 004701C5
Inno Setup: App Path, xrefs: 0046FF96
Inno Setup: Selected Tasks, xrefs: 00470087
DisplayIcon, xrefs: 0047018B
Contact, xrefs: 004702E7
Inno Setup: Setup Type, xrefs: 00470021
NoModify, xrefs: 00470338
NoRepair, xrefs: 0047034C
VersionMajor, xrefs: 004703BB
Inno Setup: User, xrefs: 00470002
MajorVersion, xrefs: 00470397
DisplayVersion, xrefs: 0047021C
Readme, xrefs: 004702CA
HelpLink, xrefs: 00470290
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046FEC6
ModifyPath, xrefs: 00470324
Inno Setup: User Info: Serial, xrefs: 004700E8
_is1, xrefs: 0046FECC
Inno Setup: User Info: Organization, xrefs: 004700D3
RegisterPreviousData, xrefs: 004704E2
QuietUninstallString, xrefs: 004701FF
Inno Setup: Language, xrefs: 0047010F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.5.9 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$_is1
API String ID: 3132538880-2925550972
Opcode ID: 28aa0bebb81bc6d8acf29594bf1b6a70ebde8719469c22e8397bcd291ac24d63
Instruction ID: 8dffaa2781584bc6e947bd791be20880efee78ab32c439a28404737c84d0984c
Opcode Fuzzy Hash: 28aa0bebb81bc6d8acf29594bf1b6a70ebde8719469c22e8397bcd291ac24d63
Instruction Fuzzy Hash: F8124F34A00108DBDB04EB55E991ADE77F5EF48304F60807BE804AB3A5EB79BD45CB59

Function 004063F4 Relevance: 42.2, APIs: 7, Strings: 17, Instructions: 174
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 0040640F
GetVersion.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 00406416
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040642B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00406453
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406655
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040666B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 00406676

Strings

kernel32.dll, xrefs: 0040640A
cryptbase.dll, xrefs: 0040658E
uxtheme.dll, xrefs: 004064BC
setupapi.dll, xrefs: 00406502
apphelp.dll, xrefs: 00406525
SetDllDirectoryW, xrefs: 0040644D
propsys.dll, xrefs: 00406548
clbcatq.dll, xrefs: 0040663D
SetProcessDEPPolicy, xrefs: 00406665
version.dll, xrefs: 004065D4
SetDefaultDllDirectories, xrefs: 00406425
comres.dll, xrefs: 0040661A
profapi.dll, xrefs: 004065F7
userenv.dll, xrefs: 004064DF
SetSearchPathMode, xrefs: 0040664F
dwmapi.dll, xrefs: 0040656B
oleacc.dll, xrefs: 004065B1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 3297890031-2388063882
Opcode ID: 7c5204fbbc2168c2f62eadc490ed385a4cfd672bd01c7cc457884a48157f0828
Instruction ID: 52ceb319b1b10a2745084cc2a18598c2ecefae742a63aceaaee3a2f28509b87b
Opcode Fuzzy Hash: 7c5204fbbc2168c2f62eadc490ed385a4cfd672bd01c7cc457884a48157f0828
Instruction Fuzzy Hash: 7061F130A00109EBCB01FBA6D982D8E77B9AB44709B214077B405772E6DB3DEF199B5D

Function 00484E68 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00484E79
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00484E86
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484E94
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00484E9C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00484EA8
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00484EC9
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00484EDC
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00484EE2
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484EF9

Strings

kernel32.dll, xrefs: 00484E74
GetSystemWow64DirectoryA, xrefs: 00484EC3
RegDeleteKeyExA, xrefs: 00484ED2
advapi32.dll, xrefs: 00484ED7
GetNativeSystemInfo, xrefs: 00484E80
IsWow64Process, xrefs: 00484E96

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: cd68709e737b022a93ba3f5ff6983bcc42b0d1d8f8071fae57a82298f7546d18
Instruction ID: 19f93fc1e60286517b98713993879556ba5b021e510ed05db2a10d1898c9039d
Opcode Fuzzy Hash: cd68709e737b022a93ba3f5ff6983bcc42b0d1d8f8071fae57a82298f7546d18
Instruction Fuzzy Hash: E8110351109353A4E721B3796E46B7F25889B8031CF080C7F7B84666C6EA7CC845833F

Function 0047491C Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00474F15,?,?,?,?,00000000,0047506F,?,?,0049E1E4), ref: 00474AA4
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00474F15,?,?,?,?,00000000,0047506F), ref: 00474AAD

Part of subcall function 00474770: GetLastError.KERNEL32(00000000,00000000,00000000,00474844,?,?,0049E1E4,00000000), ref: 004747FD

RegDeleteValueA.ADVAPI32(?,00000000,00000000,00474F04,?,?,00000000,00474F15,?,?,?,?,00000000,0047506F), ref: 00474BCB

Part of subcall function 0042E234: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E260

Part of subcall function 00474770: GetLastError.KERNEL32(00000000,00000000,00000000,00474844,?,?,0049E1E4,00000000), ref: 00474813

Strings

{olddata}, xrefs: 00474C63, 00474CFA
break, xrefs: 00474D3B
olddata, xrefs: 00474CCE, 00474D2D
Cannot access 64-bit registry keys on this version of Windows, xrefs: 004749FA
Failed to parse "qword" value, xrefs: 00474E57

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DeleteErrorLastValue$CloseCreate
String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
API String ID: 2638610037-3092547568
Opcode ID: 3390799d761c43e96d883a7a83be3e592606d26e88f1f25a877d420e7ba18781
Instruction ID: 267d904c86387cc298b2de5c468d8dbc688663b33e9349e97c23752959c60694
Opcode Fuzzy Hash: 3390799d761c43e96d883a7a83be3e592606d26e88f1f25a877d420e7ba18781
Instruction Fuzzy Hash: 44322074E002489FDB15DBA9D481FEEB7F8AF48314F048066F914AB3A2C778AD45CB59

Function 00469A0C Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,00469C26,?,?,00000001,00000000,00000000,00469C41,?,00000000,00000000,?), ref: 00469C0F

Strings

Inno Setup: Setup Type, xrefs: 00469B1E
Inno Setup: Selected Tasks, xrefs: 00469B7B
Inno Setup: User Info: Name, xrefs: 00469BCB
Inno Setup: No Icons, xrefs: 00469AF7
%s\%s_is1, xrefs: 00469A89
Inno Setup: Deselected Tasks, xrefs: 00469B9D
Inno Setup: Icon Group, xrefs: 00469AEA
Inno Setup: User Info: Organization, xrefs: 00469BDE
Inno Setup: App Path, xrefs: 00469ACE
Inno Setup: Deselected Components, xrefs: 00469B50
Inno Setup: Selected Components, xrefs: 00469B2E
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00469A6B
Inno Setup: User Info: Serial, xrefs: 00469BF1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 7b5af505cdaee4b9995a13ec4fd6d8a32d5a0e4e315676c1a42935439103419e
Instruction ID: c7de7197f4a769c9e7c3cd52df4c64fbb683598124d789e1de9a85ab418445f9
Opcode Fuzzy Hash: 7b5af505cdaee4b9995a13ec4fd6d8a32d5a0e4e315676c1a42935439103419e
Instruction Fuzzy Hash: C4519430A006089BCB15DB66D941BEEB7F9EF49304F5084BAE84067395E7B8AF01CB5D

Function 00473AA0 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042CC54: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CC78

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00473C58
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00473D73
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00473D89
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00473DAE

Strings

Desktop.ini, xrefs: 00473E2F
.url, xrefs: 00473B72
.pif, xrefs: 00473B4F, 00473CED
Dest filename: %s, xrefs: 00473BFA
.lnk, xrefs: 00473B2C
target.lnk, xrefs: 00473DF8
Successfully created the icon., xrefs: 00473D4D
Creating the icon., xrefs: 00473C6D
{group}\, xrefs: 00473AFA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Creating the icon.$Desktop.ini$Dest filename: %s$Successfully created the icon.$target.lnk${group}\
API String ID: 971782779-2902529204
Opcode ID: e54a508a62dfe029f21a25df3b69d4e56c56f2154e951fb1d55b97ecab692537
Instruction ID: 9b31a6288a8d0ad81c732a29d19026b8086b57763a6276d7ac4447936d78ea7d
Opcode Fuzzy Hash: e54a508a62dfe029f21a25df3b69d4e56c56f2154e951fb1d55b97ecab692537
Instruction Fuzzy Hash: EBD11374A00148ABDB11DFA9D582BDDBBF4AF08305F50806AF804B7392D778AE45DB69

Function 0047D978 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DCE8: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,0045451C,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D), ref: 0042DCFB

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042DD40: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,004542C2,00000000,00454365,?,?,00000000,00000000,00000000,00000000,00000000,?,00454755,00000000), ref: 0042DD5A
Part of subcall function 0042DD40: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042DD60

SHGetKnownFolderPath.SHELL32(0049BD44,00008000,00000000,?,00000000,0047DC4C), ref: 0047DB52
CoTaskMemFree.OLE32(?,0047DB95), ref: 0047DB88

Part of subcall function 0042D658: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DE8E,00000000,0042DF20,?,?,?,0049D62C,00000000,00000000), ref: 0042D683

Strings

SystemDrive, xrefs: 0047D9DF
CommonFilesDir, xrefs: 0047DA7A, 0047DAF6
cmd.exe, xrefs: 0047DC06
ProgramFilesDir, xrefs: 0047DA40, 0047DAC7
Failed to get path of 64-bit Program Files directory, xrefs: 0047DAE9
Failed to get path of 64-bit Common Files directory, xrefs: 0047DB18
COMMAND.COM, xrefs: 0047DC27
Common Files, xrefs: 0047DAB1
\Program Files, xrefs: 0047DA67

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 3771764029-544719455
Opcode ID: 6ec6ff986ef5dd5265772e09c3445ba75f4a3d0a7ec86f160005d9c17a7e769a
Instruction ID: 0fe7c2c5921331aa3b985ab989dbf77b3a087c61dea5e3792aec770f31e1cce1
Opcode Fuzzy Hash: 6ec6ff986ef5dd5265772e09c3445ba75f4a3d0a7ec86f160005d9c17a7e769a
Instruction Fuzzy Hash: A061B234E24204AFDB11EFA6D84269E7B78EF84318F51C57BE404AB391D77CAA41CA1D

Function 0047E184 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047E2B1

Strings

SHFOLDERDLL, xrefs: 0047E22F
Failed to get address of SHGetFolderPath function, xrefs: 0047E2C2
Failed to load DLL "%s", xrefs: 0047E294
SHGetFolderPathA, xrefs: 0047E2A6
shell32.dll, xrefs: 0047E24F
shfolder.dll, xrefs: 0047E1BF
_isetup\_shfoldr.dll, xrefs: 0047E222
2, xrefs: 0047E1F3

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressDirectoryProcSystem
String ID: 2$Failed to get address of SHGetFolderPath function$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 996212319-3422985891
Opcode ID: 2ee55fa07f5402e21f3b06f2d1869faf56609dd587cb054fbf2c8bfa1446e0f1
Instruction ID: 9758cc0716918fe71002c31ee1435c1447d2ac946059de1b269defc554b01a12
Opcode Fuzzy Hash: 2ee55fa07f5402e21f3b06f2d1869faf56609dd587cb054fbf2c8bfa1446e0f1
Instruction Fuzzy Hash: C9415830A00119DFDB10DFA6C9415DE77B8FB48309F50C9BBE414A7252D7389E05CB59

Function 00423CC4 Relevance: 15.1, APIs: 10, Instructions: 98windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F814: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041F1F4,?,00423CDF,0042405C,0041F1F4), ref: 0041F832

GetClassInfoA.USER32(00400000,00423ACC), ref: 00423CEF
RegisterClassA.USER32(0049B630), ref: 00423D07
GetSystemMetrics.USER32(00000000), ref: 00423D29
GetSystemMetrics.USER32(00000001), ref: 00423D38
SetWindowLongA.USER32(004108B0,000000FC,00423ADC), ref: 00423D94
SendMessageA.USER32(004108B0,00000080,00000001,00000000), ref: 00423DB5
GetSystemMenu.USER32(004108B0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C,0041F1F4), ref: 00423DC0
DeleteMenu.USER32(00000000,0000F030,00000000,004108B0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C,0041F1F4), ref: 00423DCF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004108B0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423DDC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004108B0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423DF2

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID:
API String ID: 183575631-0
Opcode ID: a2c02cc2165dcaf8367acf6641f6e6fd3fefd979ebd8238a53b3443abb8769c0
Instruction ID: 7df3f4c256e16cf88ed5bb8a347b5b3a25df550de305930316ee8fcfc6e0617b
Opcode Fuzzy Hash: a2c02cc2165dcaf8367acf6641f6e6fd3fefd979ebd8238a53b3443abb8769c0
Instruction Fuzzy Hash: 203164B17502106AEB10AF65DC86F6A3698D714709F60017AFA40EF2D7C6BDED40476D

Function 00482C40 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00482DFD
FreeLibrary.KERNEL32(00000000), ref: 00482E11
SendNotifyMessageA.USER32(00020442,00000496,00002710,00000000), ref: 00482E83

Strings

Deinitializing Setup., xrefs: 00482C5E
Not restarting Windows because Setup is being run from the debugger., xrefs: 00482E32
Restarting Windows., xrefs: 00482E5E
DeinitializeSetup, xrefs: 00482CF9
GetCustomSetupExitCode, xrefs: 00482C9D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 04d3ba94bbaf6634d38e028a61e56e47dab80ce7d9174f3f05bce7b3b98b9e86
Instruction ID: 87ca8a1097935e6c4637b022688acffdd958b69fb8a4991d3dc3ea9519d40e2c
Opcode Fuzzy Hash: 04d3ba94bbaf6634d38e028a61e56e47dab80ce7d9174f3f05bce7b3b98b9e86
Instruction Fuzzy Hash: F851AA30600200EFD711EF6AD949B6E7BE4EB19718F51897BE800D72A1DBB89C45CB5D

Function 0042FA00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042FA2F
GetFocus.USER32 ref: 0042FA37
RegisterClassA.USER32(0049B7AC), ref: 0042FA58
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042FB2C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042FA96
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042FADC
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042FAED
SetFocus.USER32(00000000,00000000,0042FB0F,?,?,?,00000001,00000000,?,00458B4E,00000000,0049D62C), ref: 0042FAF4

Strings

TWindowDisabler-Window, xrefs: 0042FA8F, 0042FAD5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: fec87ca07d7290a4a57da710bc1ddf3081f88a8d4dfe440d170acd63eb0d43c3
Instruction ID: be32ada46e774ba6914a87ad40c025b2c9e25f6d11d521099bf08b28c91ad89a
Opcode Fuzzy Hash: fec87ca07d7290a4a57da710bc1ddf3081f88a8d4dfe440d170acd63eb0d43c3
Instruction Fuzzy Hash: E121B570B40720BAE210EB65EC03F1A76B4EB04B04FA1813BF504BB2D1D7B96C1487AD

Function 00473950 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00473A11,?,?,?,00000008,00000000,00000000,00000000,?,00473C6D,?,?,00000000,00473EF0), ref: 00473974

Part of subcall function 0042D1E4: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042D25A

Part of subcall function 004073A0: DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00473A11,?,?,?,00000008,00000000,00000000,00000000,?,00473C6D), ref: 004739EB
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00473A11,?,?,?,00000008,00000000,00000000,00000000), ref: 004739F1

Strings

CLSID2, xrefs: 0047399E
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 004739AD
desktop.ini, xrefs: 00473988
target.lnk, xrefs: 004739C9
.ShellClassInfo, xrefs: 004739A3

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: c5ee601f3e9953c735d8bf0a71158fe3e64be6cf92b19d5fab08f93ca351b12b
Instruction ID: bfb262a57c212aacfed1a05d1298e64af55acb3d3cb9d0523fd91374b550827c
Opcode Fuzzy Hash: c5ee601f3e9953c735d8bf0a71158fe3e64be6cf92b19d5fab08f93ca351b12b
Instruction Fuzzy Hash: 8F11D3B07006047BD701EA698C83AAE73ACDB48715F50813BB844A72C1DB3C9F02961D

Function 00453934 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453956
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045395C
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453970
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453976

Strings

Wow64RevertWow64FsRedirection, xrefs: 00453966
kernel32.dll, xrefs: 00453951, 0045396B
shell32.dll, xrefs: 004539B3
Wow64DisableWow64FsRedirection, xrefs: 0045394C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 82da2a28b5003144a588bfd6711196aeba7955ca25a5e24eec6645e80d453e72
Instruction ID: a193a4472c2853cf72940ff7690ab9972ac4b2f80f688c1a00737a0c34b4483d
Opcode Fuzzy Hash: 82da2a28b5003144a588bfd6711196aeba7955ca25a5e24eec6645e80d453e72
Instruction Fuzzy Hash: B211E3B0A00244BBDB00EF66DC03F5E7BA8D70475AF60447BF84166282D6BC9F088A2D

Function 004588C0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458A74,?, /s ",?,regsvr32.exe",?,00458A74), ref: 004589E6

Strings

Spawning 64-bit RegSvr32: , xrefs: 0045894B
Spawning 32-bit RegSvr32: , xrefs: 0045896D
CreateProcess, xrefs: 004589D8
/u, xrefs: 00458922
/s ", xrefs: 0045892F
D, xrefs: 0045899C
regsvr32.exe", xrefs: 00458907
0x%x, xrefs: 00458A09

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: ad9d7916d6da16ba8bf1be1dac70d1dd58c94c09802e75283c5b713d0a041cc3
Instruction ID: 5e566bfdb395c8031f807e0e6dfcda5b961088fbae7d5a2ae3caad0b9f5d9a1a
Opcode Fuzzy Hash: ad9d7916d6da16ba8bf1be1dac70d1dd58c94c09802e75283c5b713d0a041cc3
Instruction Fuzzy Hash: 94410770A003486BDB10EFE5C842B9DB7F9AF45305F50407FA914BB296DF789E098B59

Function 00467E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467EB3
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467ED9

Part of subcall function 00467D4C: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467DE7
Part of subcall function 00467D4C: DestroyCursor.USER32(00000000), ref: 00467DFD

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467F30
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467F91
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467FB7

Strings

shell32.dll, xrefs: 00467F14
c:\directory, xrefs: 00467EAE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 5f39b0330533c07a7ed62396f03ad1b0497855389b17cb99d84a9eecbd47350c
Instruction ID: adf232676f9dc8545d434ff73a7213ff4163269ef5d9f53791e9b27a0c2465ea
Opcode Fuzzy Hash: 5f39b0330533c07a7ed62396f03ad1b0497855389b17cb99d84a9eecbd47350c
Instruction Fuzzy Hash: 64516D70644208AFD750EF65CC85FDEBBA8EB48308F1085A7F5089B391DA399E85CB59

Function 00430DE0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430DE8
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430DF7
GetCurrentThreadId.KERNEL32 ref: 00430E11
GlobalAddAtomA.KERNEL32(00000000), ref: 00430E32

Strings

WndProcPtr%.8X%.8X, xrefs: 00430E23
commdlg_help, xrefs: 00430DE3
commdlg_FindReplace, xrefs: 00430DF2

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 50811bd1b0b0bc88e10382fd261453b7235327efbd1eb80bce93881789032006
Instruction ID: dd09876b0f9c3184917b018614b917cdad608ae665b29eb2c15b2e3af62d5cdc
Opcode Fuzzy Hash: 50811bd1b0b0bc88e10382fd261453b7235327efbd1eb80bce93881789032006
Instruction Fuzzy Hash: 98F082B09483409ED300EF26890371A7AE0AB58708F404F3FB48CA2291D7399910CB1F

Function 004232A0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 004232F4
GetCapture.USER32 ref: 00423303
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00423309
ReleaseCapture.USER32 ref: 0042330E
GetActiveWindow.USER32 ref: 0042331D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 0042339C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00423400
GetActiveWindow.USER32 ref: 0042340F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: bac6248c5c65b2a46f0a1d517af8b370a3a4e6cba25cb3140287781b4ccd40b9
Instruction ID: 3a9af59dda1f98e95100fec3f153a7acb7f05633bd4cd2eb2e4992da2b7770c9
Opcode Fuzzy Hash: bac6248c5c65b2a46f0a1d517af8b370a3a4e6cba25cb3140287781b4ccd40b9
Instruction Fuzzy Hash: 68414170B10258AFDB10EFAAD942B9DB7F1AF44704F5140BAE404AB292DB7C9F41CB18

Function 00477E98 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00477EF1
SetWindowLongW.USER32(00000000,000000FC,Function_00077E4C), ref: 00477F18
GetACP.KERNEL32(00000000,00478130,?,00000000,0047815A), ref: 00477F55
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00477F9B

Strings

Inno Setup: Language, xrefs: 00478023
COMBOBOX, xrefs: 00477EEA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: ee73a32da0349862b0492f9267fac64247cda7a4a61a4b082aceda1c218f248c
Instruction ID: 81c94a85f2d0ae2d33cbd4ee74d6221623364a49e9b2571c8ba4411711431487
Opcode Fuzzy Hash: ee73a32da0349862b0492f9267fac64247cda7a4a61a4b082aceda1c218f248c
Instruction Fuzzy Hash: 65813C34A00205DFD710EF69C989AAAB7F0FB49304F55C1BAE848D7362DB38AD45CB59

Function 00455778 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455994,00455994,?,00455994,00000000), ref: 00455922
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455994,00455994,?,00455994), ref: 0045592F

Part of subcall function 004556E4: WaitForInputIdle.USER32(?,00000032), ref: 00455710
Part of subcall function 004556E4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00455732
Part of subcall function 004556E4: GetExitCodeProcess.KERNEL32(?,?), ref: 00455741
Part of subcall function 004556E4: CloseHandle.KERNEL32(?,0045576E,00455767,?,?,?,00000000,?,?,00455943,?,?,?,00000044,00000000,00000000), ref: 00455761

Strings

.cmd, xrefs: 00455823
COMMAND.COM" /C , xrefs: 0045588C
.bat, xrefs: 00455808
D, xrefs: 004558C0
cmd.exe" /C ", xrefs: 00455855

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 95c85a57d3cb7a8085ed9082f870712bc010097446f40961deb1835e90336128
Instruction ID: 19165e213e9236b89a5b086241af4e71530f18fc7e42ed674525c8849c01d6f6
Opcode Fuzzy Hash: 95c85a57d3cb7a8085ed9082f870712bc010097446f40961deb1835e90336128
Instruction Fuzzy Hash: F4514A7060074DABDB11EF96C892BEEBBB9AF44315F50403BF804BB282D77C99198759

Function 00423ADC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423B6C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423B99
OemToCharA.USER32(?,?), ref: 00423BAC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423BEC

Strings

2, xrefs: 00423B3A
MAINICON, xrefs: 00423B61

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 5bb029359a14fe80b98f3d31a1bddee7a09f53b94ef6d4528e1ea31487fdaa44
Instruction ID: e5d3831d9b5483d4bbbd2f836839ca6b10e9aa02fde8f17f2ef2fb4492c3d901
Opcode Fuzzy Hash: 5bb029359a14fe80b98f3d31a1bddee7a09f53b94ef6d4528e1ea31487fdaa44
Instruction Fuzzy Hash: 6031A271A042549ADB10EF29C8C57C67BE8AF14308F4045BAE844DB383D7BED988CB59

Function 00419388 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0041938D
GlobalAddAtomA.KERNEL32(00000000), ref: 004193AE
GetCurrentThreadId.KERNEL32 ref: 004193C9
GlobalAddAtomA.KERNEL32(00000000), ref: 004193EA

Part of subcall function 00423518: GetDC.USER32(00000000), ref: 0042356E
Part of subcall function 00423518: EnumFontsA.GDI32(00000000,00000000,004234B8,004108B0,00000000,?,?,00000000,?,00419423,00000000,?,?,?,00000001), ref: 00423581
Part of subcall function 00423518: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423589
Part of subcall function 00423518: ReleaseDC.USER32(00000000,00000000), ref: 00423594

Part of subcall function 00423ADC: LoadIconA.USER32(00400000,MAINICON), ref: 00423B6C
Part of subcall function 00423ADC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423B99
Part of subcall function 00423ADC: OemToCharA.USER32(?,?), ref: 00423BAC
Part of subcall function 00423ADC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423BEC

Part of subcall function 0041F568: GetVersion.KERNEL32(?,00419440,00000000,?,?,?,00000001), ref: 0041F576
Part of subcall function 0041F568: SetErrorMode.KERNEL32(00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F592
Part of subcall function 0041F568: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F59E
Part of subcall function 0041F568: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F5AC
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F5DC
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F605
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F61A
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F62F
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F644
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F659
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F66E
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F683
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F698
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F6AD

Strings

Delphi%.8X, xrefs: 0041939F
ControlOfs%.8X%.8X, xrefs: 004193DB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: e4565b8fba9480968b1ec32b488455297d6f31b702462cc9ec0cccc8cb2a2db4
Instruction ID: 7870b9ea93aa7f75565cd31cdf92f475c288cd9ab0443d66b722f1effdfa130a
Opcode Fuzzy Hash: e4565b8fba9480968b1ec32b488455297d6f31b702462cc9ec0cccc8cb2a2db4
Instruction Fuzzy Hash: 8D112C70A182419AC300FF36D44279A7AE09BA430CF50893FF488AB3A1DB3D9D458B5E

Function 00413A8C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413AB4
GetWindowLongA.USER32(?,000000F0), ref: 00413ABF
GetWindowLongA.USER32(?,000000F4), ref: 00413AD1
SetWindowLongA.USER32(?,000000F4,?), ref: 00413AE4
SetPropA.USER32(?,00000000,00000000), ref: 00413AFB
SetPropA.USER32(?,00000000,00000000), ref: 00413B12

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: a72ee32d6cac1f66b8d23ea34dc7313db56b2b1373a44c7e0100784739caab29
Instruction ID: a594f7604add2a8bfce9427623ad02c9736cb33a5a72341fbb506abd62de3718
Opcode Fuzzy Hash: a72ee32d6cac1f66b8d23ea34dc7313db56b2b1373a44c7e0100784739caab29
Instruction Fuzzy Hash: 0811CC75500244BFDF00DF99ED88E9A3BE8EB09364F104276B914DB2E1D739D990CB94

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049D420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049D420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049D420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: a09964db7d5e1398f2afb7250b5a8c8ddfedb2b5ecba3fe18733cc428a63f314
Instruction ID: 86217af8f0c65890f5da76d4fe10d609cc5e2f7049d93a5e71f2b830536aceac
Opcode Fuzzy Hash: a09964db7d5e1398f2afb7250b5a8c8ddfedb2b5ecba3fe18733cc428a63f314
Instruction Fuzzy Hash: 7A11BF70E003405AEB15AB659D82B267BE4976570CF44007BF50067AF1D77CB840C76E

Function 004730AC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,00000000,00000000,0047327D,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639), ref: 00473259
FindClose.KERNEL32(000000FF,00473284,0047327D,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639,?), ref: 00473277
FindNextFileA.KERNEL32(000000FF,00000000,00000000,0047339F,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639), ref: 0047337B
FindClose.KERNEL32(000000FF,004733A6,0047339F,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639,?), ref: 00473399

Strings

I, xrefs: 004730E9, 00473123, 004732E0

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: I
API String ID: 2066263336-1966777607
Opcode ID: d4d7e8d001aaa933d1d05ce32bbe3e9e4fe33d6a0cd41b5605a577a7fb716996
Instruction ID: 1af051264105f0c3ac5173717805306f181c97d1b343904b0a5707565e1f6f82
Opcode Fuzzy Hash: d4d7e8d001aaa933d1d05ce32bbe3e9e4fe33d6a0cd41b5605a577a7fb716996
Instruction Fuzzy Hash: F2C13C7490425DAFCF11DFA5C881ADEBBB9FF49304F5081AAE808A3351D7399A46CF54

Function 00455E74 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045600B,?,00000000,0045604B), ref: 00455F51

Strings

PendingFileRenameOperations, xrefs: 00455EF0
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455ED4
WININIT.INI, xrefs: 00455F80
PendingFileRenameOperations2, xrefs: 00455F20

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 8be7122c243ce20522057dc2e2531da27295be9a62d17f0d53ccadd57aa7aa50
Instruction ID: cd3286cbb97796e9ecd700c4ab963dac99c65abdd87cbf21601b40f17af9d083
Opcode Fuzzy Hash: 8be7122c243ce20522057dc2e2531da27295be9a62d17f0d53ccadd57aa7aa50
Instruction Fuzzy Hash: 1551B930E001089FDB11EF61DC51ADEB7B9EF44705F5085BBE804A72D2DB39AE45CA58

Function 0047DEA0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047DFF6,?,?,00000000,0049D62C,00000000,00000000,?,00499E21,00000000,00499FCA,?,00000000), ref: 0047DF33
GetLastError.KERNEL32(00000000,00000000,00000000,0047DFF6,?,?,00000000,0049D62C,00000000,00000000,?,00499E21,00000000,00499FCA,?,00000000), ref: 0047DF3C

Strings

\_setup64.tmp, xrefs: 0047DFAE
Created temporary directory: , xrefs: 0047DED5
_isetup, xrefs: 0047DF1E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 11c41cff4b2e26d29b59e317b5d01f68a09a239768e9d902b03435ecaad13ccb
Instruction ID: ecaa8d991a706e785fb0a456308ec2ceb04ba6e672c042181299f5b248b5f278
Opcode Fuzzy Hash: 11c41cff4b2e26d29b59e317b5d01f68a09a239768e9d902b03435ecaad13ccb
Instruction Fuzzy Hash: A2414634A101099BCB01EF95DC81ADEB7B9EF44309F50847BE901B7392DB38AE05CB69

Function 004587F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458824
GetExitCodeProcess.KERNEL32(?,?), ref: 00458845
CloseHandle.KERNEL32(?,00458878), ref: 0045886B

Strings

MsgWaitForMultipleObjects, xrefs: 00458831
GetExitCodeProcess, xrefs: 0045884E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: ccb40889def51a45099d1ba5ac8691cf64062e15bbead1c0493d0fc1e541217c
Instruction ID: 4c05e8df3edacc9d455a33c3a45c96e3e51f685ffe720196e50d624f784124f1
Opcode Fuzzy Hash: ccb40889def51a45099d1ba5ac8691cf64062e15bbead1c0493d0fc1e541217c
Instruction Fuzzy Hash: 3E01A274A00204AFDB10FBA98C52A1E73A8EB45715FA0057AFD10F73D2DE39AD048A28

Function 0042E294 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042E2A0
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042E43B,00000000,0042E453,?,?,?,?,00000006,?,00000000,00499145), ref: 0042E2BB
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E2C1

Strings

advapi32.dll, xrefs: 0042E2B6
RegDeleteKeyExA, xrefs: 0042E2B1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ec6d5e68239a8fd64e2f61c23397c604527ea817bc29ae7d62183104243c5598
Instruction ID: a3ecee3a08e4bdafa542c89306e26d0a5ab5c090d3d5ae483566a3001d088d92
Opcode Fuzzy Hash: ec6d5e68239a8fd64e2f61c23397c604527ea817bc29ae7d62183104243c5598
Instruction Fuzzy Hash: B8E065B0740234EAD7142A66BC4AFA7260CEB54726F940877F10A661D187BC1C40D66C

Function 0046C7D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

Need to restart Windows? %s, xrefs: 0046CB55
NextButtonClick, xrefs: 0046C90C
PrepareToInstall failed: %s, xrefs: 0046CB2E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: d87af4896cb793d083c2bc30ee3769ba6e3254b9113bfc88e0628799f0af0af8
Instruction ID: 93777efb9077a0228fe374709ad1741880755db4a3f7640889f56f3bdeecc4c5
Opcode Fuzzy Hash: d87af4896cb793d083c2bc30ee3769ba6e3254b9113bfc88e0628799f0af0af8
Instruction Fuzzy Hash: 9CD17F34A00108DFCB10EFA9C585AED7BF5EF49304F6444BAE444AB352E738AE45DB5A

Function 00484470 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,004847C1), ref: 00484594
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00484632

Strings

, xrefs: 004846EF
Need to restart Windows? %s, xrefs: 0048466F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: dca023eaf0adf91f688e90e7278f8f3d4603c071aacc431b0939a1ba66e08d33
Instruction ID: cbf7044c9224e5df34f4324165486d78489046a6efa1a602e4c0c9b5677eb74d
Opcode Fuzzy Hash: dca023eaf0adf91f688e90e7278f8f3d4603c071aacc431b0939a1ba66e08d33
Instruction Fuzzy Hash: C591A334A042459FDB10FB66D885B9D77E0AF5A308F1444BBE800973A2D77CAD45CB5E

Function 00454868 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00454AAE,?,00000000,00454B22,?,?,-00000001,00000000,?,0047E107,00000000,0047E054,00000000), ref: 00454A8A
FindClose.KERNEL32(000000FF,00454AB5,00454AAE,?,00000000,00454B22,?,?,-00000001,00000000,?,0047E107,00000000,0047E054,00000000,00000000), ref: 00454AA8

Strings

.H, xrefs: 00454B14, 004548F1, 00454902, 004548D4
.H, xrefs: 00454AB5, 00454A2F, 00454A32

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: .H$ .H
API String ID: 2066263336-1676226347
Opcode ID: ff4ed68c57a0d298832a8e289a05f0a49072924424f8e3e4963c38c144bad6ce
Instruction ID: 86a97b531f1ad2b4b7463d4220b8e0547854eedc1a857b6a9afda59406c2b972
Opcode Fuzzy Hash: ff4ed68c57a0d298832a8e289a05f0a49072924424f8e3e4963c38c144bad6ce
Instruction Fuzzy Hash: CF81A43490428DAFCF11DF65C8417EFBBB4AF89309F1440A6D8546B392C3399E8ACB58

Function 00470938 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042CC54: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CC78

GetLastError.KERNEL32(00000000,00470B35,?,?,0049E1E4,00000000), ref: 00470A12
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00470A8C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00470AB1

Strings

Creating directory: %s, xrefs: 004709FA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 491f8044cdd55bca13a915365ddaeeb7f1710c9c03b2f754f829ba70678f95d0
Instruction ID: 27f0dcb835b35bf1686b0556d16ec1317b7bae4cbab61287d01ee882f408922b
Opcode Fuzzy Hash: 491f8044cdd55bca13a915365ddaeeb7f1710c9c03b2f754f829ba70678f95d0
Instruction Fuzzy Hash: 0251FE74E01248ABDB01DFA5C982BDEB7F5AF48308F50856AE844B7382D7785F04CB59

Function 0045553C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 004555EA
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,004556B0), ref: 00455654

Strings

sfc.dll, xrefs: 004555AC
SfcIsFileProtected, xrefs: 004555E4

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: f7e58a0fd106200e4f3bc04200b2cacc58717943215cb6059fe45d01fbc32bb5
Instruction ID: f46810b5b314b431af4f43299c3fabe32507941823b9175d405aae5aeba4d308
Opcode Fuzzy Hash: f7e58a0fd106200e4f3bc04200b2cacc58717943215cb6059fe45d01fbc32bb5
Instruction Fuzzy Hash: 9141A470A00618AFEB20DF55DC95BAD77B8AB04319F5080B7E90CA7292D7789F48CE1D

Function 00452C54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D31520.VERSION(00000000,?,?,?,?), ref: 00452C74
74D31500.VERSION(00000000,?,00000000,?,00000000,00452CEF,?,00000000,?,?,?,?), ref: 00452CA1
74D31540.VERSION(?,00452D18,?,?,00000000,?,00000000,?,00000000,00452CEF,?,00000000,?,?,?,?), ref: 00452CBB

Strings

)-E, xrefs: 00452CFF, 00452CC7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: D31500D31520D31540
String ID: )-E
API String ID: 1003763464-3997256589
Opcode ID: 1e3fa64680b4daa2d15fd70f35a4d6916cc241641b57064dc1621c371eabb0d9
Instruction ID: 50707f88950aac898d8c4389756beb7c92bb5193b179b1fc1fca76f0aa7be7f8
Opcode Fuzzy Hash: 1e3fa64680b4daa2d15fd70f35a4d6916cc241641b57064dc1621c371eabb0d9
Instruction Fuzzy Hash: 2B219275A00648AFDB01DAA99D419AFB7FCEB4A301F554077FC00E3282D6B99E088769

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 6146da9580bef9965da9cda28fdf8b1f09917d9546c5f1af2fde060953d626be
Instruction ID: c00c8b1b907268fe45c84c5108a6570d36dd98a08fca56cdb76ff5d345661702
Opcode Fuzzy Hash: 6146da9580bef9965da9cda28fdf8b1f09917d9546c5f1af2fde060953d626be
Instruction Fuzzy Hash: 8F21D360E452418ADB10AB75ED8171A3B8097F930CF04817BE700B73E2C67CD84687AE

Function 00450390 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00450469,?,?,?,?,00000000,00000000), ref: 004503F8
LoadLibraryA.KERNEL32(00000000,00000000,00450469,?,?,?,?,00000000,00000000), ref: 0045043E

Part of subcall function 00450360: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00450378

Strings

RICHED20.DLL, xrefs: 004503E5
RICHED32.DLL, xrefs: 0045042B

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: LibraryLoad$DirectorySystem
String ID: RICHED20.DLL$RICHED32.DLL
API String ID: 2630572097-740611112
Opcode ID: 9fcc27b6184eb67fa55648afaa4eab07c2ec715cb05f6099bae96d6f0231ec87
Instruction ID: 45d93e0d121fe09c7a50066aca23a685df4873c559958f5edeb39e7b45036801
Opcode Fuzzy Hash: 9fcc27b6184eb67fa55648afaa4eab07c2ec715cb05f6099bae96d6f0231ec87
Instruction Fuzzy Hash: EB216374900108EFDB10FF61E846B5D77F8EB55319F50447BE500A6162D7785A49CF5C

Function 0042F188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042F201

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042F1E4

Strings

SHAutoComplete, xrefs: 0042F1DE
shlwapi.dll, xrefs: 0042F1C1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: ef2fe5795da2c79bebcfc8bc045bc88b8cffcc678c25b10b165038ef52182f9f
Instruction ID: f8fd25663858203a515409cfb2833324ac242db414aae85ffba9c986139a78a3
Opcode Fuzzy Hash: ef2fe5795da2c79bebcfc8bc045bc88b8cffcc678c25b10b165038ef52182f9f
Instruction Fuzzy Hash: 9701D274B00718EBE711DB65EC42B5E7BFCDB99704FE000B7B404A2291DAB99E48C62C

Function 004561AC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,00456217,?,00000001,00000000), ref: 0045620A

Strings

PendingFileRenameOperations, xrefs: 004561DC
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004561B8
PendingFileRenameOperations2, xrefs: 004561EB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 26aed6e5fe3ea03506abb76c46215ae559a4fd81786fee60218c8c29e953e84b
Instruction ID: 13f9a8dc2762523c9d5034016e8e0e4cf56d15ba7b570f5b98feacd54ef34b89
Opcode Fuzzy Hash: 26aed6e5fe3ea03506abb76c46215ae559a4fd81786fee60218c8c29e953e84b
Instruction Fuzzy Hash: F2F06271348204ABD714E6E69C13B5B739CD784B15FE284A6F80487982EA79AD14962C

Function 0046FC5C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,VtG,?,0049E1E4,?,0046FF73,?,00000000,00470532,?,_is1), ref: 0046FC7F

Strings

Inno Setup: Setup Version, xrefs: 0046FC7D
I, xrefs: 0046FC89, 0046FC8F
VtG, xrefs: 0046FC61

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version$VtG$I
API String ID: 3702945584-29442299
Opcode ID: 5dcffb009f333844a0907ea62aeb66fd755f698b1ccd3361f3efdca3959d7f8d
Instruction ID: 298cf4f1533d54ab550fd3d15e19e6a926ba71f9f01c0afe6301adb1283b93e4
Opcode Fuzzy Hash: 5dcffb009f333844a0907ea62aeb66fd755f698b1ccd3361f3efdca3959d7f8d
Instruction Fuzzy Hash: E7E06D713013043BD710AA2BAC85F5BAADCDF987A5F00403AB948DB392D578ED0542A8

Function 00481008 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,00481201), ref: 004810AE
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,00481201), ref: 004810BB
FindNextFileA.KERNEL32(000000FF,?,00000000,004811D4,?,?,?,?,00000000,00481201), ref: 004811B0
FindClose.KERNEL32(000000FF,004811DB,004811D4,?,?,?,?,00000000,00481201), ref: 004811CE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 63da60fc703e6e8aa7dcaf1f4a84ca4d1db4635fe8be35313377f08196bdfc45
Instruction ID: 32ce0b593b226a8a495a7b16ec3f8c392e3281c2b0d16565a73bd1b48714ff7d
Opcode Fuzzy Hash: 63da60fc703e6e8aa7dcaf1f4a84ca4d1db4635fe8be35313377f08196bdfc45
Instruction Fuzzy Hash: 95515E75A006489FCB10EF65CC45ADEB7BCEB89315F1045ABA808E7351D6389F86CF58

Function 004216C4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004217B1
SetMenu.USER32(00000000,00000000), ref: 004217CE
SetMenu.USER32(00000000,00000000), ref: 00421803
SetMenu.USER32(00000000,00000000), ref: 0042181F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: a1d2f4484655de1d3fd0847b2328f430e3f40ab88dcc203f2c43afec94015a70
Instruction ID: 73b485f7b17ee0b128820b03b0310e3fef403fa1ec291b42cca88d6787b8c394
Opcode Fuzzy Hash: a1d2f4484655de1d3fd0847b2328f430e3f40ab88dcc203f2c43afec94015a70
Instruction Fuzzy Hash: 44419E3070426407DB21BF3AA98579B66D55FA0308F4811BFE8458F3A3CA7CCC4A82AD

Function 00417668 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004176B0
SetCursor.USER32(00000000), ref: 004176F3
GetLastActivePopup.USER32(?), ref: 0041771D
GetForegroundWindow.USER32(?), ref: 00417724

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 6c3ac19022b264060b45d73ebcd70729185e734ffe6bab55d55db2cfe9612f2c
Instruction ID: dbcb3e4d6cdf237ebd373b45723c7518e1d79ef9827cdcdbbe1e0fb97faef126
Opcode Fuzzy Hash: 6c3ac19022b264060b45d73ebcd70729185e734ffe6bab55d55db2cfe9612f2c
Instruction Fuzzy Hash: 8121CF303086018BC710EF29D980ADB73B1AB44768F52447BE8688B392D73DEC81CA8D

Function 00416F92 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416FD4
SetTextColor.GDI32(?,00000000), ref: 00416FEE
SetBkColor.GDI32(?,00000000), ref: 00417008
CallWindowProcA.USER32(?,?,?,?,?), ref: 00417030

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 2663e636a10a516644b319dd38bd24ec26a11bbb7cdbebd148a82c02926d9cca
Instruction ID: 97657bf4431c68cea31458eff6611b8cbcc4ca9acdd3171e17da9912607f4e93
Opcode Fuzzy Hash: 2663e636a10a516644b319dd38bd24ec26a11bbb7cdbebd148a82c02926d9cca
Instruction Fuzzy Hash: CE114CB1604600AFD710EE6ECD84E87B7ECDF48310B14882AB55ADB612C62CE8818B69

Function 00423ED4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423E6C), ref: 00423EF8
GetWindow.USER32(?,00000003), ref: 00423F0D
GetWindowLongA.USER32(?,000000EC), ref: 00423F1C
SetWindowPos.USER32(00000000,004245AC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004245FB,?,?,004241C3), ref: 00423F52

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: da7c6a1f1adb1243b5fa3636d4e877867cfe7b0e5d1887425f7f41af5dac74a2
Instruction ID: 800f3c7d6b650a9444741cf3b456662361ea129bec99247a5177c247b1bc03b7
Opcode Fuzzy Hash: da7c6a1f1adb1243b5fa3636d4e877867cfe7b0e5d1887425f7f41af5dac74a2
Instruction Fuzzy Hash: 5B117071B04610ABDB109F28ED85F5673F4EB08715F12026AF9649B2E2C37CDD40CB58

Function 00423518 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042356E
EnumFontsA.GDI32(00000000,00000000,004234B8,004108B0,00000000,?,?,00000000,?,00419423,00000000,?,?,?,00000001), ref: 00423581
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423589
ReleaseDC.USER32(00000000,00000000), ref: 00423594

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: bb643e78eddffdc26f40f16d9b8672dcc85dc1c54bcbb46a45d6df83db9bb269
Instruction ID: 3e91f746c00fb2f600ae5fc17e333cd129bb14a9c5a67b8d5949c9a763c02f3d
Opcode Fuzzy Hash: bb643e78eddffdc26f40f16d9b8672dcc85dc1c54bcbb46a45d6df83db9bb269
Instruction Fuzzy Hash: 5C019EB17457102AE710BF6A5C82B9B37A49F0531DF40427FF908AB3C2DA7E990547AE

Function 004556E4 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00455710
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00455732
GetExitCodeProcess.KERNEL32(?,?), ref: 00455741
CloseHandle.KERNEL32(?,0045576E,00455767,?,?,?,00000000,?,?,00455943,?,?,?,00000044,00000000,00000000), ref: 00455761

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: bfad4d0898bb7f7b4d6d935c7a94a0bc97643fabf39fe06bc783b945b7084efc
Instruction ID: d914ecb4f604d225e93de076450c6742835d04a0b91abb11bcb899d5d614385b
Opcode Fuzzy Hash: bfad4d0898bb7f7b4d6d935c7a94a0bc97643fabf39fe06bc783b945b7084efc
Instruction Fuzzy Hash: 6101B570A40A09FEEB20A7A58D16F7F7BADDB49760F610167F904D32C2C6789D00CA68

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049D420,0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049D420,00401A89,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 6924fe21b1383dcef356c9aa5819c214f6a77f33e1d4e548cd75cfb9fc70e511
Instruction ID: 7339f3ebbe1eed2a5a633cb922c09bf0bd68a71b88021a6e55e3f3fb74b7268e
Opcode Fuzzy Hash: 6924fe21b1383dcef356c9aa5819c214f6a77f33e1d4e548cd75cfb9fc70e511
Instruction Fuzzy Hash: AB01CCB0E482405EFB19AF699902B293FD4D799748F51803BF441A7AF1CA7C6840CB2E

Function 0047E054 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047E075
GetLastError.KERNEL32 ref: 0047E07F
GetTickCount.KERNEL32 ref: 0047E089
Sleep.KERNEL32(00000032), ref: 0047E099

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 22ddb9d6ab121fa8b7aad317e9abd2d9173961abc661a66fb327fe759d7b9ec5
Instruction ID: 9be5390d37519caeffefa09d8943b7800c28e667e42796fceef54f4227176e6c
Opcode Fuzzy Hash: 22ddb9d6ab121fa8b7aad317e9abd2d9173961abc661a66fb327fe759d7b9ec5
Instruction Fuzzy Hash: 28E0E5213092A855C63035BB58C26AF45C9DA89768B244ABFE088D6283C89C4C05652E

Function 0045CA60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00451070: SetEndOfFile.KERNEL32(?,?,0045CB3E,00000000,0045CCC9,?,00000000,00000002,00000002), ref: 00451077

FlushFileBuffers.KERNEL32(?), ref: 0045CC95

Strings

EndOffset range exceeded, xrefs: 0045CBC9
NumRecs range exceeded, xrefs: 0045CB92

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 69559d5369597ea91ae9cee70a3000ef17ba892e4adcf601713595c8f1485f33
Instruction ID: 609741d3f79eabe780872f94ce4b5bf90fe53003262008b9b2f446b63576a9fa
Opcode Fuzzy Hash: 69559d5369597ea91ae9cee70a3000ef17ba892e4adcf601713595c8f1485f33
Instruction Fuzzy Hash: 6E615234A002588FDB25DF25D881BDAB7B5EF49305F0084DAED899B352D6B4AEC8CF54

Function 00484978 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00484B02,?,00000000,00484B43,?,?,?,?,00000000,00000000,00000000,?,0046CA59), ref: 004849B1
SetActiveWindow.USER32(?,00000000,00484B02,?,00000000,00484B43,?,?,?,?,00000000,00000000,00000000,?,0046CA59), ref: 004849C3

Strings

Will not restart Windows automatically., xrefs: 00484AE2

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: e9fd9b813b1150c3656dd19ef81cb097417f0f4d1130d5c98022cf40aa9a9c5d
Instruction ID: e3ffbfa0a86cb08642d5b37a1a1eca219a4b332c0ee086946791bcc458de558f
Opcode Fuzzy Hash: e9fd9b813b1150c3656dd19ef81cb097417f0f4d1130d5c98022cf40aa9a9c5d
Instruction Fuzzy Hash: 64415930644245EFD714FFA6EC05B6E7BE4D795308F1948B7E8405B392E2BC9800971E

Function 0049A490 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,0049A49E), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,0049A49E), ref: 00403356

Part of subcall function 004063F4: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 0040640F
Part of subcall function 004063F4: GetVersion.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 00406416
Part of subcall function 004063F4: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040642B
Part of subcall function 004063F4: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00406453

Part of subcall function 00406814: 6F541CD0.COMCTL32(0049A4AD), ref: 00406814

Part of subcall function 00410BB4: GetCurrentThreadId.KERNEL32 ref: 00410C02

Part of subcall function 00419490: GetVersion.KERNEL32(0049A4C6), ref: 00419490

Part of subcall function 0044FD1C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049A4DA), ref: 0044FD57
Part of subcall function 0044FD1C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044FD5D

Part of subcall function 004501E8: GetVersionExA.KERNEL32(0049D794,0049A4DF), ref: 004501F7

Part of subcall function 00453934: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453956
Part of subcall function 00453934: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045395C
Part of subcall function 00453934: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453970
Part of subcall function 00453934: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453976

Part of subcall function 00457850: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004578AA

Part of subcall function 00465214: LoadLibraryA.KERNEL32(00000000,SHPathPrepareForWriteA,00000000,0046528A,?,?,?,?,00000000,00000000,?,0049A502), ref: 0046525F
Part of subcall function 00465214: GetProcAddress.KERNEL32(00000000,00000000), ref: 00465265

Part of subcall function 0046DAB0: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046DAFB

Part of subcall function 00479E68: GetModuleHandleA.KERNEL32(kernel32.dll,?,0049A50C), ref: 00479E6E
Part of subcall function 00479E68: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00479E7B
Part of subcall function 00479E68: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00479E8B

Part of subcall function 00485374: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00485485

Part of subcall function 0049749C: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 004974B5

SetErrorMode.KERNEL32(00000001,00000000,0049A554), ref: 0049A526

Part of subcall function 0049A250: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049A530,00000001,00000000,0049A554), ref: 0049A25A
Part of subcall function 0049A250: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049A260

Part of subcall function 00424924: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424943

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

ShowWindow.USER32(?,00000005,00000000,0049A554), ref: 0049A587

Part of subcall function 004839B4: SetActiveWindow.USER32(?), ref: 00483A62

Strings

Setup, xrefs: 0049A56D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleModule$VersionWindow$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 1137645576-3839654196
Opcode ID: cdfde2e51fe0698aa6b85e30c0a1c237bbea7d7fd99d79f8e074734ecee56c62
Instruction ID: 2627a5300f3eb19f067de96b875d46ae0be93d5911e26a22e66c9acfb87dca20
Opcode Fuzzy Hash: cdfde2e51fe0698aa6b85e30c0a1c237bbea7d7fd99d79f8e074734ecee56c62
Instruction Fuzzy Hash: AA31B3712046409EDB01BBB7AC1391D3BA8EB8971CB62487FF90486563DE3D5C24867F

Function 0047A0E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,0047A1C6,?,?,00000001,00000000,00000000,0047A1E1), ref: 0047A1AF

Strings

%s\%s_is1, xrefs: 0047A158
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0047A13A

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: ed3c9ed544e9992b8fac624f4914d5ae006c7f9a390fec7504e0c8a2c970f41f
Instruction ID: 0d63d1a050f55a8da938840af3d9f6bfa62d29ba12cdbe4796c61ae60ad15f2e
Opcode Fuzzy Hash: ed3c9ed544e9992b8fac624f4914d5ae006c7f9a390fec7504e0c8a2c970f41f
Instruction Fuzzy Hash: 8E216474B042449FEB01DFA9CC516EEBBF8EB89704F90847AE404E7381D7789E158B59

Function 0045418C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0045427B,?,?,00000000,0049D62C,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004541D2
GetLastError.KERNEL32(00000000,00000000,?,00000000,0045427B,?,?,00000000,0049D62C,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004541DB

Strings

.tmp, xrefs: 004541BB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 6f4460bb771477b2532cc418dcf8c2749320d1c4241bb26b34006b525e4e1938
Instruction ID: f8da180511d522ff1cc3db6e91f047bd7ddaecfb92c8c1642a91e8309ff3a61b
Opcode Fuzzy Hash: 6f4460bb771477b2532cc418dcf8c2749320d1c4241bb26b34006b525e4e1938
Instruction Fuzzy Hash: 19214E75A002189BDB01EFA1C8465DEB7BDEF44305F50457BF801B7382D67C5E458BA9

Function 00485374 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00484E68: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00484E79
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00484E86
Part of subcall function 00484E68: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484E94
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00484E9C
Part of subcall function 00484E68: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00484EA8
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00484EC9
Part of subcall function 00484E68: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00484EDC
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00484EE2

Part of subcall function 00485194: GetVersionExA.KERNEL32(?,004853AA,00000000,004854AA,?,?,?,?,00000000,00000000,?,0049A511), ref: 004851A2
Part of subcall function 00485194: GetVersionExA.KERNEL32(0000009C,?,004853AA,00000000,004854AA,?,?,?,?,00000000,00000000,?,0049A511), ref: 004851F4

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00485485

Strings

SHGetKnownFolderPath, xrefs: 00485452
shell32.dll, xrefs: 0048546D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleModuleSystemVersion$CurrentDirectoryErrorInfoLibraryLoadModeNativeProcess
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 1303913335-2936008475
Opcode ID: 8d9af6f5cb47815f3ef02b670df531d4aca205f4dd503ff5ab0741a2b0aad5e0
Instruction ID: 7070cd684f6103364e9f8a31a7d8965128adaac247882cc77746aeeddc076857
Opcode Fuzzy Hash: 8d9af6f5cb47815f3ef02b670df531d4aca205f4dd503ff5ab0741a2b0aad5e0
Instruction Fuzzy Hash: F9215E70600200ABC711FFAF995674E37A4EB9570CB51993FF400AB2D1D77DA8059B6E

Function 0045304C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,004530A9,?,-00000001,?), ref: 00453083
GetLastError.KERNEL32(00000000,00000000,004530A9,?,-00000001,?), ref: 0045308B

Strings

@8H, xrefs: 004530B9

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: @8H
API String ID: 2018770650-3762495883
Opcode ID: a1fb3666b45fe32249cf4b68f1752c0b17d8b18f48336da527a90bea16c05efb
Instruction ID: 483a50349848f844724b37c9089874c2f5155cc8dca7ffd3c90c1c5b4081c312
Opcode Fuzzy Hash: a1fb3666b45fe32249cf4b68f1752c0b17d8b18f48336da527a90bea16c05efb
Instruction Fuzzy Hash: 74F0C871A04708AFCB01DFB9AC4249EB7ECDB0975675045B7FC04E3282EB785F188599

Function 00453554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,004535B1,?,-00000001,00000000), ref: 0045358B
GetLastError.KERNEL32(00000000,00000000,004535B1,?,-00000001,00000000), ref: 00453593

Strings

@8H, xrefs: 004535C1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID: @8H
API String ID: 377330604-3762495883
Opcode ID: ed9ee3e2dc24464d0c236720d007919d28e5762e289691b171a35ab4808c6178
Instruction ID: 7fd71ab76445d730fbf8dcc8275d2678ef65a3f2b88ec35f2c7a4b5c8e56db9b
Opcode Fuzzy Hash: ed9ee3e2dc24464d0c236720d007919d28e5762e289691b171a35ab4808c6178
Instruction Fuzzy Hash: B2F0C271A04608BBCB01EFB9AC4249EB7E8EB0975675049BBFC04E3242F7785F088598

Function 00457850 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004577E0: CoInitialize.OLE32(00000000), ref: 004577E6

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004578AA

Strings

SHCreateItemFromParsingName, xrefs: 00457877
shell32.dll, xrefs: 00457892

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressDirectoryErrorInitializeLibraryLoadModeProcSystem
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 1013667774-2320870614
Opcode ID: f768b6972bd4a9b7486ce10d9acfcd5e81d127b13faf4c2cc7ed9affc27adf63
Instruction ID: 9566a5db5de29e1f96e1247fa15de811f0c6c8f84fbefe9709ba2c3b4718617c
Opcode Fuzzy Hash: f768b6972bd4a9b7486ce10d9acfcd5e81d127b13faf4c2cc7ed9affc27adf63
Instruction Fuzzy Hash: 4DF03670604608BBE701FBA6E842F5D7BACDB45759F604477B800A6592D67CAE04C92D

Function 0046DAB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046DAFB

Strings

shell32.dll, xrefs: 0046DAE3
SHPathPrepareForWriteA, xrefs: 0046DAC8

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressDirectoryErrorLibraryLoadModeProcSystem
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2552568031-2683653824
Opcode ID: d5f4c7af768d16b3b5c6a86f87ef45a876fa3cc5c322967070caf22bd86c78e1
Instruction ID: 91b75a77547c13e1772f921c750cf7bd45708da1ec0dc58a0f4cb33c0377533c
Opcode Fuzzy Hash: d5f4c7af768d16b3b5c6a86f87ef45a876fa3cc5c322967070caf22bd86c78e1
Instruction Fuzzy Hash: B5F04430B04608BBD700EF52DC52F5DBBACEB45B14FA14076B40067595E678AE048A2D

Function 0047D8E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047DC36,00000000,0047DC4C), ref: 0047D946

Strings

RegisteredOrganization, xrefs: 0047D935
RegisteredOwner, xrefs: 0047D923

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: d4927c1d3794e351f7864a9843da2db15e63a7a3432c113007369929f19e5816
Instruction ID: 03cfcff152a519ea80d4f5543ba1c5a79f91faf414c5488bd5ec988fdc31f9f9
Opcode Fuzzy Hash: d4927c1d3794e351f7864a9843da2db15e63a7a3432c113007369929f19e5816
Instruction Fuzzy Hash: B6F0BBB0B042449BDB04D667AC93BDB37B9CB41308F24847BA2459B392D67C9D00D75D

Function 004763E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047661B), ref: 00476409
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047661B), ref: 00476420

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

CreateFile, xrefs: 00476415

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: dfe37b7c2a5045629fd8e0b2a77d405f8cad1a2ae405d18a87ba2f0597c9e29b
Instruction ID: 7bcc5fcb2fff494360280e2963ad1350d0a4ff74aab44489db68ce07f01780cc
Opcode Fuzzy Hash: dfe37b7c2a5045629fd8e0b2a77d405f8cad1a2ae405d18a87ba2f0597c9e29b
Instruction Fuzzy Hash: CDE06D302403447BEA20EB69DCC6F4A77D89B04738F108161FA48AF3E2C6B9EC408A5C

Function 0046FCCC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0047034A,?,?,00000000,00470532,?,_is1,?), ref: 0046FCDF

Strings

I, xrefs: 0046FCE9, 0046FCEF
NoModify, xrefs: 0046FCDD

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Value
String ID: NoModify$I
API String ID: 3702945584-1047506205
Opcode ID: a9350f4946b76da1c4589c44166ab03b9a024603b137e61cab75a19685011d2b
Instruction ID: 74656710be1799963dacf24c43606be2f52e229709c8467fcc2139d849b5a3c3
Opcode Fuzzy Hash: a9350f4946b76da1c4589c44166ab03b9a024603b137e61cab75a19685011d2b
Instruction Fuzzy Hash: 1AE04FB0640308BFEB04DB55DD4AF6BB7ACDB48750F104059BA44DB381EA74FE008658

Function 00483068 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,004831A0), ref: 00483138
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00483149
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00483161

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: b1581a0f06f3993262020228058a878573e1761b052ad4db3e08fed4fbd829c7
Instruction ID: 62bbcf7b8eda1c1d1fe504de26200215c04982407344b62899e0b3f82f18d8db
Opcode Fuzzy Hash: b1581a0f06f3993262020228058a878573e1761b052ad4db3e08fed4fbd829c7
Instruction Fuzzy Hash: 6431B0707083445AD710FF368C86B9E7A945B55B08F44593FB9009B3E3CA7D9E09876D

Function 0044B82C Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B8A1
SelectObject.GDI32(?,00000000), ref: 0044B8C4
ReleaseDC.USER32(00000000,?), ref: 0044B8F7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID:
API String ID: 1831053106-0
Opcode ID: aebefea9080a2ffce71cc44d900bb6067fbd40711943de4e6aa6f899a124bbe5
Instruction ID: 488fbe92d3dbd6553530e1f28a7071e145c326c324a604cd7e83169de99d3e99
Opcode Fuzzy Hash: aebefea9080a2ffce71cc44d900bb6067fbd40711943de4e6aa6f899a124bbe5
Instruction Fuzzy Hash: B321A470E043086FEB05EFA5C841B9EBBB8EB48304F0184BAF504A6292D73CD940CB58

Function 0044B560 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B5EC,?,004839CF,?,?), ref: 0044B5BE
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B5D1
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B605

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 220ba5cac8d50b27136c7947ff428b4d5b30f8bb344e0136b885afe7086c5f85
Instruction ID: c4c5e2dbcf53f363daa0ac06871d419456bbfc1076f0fbe0a6f7c1d9791685bd
Opcode Fuzzy Hash: 220ba5cac8d50b27136c7947ff428b4d5b30f8bb344e0136b885afe7086c5f85
Instruction Fuzzy Hash: 1011CBB27045047FE711DB5A9C81D6FB7ECEB89714F10417BF514D72D0D6389E018669

Function 0042484C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424862
TranslateMessage.USER32(?), ref: 004248DF
DispatchMessageA.USER32(?), ref: 004248E9

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 1d5f45652bc976909b78a8fda5e55899e4ac3f100e933d79a059951e0026f3ac
Instruction ID: c7af1bd1b10d32b98fa997e15213bd70182e4a6faef26a56c53dd2d0e562e7a0
Opcode Fuzzy Hash: 1d5f45652bc976909b78a8fda5e55899e4ac3f100e933d79a059951e0026f3ac
Instruction Fuzzy Hash: 7111C4343143905AEA20F664A94179B73D4DFD1B04F81481FF8D947382D3BD9D49876B

Function 00416A94 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 00416ABA
SetPropA.USER32(00000000,00000000), ref: 00416ACF
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416AF6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 120d831fd0e7c0f5eedd88e24305ab6ef8b5e2b9243d669fe5121d0f27645725
Instruction ID: ba7ff3a79511e9fd345c6eb2e7309737472e1a66b8435aad7f351e84ed883601
Opcode Fuzzy Hash: 120d831fd0e7c0f5eedd88e24305ab6ef8b5e2b9243d669fe5121d0f27645725
Instruction Fuzzy Hash: 24F0B271701210ABD710AB698C85FA636ECAF0D755F16417ABA05EF286C679DC4087A8

Function 0041F2A4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041F2B4
IsWindowEnabled.USER32(?), ref: 0041F2BE
EnableWindow.USER32(?,00000000), ref: 0041F2E4

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: f8c63cb9eb03fe3057432f7fc847cbb230a844cb3caf0d06e376941515be7c19
Instruction ID: f88b3158499dd9289c75302ad3040ea965d59b676cda83e5cbf87f6be83bac28
Opcode Fuzzy Hash: f8c63cb9eb03fe3057432f7fc847cbb230a844cb3caf0d06e376941515be7c19
Instruction Fuzzy Hash: 56E06D74200200ABE310AB26ED81A56779CEB10314F118437A849AB293D63AD8458ABC

Function 00484808 Relevance: 4.5, APIs: 3, Instructions: 25threadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,?,?,0048486D,?,00484952,?,?,00000000), ref: 0048480E
GetWindowThreadProcessId.USER32(00000000,?), ref: 00484820
GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,0048486D,?,00484952,?,?,00000000), ref: 00484829

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ProcessWindow$CurrentForegroundThread
String ID:
API String ID: 3477312055-0
Opcode ID: 9f51dd0a086dfbcb1114822517b22dcc69f79606d1d2df2038485f7abb79e1d8
Instruction ID: 1f5535e564554d04b279d15e2d0f53a7c3fa56dd59ea92930bb6cd4aac111565
Opcode Fuzzy Hash: 9f51dd0a086dfbcb1114822517b22dcc69f79606d1d2df2038485f7abb79e1d8
Instruction Fuzzy Hash: 79D01273506A2A7E6610F5E96D81CAFB39CD900758714017BF904A2241EA299E0486BD

Function 0046ABA0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046ACB1

Strings

PrepareToInstall, xrefs: 0046AC5B, 0046AD02

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: af0ab7a5ac2ffeb14c41136b45c350a31b01809bc414c92ed106cebc834d7d8e
Instruction ID: fdee18710babf5e336c1910aeb408bf0e6a903f892d838ad66a8bf575b9628a0
Opcode Fuzzy Hash: af0ab7a5ac2ffeb14c41136b45c350a31b01809bc414c92ed106cebc834d7d8e
Instruction Fuzzy Hash: 90A10C74A00109DFCB00EF99D886E9EB7F5AF48304F5540B6E404AB366D738AE45DB5A

Function 0046D17C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046D318, 0046D32F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: ceb3f76dddb8c4f3c05b9d1c15b0c50ece1c75124130fc1418fa8c0e44e40a18
Instruction ID: f677315d7a897bddb44220e636167c4a4d5a92338f94b0a6c85659efeb8beb4e
Opcode Fuzzy Hash: ceb3f76dddb8c4f3c05b9d1c15b0c50ece1c75124130fc1418fa8c0e44e40a18
Instruction Fuzzy Hash: 95719770F04208ABDB10EB66DC92F9E77A15B41308F1480A7F900BB392E6B99D45875F

Function 004839B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00483A62

Strings

InitializeWizard, xrefs: 004839FB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 99c9fb0f11c91144e7e22f4d3c3796febd7f25dc99ff7cc832fb776fe257691d
Instruction ID: 9a8fbe648e99d25b3c1ebd2b051959da3f81131ff902f8f70686133b91dd172c
Opcode Fuzzy Hash: 99c9fb0f11c91144e7e22f4d3c3796febd7f25dc99ff7cc832fb776fe257691d
Instruction Fuzzy Hash: BD119170608104DFD704EF2AFC85B597BE8E714718F22847BE544872A2EBB96D00DB6D

Function 0047E0A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047E0F2

Strings

Failed to remove temporary directory: , xrefs: 0047E10B

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 9feb2f6085af5a8b024ba5244f206146ce975ac7a9d5adcf9a00534459b24a1c
Instruction ID: ac5e1a37918f7d070e72ace47ef54387b1d6805ebc6ff4ed15476670fa48ed12
Opcode Fuzzy Hash: 9feb2f6085af5a8b024ba5244f206146ce975ac7a9d5adcf9a00534459b24a1c
Instruction Fuzzy Hash: 5A017930604204AADB11EB73DC47FDA3798DB49709F6089BBB504B62E2DBBC9D04D55C

Function 004948A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,00000000,00494924,?,?,?,?,00000000), ref: 004948FE

Strings

Inno Setup CodeFile: , xrefs: 004948DD

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Value
String ID: Inno Setup CodeFile:
API String ID: 3702945584-2285989325
Opcode ID: 2f90158afc0c9fd23007fa1d29d76f6e16293ff65aac597289e1ddf349941b77
Instruction ID: 9b0f4ad90dc0f1e84aaf2a8accef921b1bbee2ca8ab783952ee32dac83d05b84
Opcode Fuzzy Hash: 2f90158afc0c9fd23007fa1d29d76f6e16293ff65aac597289e1ddf349941b77
Instruction Fuzzy Hash: A101ADB1300204BBEB11EA76CC82F6BBEDCCB89705F60003AF800E7292DA7C9E06511C

Function 0047D800 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047DA4C,00000000,0047DC4C), ref: 0047D845

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047D815

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 53df27f75c1619b18280fce424738c59cd53f5d3a215a116b7eac3c2b38ec33c
Instruction ID: 9e1ac37bc360ea69ca44dde089ba04ba4b826bb97de6a423fadd5e819c649f8f
Opcode Fuzzy Hash: 53df27f75c1619b18280fce424738c59cd53f5d3a215a116b7eac3c2b38ec33c
Instruction Fuzzy Hash: 09F08231B04114A7DB00B69A9C42BAEA7AC8F84758F20807BF519EB242D9B99E0143AD

Function 0042E26C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042E286

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: ba599b357b8d4751e1ab922ebb55064d8a8854d38c942fc45e646e4ab9ecaa7b
Instruction ID: 65e6a506820a5022674633d18044d67bbd02e357da0c4a821f6ebd0b5300d4b8
Opcode Fuzzy Hash: ba599b357b8d4751e1ab922ebb55064d8a8854d38c942fc45e646e4ab9ecaa7b
Instruction Fuzzy Hash: B7D09272910228BBAB009A89DC41DFB77ADDB1A760F80806AF91897241D2B4AC519BF4

Function 0047F778 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047FA57,?,-0000001A,00481956,-00000010,?,00000004,0000001C,00000000,00481CA3,?,0045E364), ref: 0047F7EE

Part of subcall function 0042E76C: GetDC.USER32(00000000), ref: 0042E77B
Part of subcall function 0042E76C: EnumFontsA.GDI32(?,00000000,0042E758,00000000,00000000,0042E7C4,?,00000000,00000000,?,?,00000001,00000000,00000002,00000000,00482671), ref: 0042E7A6
Part of subcall function 0042E76C: ReleaseDC.USER32(00000000,?), ref: 0042E7BE

SendNotifyMessageA.USER32(00020442,00000496,00002711,-00000001), ref: 0047F9BE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: f63ddfb2871cf1e66e6cb65ad1930d9627398cbe91e727e5a4f1e93d11453290
Instruction ID: 2351f95844d6f0f86e4a4553bb1ee5652cba21286aa46acec5315b7e6dd2a420
Opcode Fuzzy Hash: f63ddfb2871cf1e66e6cb65ad1930d9627398cbe91e727e5a4f1e93d11453290
Instruction Fuzzy Hash: 865196B46001009BD710FF26D98179A37A9EB54309B50C53BA4099F3A7CB3CED4ACB9E

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049D420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049D420,0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049D420,00401A89,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: d8e299963bb2c4fed4ff4e3414f532efba3796fb7efe986e1124fe849202073f
Instruction ID: 28de6049d60bc6243b4bd9e8b7e4b04bc6e7afcf6678d0e749794f980a6998b8
Opcode Fuzzy Hash: d8e299963bb2c4fed4ff4e3414f532efba3796fb7efe986e1124fe849202073f
Instruction Fuzzy Hash: 3D41C4B2E003019FDB10CF69DE8521A77A4F7A9328F15417BD954A77E1D378A842CB48

Function 0042E050 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042E188), ref: 0042E08C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042E188), ref: 0042E0FC

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fb659fd4e3abd397cfb8b0300bb5eb5c22831bf077ba98013b241e0a6da047f3
Instruction ID: f9a1da9ca9b7937b0bb3d9b331acc3eaa2fb365deabda7ea02547e95fe34f262
Opcode Fuzzy Hash: fb659fd4e3abd397cfb8b0300bb5eb5c22831bf077ba98013b241e0a6da047f3
Instruction Fuzzy Hash: 77415E71E00129ABDB11DF92D881BBFB7B9EB01704F944576E814F7281D778AE01CBA9

Function 0042E310 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042E426,?,?,00000008,00000000,00000000,0042E453), ref: 0042E3BC
RegCloseKey.ADVAPI32(?,0042E42D,?,00000000,00000000,00000000,00000000,00000000,0042E426,?,?,00000008,00000000,00000000,0042E453), ref: 0042E420

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: ba9fca61959f2a1fd28644f420a32ef2aa2387f9cea893e540c804915765ba19
Instruction ID: a18f9d464683a8b418f1d9d9c182c699679c3713f239d59a614a00dbe2042668
Opcode Fuzzy Hash: ba9fca61959f2a1fd28644f420a32ef2aa2387f9cea893e540c804915765ba19
Instruction Fuzzy Hash: 3E318670B04254AFDB11EBA3EC52BBFBBB9EB45305F90447BE500B3291D6785E01CA29

Function 00452F2C Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458A74,00000000,00458A5C,?,?,?,00000000,00452FA6,?,?,?,00000001), ref: 00452F80
GetLastError.KERNEL32(00000000,00000000,?,?,00458A74,00000000,00458A5C,?,?,?,00000000,00452FA6,?,?,?,00000001), ref: 00452F88

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 1398244007b20135f5cbcb84ec70d62da1e947103cbbdaeddf7845a69a56a8f1
Instruction ID: 1642ece03f316e66375c060ca7626bc18a341a32778e3b1f8c5ba0bc81bd916e
Opcode Fuzzy Hash: 1398244007b20135f5cbcb84ec70d62da1e947103cbbdaeddf7845a69a56a8f1
Instruction Fuzzy Hash: E7112772A04208AF8B40DEA9ED41D9FB7ECEB4E310B11456BBD08D3241D678AD159B68

Function 0040B228 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040B242
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B39F,00000000,0040B3B7,?,?,?,00000000), ref: 0040B253

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: ccfb53ccaaecadb89aef38a6b87b21aaaa45f6b87b20848e9e6dd1c8ee0e0d8f
Instruction ID: 99f6b945ddddc3ffa7954b5b99b0f089effa67c77682540e1bcd22500dccd1d0
Opcode Fuzzy Hash: ccfb53ccaaecadb89aef38a6b87b21aaaa45f6b87b20848e9e6dd1c8ee0e0d8f
Instruction Fuzzy Hash: 9101F7717043006FE700EF69DC52D1A77ADDB89718711807AF500EB2D0D63D9C0196AD

Function 0041F2F4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F343
EnumThreadWindows.USER32(00000000,0041F2A4,00000000), ref: 0041F349

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 26a01034718a754fac2428515d88d868d648ddf0343dd67eaafc6563d075de98
Instruction ID: ded2603fe903b3ccb75c053802ed51acc4a1ef0e0cc57bb05547c7342bcbb188
Opcode Fuzzy Hash: 26a01034718a754fac2428515d88d868d648ddf0343dd67eaafc6563d075de98
Instruction Fuzzy Hash: B2016D74A04B08BFD301CF66ED1195ABBF8F749724B22C877E854D3AA0E73459119E58

Function 004533C4 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00453406
GetLastError.KERNEL32(00000000,00000000,00000000,0045342C), ref: 0045340E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 1548faf8a9677bd12e98f2e2d243f9d82652a592f520366f9bcd72908c48431c
Instruction ID: 0cc30b72992c59045a3cb8216ce3619e412531a307d766600c380e57d1775dbb
Opcode Fuzzy Hash: 1548faf8a9677bd12e98f2e2d243f9d82652a592f520366f9bcd72908c48431c
Instruction Fuzzy Hash: 6101D671B04204BB8701EFB9AC4249EB7ECDB49766760457BFC04E3242EA789F088558

Function 00452EB4 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00452F13), ref: 00452EED
GetLastError.KERNEL32(00000000,00000000,00000000,00452F13), ref: 00452EF5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7cb2c570ac219d0ee22c88f96f5bf87a62d98c3fd0f6f1ca7cf3871b5df67843
Instruction ID: 89335b5e5455deb896f2d2efe83bb95299e3db0618b413de6719cdd134c6b725
Opcode Fuzzy Hash: 7cb2c570ac219d0ee22c88f96f5bf87a62d98c3fd0f6f1ca7cf3871b5df67843
Instruction Fuzzy Hash: CEF02872A04304BBCB01EF75AD0259EB3E8DB0A321B5045BBFC04E3282E7B94E049698

Function 0042368C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423699
LoadCursorA.USER32(00000000,00000000), ref: 004236C3

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: f140cec9cfa9b30dc2305244e4258a11cf30c4d8c1b352010c949b8b0dda8ca8
Instruction ID: 05fd857f6409e6a60644ea24615d01c87e42662e453bf4d6e4e1dfbb00014e4e
Opcode Fuzzy Hash: f140cec9cfa9b30dc2305244e4258a11cf30c4d8c1b352010c949b8b0dda8ca8
Instruction Fuzzy Hash: F2F0A7517002107ADA205E3E6CC0A2A72ADCBC1735B61437BFA2AE73D1C72D5D45556D

Function 0042E7E4 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b4fdb90dd8f6dfc429e23110810c204407b66d19ffb3595c1bc568b2ae7c347
Instruction ID: 76a16bdd6934cf9e499703eeb82aeaab1faf94a78ecb328ba4f7015bbedd62a6
Opcode Fuzzy Hash: 9b4fdb90dd8f6dfc429e23110810c204407b66d19ffb3595c1bc568b2ae7c347
Instruction Fuzzy Hash: 13F08270B14744BEDB116F779C6282BBBECE749B1079348B6F800A3A91E63C4C10C968

Function 00477E4C Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(6F5027E0,?,?,?,?), ref: 00477E79
CallWindowProcW.USER32(FFFF0466,?,?,?,?), ref: 00477E8A

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3b3bcb1a515eb24d18246344862472c5999d5df4409f8f541189235709fabbb3
Instruction ID: e3cdc248f3d34916c976d05d9458007ce5e90364cfce0ac0a3cfd78eef4de0e7
Opcode Fuzzy Hash: 3b3bcb1a515eb24d18246344862472c5999d5df4409f8f541189235709fabbb3
Instruction Fuzzy Hash: 30F030B2114318BBDA00DA6ADC89CA777ACEF59360B00C637BD18933A0D178AD008678

Function 0046EE04 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046EE9A), ref: 0046EE0E
CoCreateInstance.OLE32(0049BB9C,00000000,00000001,0049BBAC,?,?,0046EE9A), ref: 0046EE2A

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 780da2f8f06851a502736db72271cf8d77c3ee5523c6db3b3ed376e5da340fe9
Instruction ID: 784abeb2b863a263b0685f2ce256345c834679a9cfc70721c753cc97000ad865
Opcode Fuzzy Hash: 780da2f8f06851a502736db72271cf8d77c3ee5523c6db3b3ed376e5da340fe9
Instruction Fuzzy Hash: 2AF0E534241310EEFB11E72BDC4AB4A3BC4AB25714F14403BF144972A1E3EE94808B6F

Function 0047DB95 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(0049BD54,00008000,00000000,?), ref: 0047DBA5
CoTaskMemFree.OLE32(?,0047DBE8), ref: 0047DBDB

Strings

SystemDrive, xrefs: 0047D9DF
CommonFilesDir, xrefs: 0047DA7A, 0047DAF6
cmd.exe, xrefs: 0047DC06
ProgramFilesDir, xrefs: 0047DA40, 0047DAC7
Failed to get path of 64-bit Program Files directory, xrefs: 0047DAE9
Failed to get path of 64-bit Common Files directory, xrefs: 0047DB18
COMMAND.COM, xrefs: 0047DC27
Common Files, xrefs: 0047DAB1
\Program Files, xrefs: 0047DA67

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: 40c9fceec1849ef55c2d9e9b165fa2d81ca6f89bfe3325e062340eef34f4dc70
Instruction ID: 547cb950fcd41f41a68947569da9652c82defc7c7397c5e87919afd81bca1a0c
Opcode Fuzzy Hash: 40c9fceec1849ef55c2d9e9b165fa2d81ca6f89bfe3325e062340eef34f4dc70
Instruction Fuzzy Hash: F5E06534714640BEEB119A619D12B5977B8EB85B04FB28476F50496690D678A9009A18

Function 0045103C Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,00470FA5,?,00000000), ref: 00451052
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,00470FA5,?,00000000), ref: 0045105A

Part of subcall function 00450DF8: GetLastError.KERNEL32(00450C14,00450EBA,?,00000000,?,00499714,00000001,00000000,00000002,00000000,00499875,?,?,00000005,00000000,004998A9), ref: 00450DFB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 57e3a47998fe8597b6042e5f5bf28c6be865df3206a1389c22972bb96d3862bd
Instruction ID: e16622de0e040581c0824a6ac5d1d77e375427595308dce999b5737054ed6bda
Opcode Fuzzy Hash: 57e3a47998fe8597b6042e5f5bf28c6be865df3206a1389c22972bb96d3862bd
Instruction Fuzzy Hash: 86E012B5344201ABE700FAB599C1F2B22DCDB44755F10846AF944DA187D674DC498B35

Function 0048483C Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00484846
GetTickCount.KERNEL32 ref: 0048483D

Part of subcall function 00484808: GetForegroundWindow.USER32(00000000,00000000,?,?,0048486D,?,00484952,?,?,00000000), ref: 0048480E
Part of subcall function 00484808: GetWindowThreadProcessId.USER32(00000000,?), ref: 00484820
Part of subcall function 00484808: GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,0048486D,?,00484952,?,?,00000000), ref: 00484829

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CountProcessTickWindow$CurrentForegroundThread
String ID:
API String ID: 711787588-0
Opcode ID: b5012c5d5f67b50791137d02010e47c7c65d22dc99dd8034a83b9399e6e836ec
Instruction ID: 15379a2e01471303efff648884838df7c38ffaa6109914de87cf785516410688
Opcode Fuzzy Hash: b5012c5d5f67b50791137d02010e47c7c65d22dc99dd8034a83b9399e6e836ec
Instruction Fuzzy Hash: 76D0A94C61028305CD00BBB3828622D01409FC031DF000C3FB80A9B283DE1C8100833F

Function 0041F444 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F45E
EnumThreadWindows.USER32(00000000,0041F3E0,00000000), ref: 0041F464

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 714e2587f2e5118136e687c91d65361c8421099981035becec4dff953f00131f
Instruction ID: 68741bc32d62e3c0e2143af6d8bcd4559dc66fbf958b0e80957fbdef8d5f35d8
Opcode Fuzzy Hash: 714e2587f2e5118136e687c91d65361c8421099981035becec4dff953f00131f
Instruction Fuzzy Hash: 92E04CB1A00600AFDB10EF35FF4575A37E4E720718F16483BA884D21A1D3745844DA9C

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e62aa1badbe9b7bec7abb2084251aae76f03f49734707af951965b808a3b35c
Instruction ID: a6323659c4e3f22e280215c11bf30f87fcb27bed7f3312751ebcd43238c0638b
Opcode Fuzzy Hash: 7e62aa1badbe9b7bec7abb2084251aae76f03f49734707af951965b808a3b35c
Instruction Fuzzy Hash: CCF08272A0063067EB60596A4C81B5359849BC5794F154076FD09FF3E9D6B58C0142A9

Function 00408A2C Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408B62), ref: 00408A4B

Part of subcall function 0040723C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00407259

Part of subcall function 004089B8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049D4C4,00000001,?,00408A83,?,00000000,00408B62), ref: 004089D6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: bb57ecfbcf6c99401787c1e244de85808a7a992296f2a947b18206caa06ad51e
Instruction ID: 2280d21d464d6860fad4d2303e4b2489916fa30e512bd771d5ffef80d8a4ef38
Opcode Fuzzy Hash: bb57ecfbcf6c99401787c1e244de85808a7a992296f2a947b18206caa06ad51e
Instruction Fuzzy Hash: F6315275E001099BCF00EF95C8819EEB779EF84314F51857BE815BB385E738AE058B99

Function 0041FFEC Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 00420089

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 3edf798da742a1a67383ead948891c4ca252191c32eeff7b634738f170ced4ea
Instruction ID: a69ccf46589f52d523cedfa5b555af8e95575bce60e7416ef6aeac4177a5bf43
Opcode Fuzzy Hash: 3edf798da742a1a67383ead948891c4ca252191c32eeff7b634738f170ced4ea
Instruction Fuzzy Hash: BA2151B1604755AFD340DF39A440767BBE4BB48344F04892EE098C3342E775E995CBD6

Function 0046D110 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041F2F4: GetCurrentThreadId.KERNEL32 ref: 0041F343
Part of subcall function 0041F2F4: EnumThreadWindows.USER32(00000000,0041F2A4,00000000), ref: 0041F349

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046D16E,?,00000000,?,?,0046D380,?,00000000,0046D3F4), ref: 0046D152

Part of subcall function 0041F3A8: IsWindow.USER32(?), ref: 0041F3B6
Part of subcall function 0041F3A8: EnableWindow.USER32(?,00000001), ref: 0041F3C5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 9f032309dcde971134040d123568164e642ddd2cabc1e4735cf40f63c5ed8cf9
Instruction ID: b16b0b1c8f0f43ce2eded6e4310be42afa410753b2a581968e322ef2fdc8cd52
Opcode Fuzzy Hash: 9f032309dcde971134040d123568164e642ddd2cabc1e4735cf40f63c5ed8cf9
Instruction Fuzzy Hash: EFF0BEB1B08344BFFB05DB72EC56B6AB7A8E30A714F61447BF404861A0EAF95840852E

Function 004169A0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 004169D5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 055c9416affa8369aca5a52daf2b71abecd104a899c95fff13876bf4c34adbe4
Instruction ID: 76b9729045c620b17443a4bfae3f317f1f80b082859ffabd1d53e10c409eed5a
Opcode Fuzzy Hash: 055c9416affa8369aca5a52daf2b71abecd104a899c95fff13876bf4c34adbe4
Instruction Fuzzy Hash: FEF025B2600510AFDB84CF9CD8C0F9373ECEB0C210B0881A6FA08CF21AD220EC108BB0

Function 00414E04 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 00414E3F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 00450F08 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450F48

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 00d3b0e571f0f9799c9202ce425a31b8579894210baf7755ca9a5e27d392a7a4
Instruction ID: 8219f7e09200e9d280371fd8822ce49b3febf2e1364c7dcaf59ee2aef9f1cf3d
Opcode Fuzzy Hash: 00d3b0e571f0f9799c9202ce425a31b8579894210baf7755ca9a5e27d392a7a4
Instruction Fuzzy Hash: E2E0EDB53541483ED6809AAD7D42F9667DCD71A724F008033B998D7241D5619D158BE8

Function 0042D11C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042D164,?,00000001,?,?,00000000,?,0042D1B6,00000000,00453169,00000000,0045318A,?,00000000), ref: 0042D147

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 52a97f63493a2405b18f7ceeeb4c5583b1fc3ffb9d272bcba16263c996160de7
Instruction ID: 9806b9c164805e7544688198397d180b04c1e4ca63c7d3d80aa3ce68cdb407ca
Opcode Fuzzy Hash: 52a97f63493a2405b18f7ceeeb4c5583b1fc3ffb9d272bcba16263c996160de7
Instruction Fuzzy Hash: 74E09271704704BFD701EF62DC53E6BBBECDB89B18BA14876B400E7692D6789E10D468

Function 0042ED18 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004539D7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED37

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 09ac2101c8e17b0b2705a927b8a5b1ff093a5eaf49e610a8aec8846a662564db
Instruction ID: 20bfa46e39afc277729b0f592bdc1926ad718625f52f7f76be7811270f12921f
Opcode Fuzzy Hash: 09ac2101c8e17b0b2705a927b8a5b1ff093a5eaf49e610a8aec8846a662564db
Instruction Fuzzy Hash: 0DE0206179471216F2351416AC47B77530E43C0704F944436BF50DD3E3D6AED906465E

Function 004062F8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423ACC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00406321

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9dc46ec25ca5ecaaaae1fbad39bdca196911fb58cef97937ba07dcb482697fa8
Instruction ID: 1e3b386673cc32b76f3712ab4659b14af7d7742474b1f2ca80afcc4f691b27f6
Opcode Fuzzy Hash: 9dc46ec25ca5ecaaaae1fbad39bdca196911fb58cef97937ba07dcb482697fa8
Instruction Fuzzy Hash: 26E002B221430DBFDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972528675AC608B71

Function 0042E234 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E260

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5347a797c781b98567e2e52ffd135a3f9820974f1ad95a252eafdff03c881ffc
Instruction ID: 1b6ad3e9ff9242377371a87229ab788a86a92e19cf0220c3a89558970fe9bf90
Opcode Fuzzy Hash: 5347a797c781b98567e2e52ffd135a3f9820974f1ad95a252eafdff03c881ffc
Instruction Fuzzy Hash: 58E07EB6600119AF9B40DE8DDC81EEB37ADAB5D360F444016FA48E7200C2B8EC519BB4

Function 00455360 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0047194C,00000000,00472768,?,00000000,004727B1,?,00000000,004728EA,?,00000000,?,00000000,I), ref: 00455376

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 2037d152b961654d0701826464360efc1bc8af66d82e3674caf93459437a3ed2
Instruction ID: 8b71881552422ad0faea9fb58b8cbe3f8cf10286c40a53e64c89ff98b22cfa58
Opcode Fuzzy Hash: 2037d152b961654d0701826464360efc1bc8af66d82e3674caf93459437a3ed2
Instruction Fuzzy Hash: 74E09BB0504A004BC714DF7A848132A77D15F84321F04C96ABC9CCB7D7E67C84154667

Function 00414ACC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(004972CE,?,004972F0,?,?,00000000,004972CE,?,?), ref: 00414AEB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00407360 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407374

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3a95ec999e214528a4642a0263e4bef887c4bff4fae810559ecd64d74c978ed9
Instruction ID: 7137799a8a619894c36928dc497025c8ae4ce5b7c347e91e7b4e2a044eac2fb2
Opcode Fuzzy Hash: 3a95ec999e214528a4642a0263e4bef887c4bff4fae810559ecd64d74c978ed9
Instruction Fuzzy Hash: CFD05B723082507BE320A55B5C44EAB6BDCCBC5774F10063EF958D31C1D6349C01C675

Function 00423A9C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423A48: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 00423A5D

ShowWindow.USER32(004108B0,00000009,?,00000000,0041F1F4,00423D8A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00423AB7

Part of subcall function 00423A78: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423A94

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: b1c2cd61143bf12a0bef37db47b635a6d3ef0f027e429c080d83374e888f6fa5
Instruction ID: b4979a057c5364df20928e0f8112b75834207fc47edce7a1cb621b48fadbe9ee
Opcode Fuzzy Hash: b1c2cd61143bf12a0bef37db47b635a6d3ef0f027e429c080d83374e888f6fa5
Instruction Fuzzy Hash: E4D0A7137811703143117BB738469BF46EC4DD26AB38808BBB5C0DB303E91E8E051278

Function 00424714 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042472C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 0f798d55b4a563aaf07053da431746ff1fcbe1b34a54896860b3a53b831deb59
Instruction ID: 0401e0c0b6f3d46f422729750133087b7afca2a32056b90ced50410e3746bfe3
Opcode Fuzzy Hash: 0f798d55b4a563aaf07053da431746ff1fcbe1b34a54896860b3a53b831deb59
Instruction Fuzzy Hash: 17D05EE27011602BCB01BAAD54C4ACA67CC8B8936AB1440BBF908EF257C638CE458398

Function 0042D1BC Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00453399,00000000,004533B2,?,-00000001,00000000), ref: 0042D1C7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7c6ebe174506a89767f7ee592df00eb0c72a5955deab68b848f445c8102e14c6
Instruction ID: bf35e0695d646f252302ae8c05399a3b1551c06c76099583daea3b520eb86f7d
Opcode Fuzzy Hash: 7c6ebe174506a89767f7ee592df00eb0c72a5955deab68b848f445c8102e14c6
Instruction Fuzzy Hash: 3ED022D071121001DE10A0BC28C533711880B74336BA41A33BD69E26E3C33D8823542C

Function 0042D174 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00451D0F,00000000), ref: 0042D17F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 176281895ea3e42f60d60676608de6346bb49bc8ae14b0fa01ac27964d7a3955
Instruction ID: 86baad2ceceaa6a85e65f17f0286784d9b66173697f2cc348ab0aa8737b1e759
Opcode Fuzzy Hash: 176281895ea3e42f60d60676608de6346bb49bc8ae14b0fa01ac27964d7a3955
Instruction Fuzzy Hash: C9C080D0711210155E10A5BD1CC556703C849543793540F37B068D66D2D13D8466202C

Function 004677CC Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00468491,00000000,00000000,00000000,0000000C,00000000), ref: 004677E4

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 00407310 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040AB24,0040D0D0,?,00000000,?), ref: 0040732D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 209b0ba7fd8c5b4a24ef9a539f4d873392a5060120ce01350303422817e34c0d
Instruction ID: a78e408fffc15bc8d0ee8a54c686fbaa4e2694f5c3f88f37cecd524e454749ad
Opcode Fuzzy Hash: 209b0ba7fd8c5b4a24ef9a539f4d873392a5060120ce01350303422817e34c0d
Instruction Fuzzy Hash: ADC048B13C130032F93025A61C87F1604889714B1AE60943AB740BE1C2D8E9A818016C

Function 0041F7EC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F800

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Function 004504A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,004506B4,00000000,?,00469063,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 004504C6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 26d24d78127bedaa8bd94fa6176c523188c8219f80ea813ea250164edc493aa3
Instruction ID: d31243997fce6a081680f754dd08e5339b9cfa2d37494deb9f472b2c5ff9ad0f
Opcode Fuzzy Hash: 26d24d78127bedaa8bd94fa6176c523188c8219f80ea813ea250164edc493aa3
Instruction Fuzzy Hash: 1AD092B1925244AECB10AB26EA0430232B0E364316F404037E60095163C33988958F8C

Function 00451070 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045CB3E,00000000,0045CCC9,?,00000000,00000002,00000002), ref: 00451077

Part of subcall function 00450DF8: GetLastError.KERNEL32(00450C14,00450EBA,?,00000000,?,00499714,00000001,00000000,00000002,00000000,00499875,?,?,00000005,00000000,004998A9), ref: 00450DFB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 46bffcc4190b32f1737510e309765b0f9d847fb6a3bc417c92e668a4702f1f8e
Instruction ID: c64e7bd530bf7aca0fb3f38fdfe864b922b4b7832701085435935f337d1370ec
Opcode Fuzzy Hash: 46bffcc4190b32f1737510e309765b0f9d847fb6a3bc417c92e668a4702f1f8e
Instruction Fuzzy Hash: 0BC04CA5340140578F40A6AE85C1A1663DC9E193493504066B904DF657D669D8484A15

Function 004073A0 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 591f449e1d77daae53b1a5aa43bd251db5a728a4dd1e5d8efdcf407e7d8efb90
Instruction ID: b32d93fc701aa1162a174406e7d11ef14f94d69b7075bb962530761d6eacc69a
Opcode Fuzzy Hash: 591f449e1d77daae53b1a5aa43bd251db5a728a4dd1e5d8efdcf407e7d8efb90
Instruction Fuzzy Hash: 5BB012E13D320A26CA0079FE4CC191B00CC46297063405A3A3406E71C3DC3CC8180414

Function 004076F8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,004996A2,00000000,00499875,?,?,00000005,00000000,004998A9,?,?,00000000), ref: 00407703

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: f8e5bc84ed77a990345a18ebfce7b3b4d36d471a9523976a67f94f28f3ebd8b5
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: f8e5bc84ed77a990345a18ebfce7b3b4d36d471a9523976a67f94f28f3ebd8b5
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Function 0047E3D0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00482E1B), ref: 0047E3E6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6c53cdab159c99083d4d98b8786732a30233f1b333e0139ad3d8075ed81d35ad
Instruction ID: be2fe49a244c431ec9946715e535269e6deba234050b303873a188c7b9bcae40
Opcode Fuzzy Hash: 6c53cdab159c99083d4d98b8786732a30233f1b333e0139ad3d8075ed81d35ad
Instruction Fuzzy Hash: C5C00271511210AED750DFBA9D4C75637D4A71832AF068477F40CC3160F6344840CB09

Function 0042E83F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E85D), ref: 0042E850

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: bbf0f8014a804afebd1604ab393a38912dcaab738292d82ddfa54d7cc6c30dd0
Instruction ID: 289f6c2202f902c5fbbb0b24ee8d848b414576690a26c35d590b8c03c3951524
Opcode Fuzzy Hash: bbf0f8014a804afebd1604ab393a38912dcaab738292d82ddfa54d7cc6c30dd0
Instruction Fuzzy Hash: A7B09B76B0C6005DF705D6D5745152D63D4D7C57203E1457BF454D35C0D93C58004918

Function 00483058 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00483060

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6898b449f02840bdaf07bdabea8d5b644a8965388b8fc92a769e6b1c60158538
Instruction ID: a049f017766f74ee94b83235d94ec2d7737a3ea42143ca09c2755b46fea829eb
Opcode Fuzzy Hash: 6898b449f02840bdaf07bdabea8d5b644a8965388b8fc92a769e6b1c60158538
Instruction Fuzzy Hash: 7FA002343D530430F47463510D13F4400402744F15EE1409573053D0C304D82424201D

Function 00416A3C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00416A43

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 7c218e59c1dd1ff03dc8e849b9cf22d0cf8864dd38f6abff84783c2b34ac62d8
Instruction ID: 951f12253bcdbe2be33f1d7372765b1b3ebb510443260a24e1bbd496af9ec3c9
Opcode Fuzzy Hash: 7c218e59c1dd1ff03dc8e849b9cf22d0cf8864dd38f6abff84783c2b34ac62d8
Instruction Fuzzy Hash: AFA002755015409ADB10E7A5C84DF7A2298BF44204FD905FA714CA7052C53CD9008A55

Function 0047F09C Relevance: 1.4, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047F287,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047F241

Part of subcall function 0042CE50: GetSystemMetrics.USER32(0000002A), ref: 0042CE62

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID:
API String ID: 224039744-0
Opcode ID: f52afbad91b667b6f6308f5f7be5f2f829de3790a0e249e9b62606124138a6e4
Instruction ID: 496bb1a5f94cf580fd05206e04ab07141ed402b11bdf28edaa456749bafa96dd
Opcode Fuzzy Hash: f52afbad91b667b6f6308f5f7be5f2f829de3790a0e249e9b62606124138a6e4
Instruction Fuzzy Hash: 1D51B670600245FFDB10DFA6D884B9AB7F8EB19308F518077E804A73A2D778AD49CB59

Function 0041F814 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041F1F4,?,00423CDF,0042405C,0041F1F4), ref: 0041F832

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3cd9b2b82d3c03bb1042e3aec431f22b9c9f9b479e5e8d2dc048638413a345c3
Instruction ID: 12b252a98648104a36852bc9e66bdd9c626d3d2234b6f24232172dde86ff5d2a
Opcode Fuzzy Hash: 3cd9b2b82d3c03bb1042e3aec431f22b9c9f9b479e5e8d2dc048638413a345c3
Instruction Fuzzy Hash: FA1148746007059BCB10DF19C880B82FBE4EB98350F10C53AE9588B385D374E849CBA8

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c75a05877fa6d12c6d50048bf692a8cb9b872a1b30c0c7aeae6369689fd3dcf9
Instruction ID: 191f0f4b7cd680364798b3dc381f6aadc2f07e0dbee61be3c45a65ffd8c3a871
Opcode Fuzzy Hash: c75a05877fa6d12c6d50048bf692a8cb9b872a1b30c0c7aeae6369689fd3dcf9
Instruction Fuzzy Hash: 9E01FC766442148FC3109E29DCC0E2677E8D794378F15453EDA85673A1D37A7C4187D8

Function 00453708 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00453771), ref: 00453753

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 23d18d59897e39bc4499862bac3fc6016057085f4d4fb8d535a9825dcce29caf
Instruction ID: c77a4f58350eb22b54b4dfaca8229fa0e9126d3262ef2898ea61e0989ca8d5dd
Opcode Fuzzy Hash: 23d18d59897e39bc4499862bac3fc6016057085f4d4fb8d535a9825dcce29caf
Instruction Fuzzy Hash: 24014CB5A042046B8701DF69A8114AEFBE8DB4D3617208277FC64D3342D7345E059764

Non-executed Functions

Function 0041F568 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00419440,00000000,?,?,?,00000001), ref: 0041F576
SetErrorMode.KERNEL32(00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F592
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F59E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F5AC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F5DC
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F605
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F61A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F62F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F644
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F659
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F66E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F683
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F698
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F6AD
FreeLibrary.KERNEL32(00000001,?,00419440,00000000,?,?,?,00000001), ref: 0041F6BF

Strings

Ctl3dCtlColorEx, xrefs: 0041F64E
Ctl3dSubclassCtl, xrefs: 0041F60F
Ctl3dDlgFramePaint, xrefs: 0041F639
BtnWndProc3d, xrefs: 0041F6A2
Ctl3dRegister, xrefs: 0041F5D1
Ctl3DColorChange, xrefs: 0041F68D
Ctl3dUnregister, xrefs: 0041F5FA
Ctl3dUnAutoSubclass, xrefs: 0041F678
Ctl3dAutoSubclass, xrefs: 0041F663
Ctl3dSubclassDlgEx, xrefs: 0041F624
CTL3D32.DLL, xrefs: 0041F599

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 7f93fe397e684a103bce9d62382bab99a389729839f73a4ae53f62d0e5e878ce
Instruction ID: 05ddd3b6a7babc3b5f2b58818bfec20f43c940fb7309246182468bed43dc01b1
Opcode Fuzzy Hash: 7f93fe397e684a103bce9d62382bab99a389729839f73a4ae53f62d0e5e878ce
Instruction Fuzzy Hash: C93104B1A00604BBD710EF75BD46A6933A4F728B28B59093BB148D71A2E77C9C468F5C

Function 00458DC4 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00458E2B
QueryPerformanceCounter.KERNEL32(00000000,00000000,004590BE,?,?,00000000,00000000,?,004597BA,?,00000000,00000000), ref: 00458E34
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458E3E
GetCurrentProcessId.KERNEL32(?,00000000,00000000,004590BE,?,?,00000000,00000000,?,004597BA,?,00000000,00000000), ref: 00458E47
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458EBD
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00458ECB
CreateFileA.KERNEL32(00000000,C0000000,00000000,0049BB24,00000003,00000000,00000000,00000000,0045907A), ref: 00458F13
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00459069,?,00000000,C0000000,00000000,0049BB24,00000003,00000000,00000000,00000000,0045907A), ref: 00458F4C

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458FF5
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045902B
CloseHandle.KERNEL32(000000FF,00459070,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00459063

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

Helper process PID: %u, xrefs: 00459048
SetNamedPipeHandleState, xrefs: 00458F55
CreateNamedPipe, xrefs: 00458EDB
Starting 64-bit helper process., xrefs: 00458DF9
i, xrefs: 00458FA8
CreateProcess, xrefs: 00458FFE
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00458E93
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458E0C
helper %d 0x%x, xrefs: 00458FD4
D, xrefs: 00458F6E
64-bit helper EXE wasn't extracted, xrefs: 00458E1F
CreateFile, xrefs: 00458F21

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 588258891636d6961f6f973a73ca3d63e7b3c2cb37b3ea655e6ca71426862519
Instruction ID: c4bf9a6304175502231bb311a6f33329fdfd9ee29416440b986483e0f2b1c780
Opcode Fuzzy Hash: 588258891636d6961f6f973a73ca3d63e7b3c2cb37b3ea655e6ca71426862519
Instruction Fuzzy Hash: 9071F270A00654DADB10DF65CC46B9E7BF8EB05705F1045AAF908FB282DB785D448F69

Function 0047974C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 004795B8: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021C79E8,?,?,?,021C79E8,0047977C,00000000,0047989A,?,?,?,?), ref: 004795D1
Part of subcall function 004795B8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004795D7
Part of subcall function 004795B8: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C79E8,?,?,?,021C79E8,0047977C,00000000,0047989A,?,?,?,?), ref: 004795EA
Part of subcall function 004795B8: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C79E8,?,?,?,021C79E8), ref: 00479614
Part of subcall function 004795B8: CloseHandle.KERNEL32(00000000,?,?,?,021C79E8,0047977C,00000000,0047989A,?,?,?,?), ref: 00479632

Part of subcall function 00479690: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00479722,?,?,?,021C79E8,?,00479784,00000000,0047989A,?,?,?,?), ref: 004796C0

ShellExecuteEx.SHELL32(0000003C), ref: 004797D4
GetLastError.KERNEL32(00000000,0047989A,?,?,?,?), ref: 004797DD
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0047982A
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047984E
CloseHandle.KERNEL32(00000000,0047987F,00000000,00000000,000000FF,000000FF,00000000,00479878,?,00000000,0047989A,?,?,?,?), ref: 00479872

Strings

MsgWaitForMultipleObjects, xrefs: 00479837
ShellExecuteEx, xrefs: 004797EE
<, xrefs: 00479793
ShellExecuteEx returned hProcess=0, xrefs: 004797FE
GetExitCodeProcess, xrefs: 00479857
runas, xrefs: 004797A1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 31bfd7c4415a231b5aa8a04d7a5eb284a8c88089583419a4159b4f192fe63688
Instruction ID: ef977962423105e2be3f30a06cf623b0e2f7e3d3d4ebd630472f9d2e264b432c
Opcode Fuzzy Hash: 31bfd7c4415a231b5aa8a04d7a5eb284a8c88089583419a4159b4f192fe63688
Instruction Fuzzy Hash: 35314471910204AADB10FFAA88416DEBAB8EF45314F51857FF518F7281D77C8D058B1A

Function 004187D4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004187E3
GetWindowPlacement.USER32(?,0000002C), ref: 00418800
GetWindowRect.USER32(?), ref: 0041881C
GetWindowLongA.USER32(?,000000F0), ref: 0041882A
GetWindowLongA.USER32(?,000000F8), ref: 0041883F
ScreenToClient.USER32(00000000), ref: 00418848
ScreenToClient.USER32(00000000,?), ref: 00418853

Strings

,, xrefs: 004187EC

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: b787cf8406b328f9ec3a8af6233a206f78ef01905e488829e8331a9627355685
Instruction ID: c8128d77bd0d7ceb2c04d713c679bf83e48da9b619e6265fa23865d78167b210
Opcode Fuzzy Hash: b787cf8406b328f9ec3a8af6233a206f78ef01905e488829e8331a9627355685
Instruction Fuzzy Hash: 1B111971505201ABDB00EF69C885E9B77E8AF48314F140A7EB958DB286C738D900CB65

Function 0042F71C Relevance: 13.6, APIs: 9, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042F744
GetWindowLongA.USER32(?,000000F0), ref: 0042F758
GetWindowLongA.USER32(?,000000EC), ref: 0042F76F
GetActiveWindow.USER32 ref: 0042F778
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F7A5
SetActiveWindow.USER32(?,0042F8D5,00000000,?), ref: 0042F7C6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 49306f5a5aea126db747c93f7e274e0cd8a3885b454e69ee071c1ce4e6e90790
Instruction ID: 4c2db8bb30fa69d0e852579bfabd785c91e73d104037fd1269e13a33cc275b58
Opcode Fuzzy Hash: 49306f5a5aea126db747c93f7e274e0cd8a3885b454e69ee071c1ce4e6e90790
Instruction Fuzzy Hash: 0D31B170A00654AFDB01EFB5DC52D6EBBF8EB09704B9244BBF804E7291D6389D04CB18

Function 00455D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00455D8F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00455D95
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455DAE
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455DD5
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455DDA
ExitWindowsEx.USER32(00000002,00000000), ref: 00455DEB

Strings

SeShutdownPrivilege, xrefs: 00455DA7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 082306ff38d6c760ea0c9f1032eabff53d8a831f0171a5046667534f49f86738
Instruction ID: 02e3d1fa5e569da00b44776faf89310fbaa28c239a726f1a6525e170f6cce7ee
Opcode Fuzzy Hash: 082306ff38d6c760ea0c9f1032eabff53d8a831f0171a5046667534f49f86738
Instruction Fuzzy Hash: 55F06871294B02BAE650A6718C1BF7B21A8DB40749F50892ABD41EA1C3D7BDD40C8A7A

Function 0049998C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00499ACA,?,?,00000000,0049D62C,?,00499C54,00000000,00499CA8,?,?,00000000,0049D62C), ref: 004999E3
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00499A66
FindNextFileA.KERNEL32(000000FF,?,00000000,00499AA2,?,00000000,?,00000000,00499ACA,?,?,00000000,0049D62C,?,00499C54,00000000), ref: 00499A7E
FindClose.KERNEL32(000000FF,00499AA9,00499AA2,?,00000000,?,00000000,00499ACA,?,?,00000000,0049D62C,?,00499C54,00000000,00499CA8), ref: 00499A9C

Strings

isRS-, xrefs: 00499A03
isRS-???.tmp, xrefs: 004999CD

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 95b3f25cf4ec60d39bc400f980b771d31e145dcc29cfc9c7f6bb2460c5483c6d
Instruction ID: e7bbbac40fef3dfc3cc8058b31a588cc53a4b1370f1491e53b11de7997221e0f
Opcode Fuzzy Hash: 95b3f25cf4ec60d39bc400f980b771d31e145dcc29cfc9c7f6bb2460c5483c6d
Instruction Fuzzy Hash: 98318871A015586FDF10EF66CC41ADEBBBCDB45304F5184BBA808A32A1DA389F45CE58

Function 00457D90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457E0D
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457E34
SetForegroundWindow.USER32(?), ref: 00457E45
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,0045811D,?,00000000,00458159), ref: 00458108

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00457F88

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 1bafb29eaa387cf621c65735d6d6e09d1b320a36b208eca102bc359f3f595fb9
Instruction ID: fc8679ff921622e129be82b5c7b8b9d6156041410e322bf9d6052ebf871bd799
Opcode Fuzzy Hash: 1bafb29eaa387cf621c65735d6d6e09d1b320a36b208eca102bc359f3f595fb9
Instruction Fuzzy Hash: E8911234604204DFDB15CF55D952F1ABBF9EB88700F2180BAED04AB792CB79AE05CB58

Function 00418120 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041815F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 0041817D
GetWindowPlacement.USER32(?,0000002C), ref: 004181B3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 004181DA

Strings

,, xrefs: 004181A1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 3939ae1d6e1c590614f47c3d4bcf148a2532e1c37498b01d3d2c2056b4d5783c
Instruction ID: 655d5dfc889397085a04c255a013ff48624dbcd9c32011b5bbe491b24769000a
Opcode Fuzzy Hash: 3939ae1d6e1c590614f47c3d4bcf148a2532e1c37498b01d3d2c2056b4d5783c
Instruction Fuzzy Hash: 3C211D72600204ABDF00EF69CCC1ADA77E8AF49314F55456AFD18DF246CB78D9458BA8

Function 004648D0 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464A8D), ref: 00464901
FindFirstFileA.KERNEL32(00000000,?,00000000,00464A60,?,00000001,00000000,00464A8D), ref: 00464990
FindNextFileA.KERNEL32(000000FF,?,00000000,00464A42,?,00000000,?,00000000,00464A60,?,00000001,00000000,00464A8D), ref: 00464A22
FindClose.KERNEL32(000000FF,00464A49,00464A42,?,00000000,?,00000000,00464A60,?,00000001,00000000,00464A8D), ref: 00464A3C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 9c4269f61b84920ca12822ed024a471ff72fe9e9b28da976123b0901a486667e
Instruction ID: ae00aa0afc7aa582470d59ca75ba9400823c3a1943f8949d3747a5def8a0c8eb
Opcode Fuzzy Hash: 9c4269f61b84920ca12822ed024a471ff72fe9e9b28da976123b0901a486667e
Instruction Fuzzy Hash: B541C570A00658AFDF11EFA5DC45ADEB7B8EB89305F4044BAF404E7381E63C9E488E19

Function 00464D4C Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464F33), ref: 00464DC1
FindFirstFileA.KERNEL32(00000000,?,00000000,00464EFE,?,00000001,00000000,00464F33), ref: 00464E07
FindNextFileA.KERNEL32(000000FF,?,00000000,00464EE0,?,00000000,?,00000000,00464EFE,?,00000001,00000000,00464F33), ref: 00464EBC
FindClose.KERNEL32(000000FF,00464EE7,00464EE0,?,00000000,?,00000000,00464EFE,?,00000001,00000000,00464F33), ref: 00464EDA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: bf41e3cc1b133229262ffb54fabbd49d98797372cd5bfa19d660c2805fd8b5e1
Instruction ID: 8e27f6cc4c7e55bed8f6d5ebd72a4c3c722eac7afebeb0f1b00dc6af3d7f2fe3
Opcode Fuzzy Hash: bf41e3cc1b133229262ffb54fabbd49d98797372cd5bfa19d660c2805fd8b5e1
Instruction Fuzzy Hash: 31416535A006589FCB11EFA5CD859DEB7B9FBC8305F5044AAF804E7341EB389E448E59

Function 0042ED84 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDA6
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042EDD1
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDDE
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDE6
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDEC

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 060edd20a8b9ef3e5187fa71c6153c8dffa7266a06f07a40ca48e996766aa3cd
Instruction ID: d5f14a2582f403684e4f7b299b1070748df424b87161b08669007267f0031b9d
Opcode Fuzzy Hash: 060edd20a8b9ef3e5187fa71c6153c8dffa7266a06f07a40ca48e996766aa3cd
Instruction Fuzzy Hash: 21F0F0723A07203AF620B17A6C82F7F018CC784B68F10423AF704FF1D1D9A84D0515AD

Function 00484D28 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00484D66
GetWindowLongA.USER32(00000000,000000F0), ref: 00484D84
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049E0AC,00484242,00484276,00000000,00484296,?,?,?,0049E0AC), ref: 00484DA6
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049E0AC,00484242,00484276,00000000,00484296,?,?,?,0049E0AC), ref: 00484DBA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 6d02ab3679acd20c13477f6129401e215db0be7c9c4dcc708735b62ecc99512f
Instruction ID: c453c85064c149f2f8de5328ae0569b6634ad2f96c4c2f1b45344ef68f201c80
Opcode Fuzzy Hash: 6d02ab3679acd20c13477f6129401e215db0be7c9c4dcc708735b62ecc99512f
Instruction Fuzzy Hash: 3D015E706002129EDB10FB769D89B9A22D95B50344F19083FB8449B2E2CB7C9841975C

Function 00463344 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00463418), ref: 0046339C
FindNextFileA.KERNEL32(000000FF,?,00000000,004633F8,?,00000000,?,00000000,00463418), ref: 004633D8
FindClose.KERNEL32(000000FF,004633FF,004633F8,?,00000000,?,00000000,00463418), ref: 004633F2

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7c5a373344a681de92fecfb08138b0c42bf8f9877b9eb60383b953f92d76aded
Instruction ID: 0500e82312f9f08261d57c94a6d9b1f58695be5d4d7593f033a5dbf80f84d4fc
Opcode Fuzzy Hash: 7c5a373344a681de92fecfb08138b0c42bf8f9877b9eb60383b953f92d76aded
Instruction Fuzzy Hash: 1421DB315046886FDB11DF66CC41ADEB7ACDB49305F5084F7B808D3251EA389F44C959

Function 0042462C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424634
SetActiveWindow.USER32(?,?,?,?,0046DA13), ref: 00424641

Part of subcall function 00423A9C: ShowWindow.USER32(004108B0,00000009,?,00000000,0041F1F4,00423D8A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00423AB7

Part of subcall function 00423F64: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021C25AC,0042465A,?,?,?,?,0046DA13), ref: 00423F9F

SetFocus.USER32(00000000,?,?,?,?,0046DA13), ref: 0042466E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: f6b17c850702daf3fe2f22264f5d8e983b40a127641bef431db8629b7e0b9e45
Instruction ID: 5ae1608fbac1b61a262bbd8080f57afdf1b64e8a1d97d82fcb33e84f02d7d1dc
Opcode Fuzzy Hash: f6b17c850702daf3fe2f22264f5d8e983b40a127641bef431db8629b7e0b9e45
Instruction Fuzzy Hash: DBF0D07170122187CB00BFA9D9C5A9633A8AF48714B56407BBD09DF25BC67CDC458768

Function 0042F254 Relevance: 4.5, APIs: 3, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 0042F261
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000001), ref: 0042F271
CreateMutexA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042F299

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: 296a65e85b4cf530d2912259c248fa0dd98adb1b483a3bccc15e2a953cf47158
Instruction ID: b330794617a7040f76ad0da05c7b1ee5a1856395dd3e8d048ce20caf316d4231
Opcode Fuzzy Hash: 296a65e85b4cf530d2912259c248fa0dd98adb1b483a3bccc15e2a953cf47158
Instruction Fuzzy Hash: 18E0C0B16443007EE200EE758C82F5F76DCDB48714F00483AB654DB1C1E679D9489B96

Function 0041811E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041815F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 0041817D
GetWindowPlacement.USER32(?,0000002C), ref: 004181B3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 004181DA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: add44dc6c1a8246b0274be2cc60e43faf0e8d0d1d4c3491e9dc610c53a27efe0
Instruction ID: b17f17ea660f77e7302433a0225cb82371cce2f83056bcd31e3690383aca5fbc
Opcode Fuzzy Hash: add44dc6c1a8246b0274be2cc60e43faf0e8d0d1d4c3491e9dc610c53a27efe0
Instruction Fuzzy Hash: E5012C72300104BBDF10EE69CCC1EEB7798AB55364F55416AFD18DF242DA38ED8287A8

Function 004179E8 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417A13
GetCapture.USER32 ref: 00417A1C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 373e0a40ab0d4ea76f69d1688ff4f953920e4e837af208d8a25afaf4faa000c4
Instruction ID: c42435c704d87005acf5b6d7044dd68bff31d3bfeee1bac994fdbb5906758c2c
Opcode Fuzzy Hash: 373e0a40ab0d4ea76f69d1688ff4f953920e4e837af208d8a25afaf4faa000c4
Instruction Fuzzy Hash: 79F049313446014BD720A72DC889AAF62F99F84394B1C643BE41AC7756EB7DDDC48758

Function 004245E4 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004245EB

Part of subcall function 00423ED4: EnumWindows.USER32(00423E6C), ref: 00423EF8
Part of subcall function 00423ED4: GetWindow.USER32(?,00000003), ref: 00423F0D
Part of subcall function 00423ED4: GetWindowLongA.USER32(?,000000EC), ref: 00423F1C
Part of subcall function 00423ED4: SetWindowPos.USER32(00000000,004245AC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004245FB,?,?,004241C3), ref: 00423F52

SetActiveWindow.USER32(?,?,?,004241C3,00000000,004245AC), ref: 004245FF

Part of subcall function 00423A9C: ShowWindow.USER32(004108B0,00000009,?,00000000,0041F1F4,00423D8A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00423AB7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 1a354955b864757cfaa5613f9b306845f8d366a619694d2750710a135c8cdae9
Instruction ID: 0eb0e95855424de6865fa4d756a676c77cd5728601e575884a8a50090c80911a
Opcode Fuzzy Hash: 1a354955b864757cfaa5613f9b306845f8d366a619694d2750710a135c8cdae9
Instruction Fuzzy Hash: 3BE01A6070010187DB00EFAAE8C4B8622A8BF88305F55017ABC08CF24BDA3CDC048728

Function 00412A28 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412C25), ref: 00412C13

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: de892e97fbd68e1bb7582f7974717f862a539d23c567f166e41cd9819a8f42aa
Instruction ID: cdfe5c129d614e166dcfab814c58775b37bd24f4e82d9105b90a581207f53ed6
Opcode Fuzzy Hash: de892e97fbd68e1bb7582f7974717f862a539d23c567f166e41cd9819a8f42aa
Instruction Fuzzy Hash: 0451C2316082058FC720DF6AD781A9AF3E5EF98304B2086ABD904C7351EAB9ED91C74D

Function 00479D08 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00479E56

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 462738d441aef1136b86fc8094aec41bc4a49bb6b5bf6afc55cbfc6645c50547
Instruction ID: 77384fbc8b33c5310ab19163c687e45bac72601044cd1e9f95c219b02d082465
Opcode Fuzzy Hash: 462738d441aef1136b86fc8094aec41bc4a49bb6b5bf6afc55cbfc6645c50547
Instruction Fuzzy Hash: 71414A75604105EFCB20CF99C6808AAB7F5EB48310B74C9A6E849DB745D338EE41DB94

Function 0042F9C0 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F9DC

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 2621fde08b5d071fc730d3c03362a0ac5d2de45ee12ad7e5c10e42539110ff87
Instruction ID: 416a4692ed3cb8c0a12f59f0b22837e163b9cfd3c66ebd18f18690eb3ad7abe4
Opcode Fuzzy Hash: 2621fde08b5d071fc730d3c03362a0ac5d2de45ee12ad7e5c10e42539110ff87
Instruction Fuzzy Hash: 07D0A7B220010C7FDB00DE98D840D6B33BC9B8C700B90C826F945C7241D234EDA0CBB8

Function 0044BB28 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 282libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044BAA4: GetVersionExA.KERNEL32(00000094), ref: 0044BAC1

Part of subcall function 0044BAF8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0044BB10

LoadLibraryA.KERNEL32(00000000,00000000,0044BF0B,?,?,?,?,00000000,00000000,?,0044FD4D,0049A4DA), ref: 0044BB8A
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044BBA2
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044BBB4
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044BBC6
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044BBD8
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBEA
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBFC
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044BC0E
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044BC20
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044BC32
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044BC44
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044BC56
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044BC68
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044BC7A
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044BC8C
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044BC9E
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044BCB0
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044BCC2
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044BCD4
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044BCE6
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044BCF8
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044BD0A
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044BD1C
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044BD2E
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044BD40
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044BD52
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044BD64
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044BD76
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044BD88
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044BD9A
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044BDAC
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044BDBE
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044BDD0
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044BDE2
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044BDF4
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044BE06
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044BE18
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044BE2A
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044BE3C
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044BE4E
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044BE60
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044BE72
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044BE84
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044BE96
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044BEA8
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044BEBA
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044BECC
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044BEDE

Strings

GetThemeString, xrefs: 0044BCCC
GetThemeRect, xrefs: 0044BD38
GetThemeEnumValue, xrefs: 0044BD02
GetThemeBool, xrefs: 0044BCDE
GetThemeSysSize, xrefs: 0044BDDA
GetThemeSysString, xrefs: 0044BDFE
EnableThemeDialogTexture, xrefs: 0044BE58
DrawThemeEdge, xrefs: 0044BC60
GetThemeMargins, xrefs: 0044BD4A
SetThemeAppProperties, xrefs: 0044BE8E
GetThemeMetric, xrefs: 0044BCBA
IsThemePartDefined, xrefs: 0044BC84
GetThemeIntList, xrefs: 0044BD5C
SetWindowTheme, xrefs: 0044BD80
DrawThemeText, xrefs: 0044BBD0
GetThemeBackgroundContentRect, xrefs: 0044BBE2, 0044BBF4
GetThemeSysInt, xrefs: 0044BE10
GetThemeFilename, xrefs: 0044BD92
GetThemeSysColor, xrefs: 0044BDA4
GetThemePropertyOrigin, xrefs: 0044BD6E
GetThemeDocumentationProperty, xrefs: 0044BEB2
GetThemeTextMetrics, xrefs: 0044BC2A
IsThemeDialogTextureEnabled, xrefs: 0044BE6A
GetThemeColor, xrefs: 0044BCA8
GetWindowTheme, xrefs: 0044BE46
GetThemeTextExtent, xrefs: 0044BC18
GetThemeInt, xrefs: 0044BCF0
EnableTheming, xrefs: 0044BED6
IsThemeBackgroundPartiallyTransparent, xrefs: 0044BC96
uxtheme.dll, xrefs: 0044BB77
GetThemeFont, xrefs: 0044BD26
GetThemeSysBool, xrefs: 0044BDC8
GetCurrentThemeName, xrefs: 0044BEA0
GetThemeSysFont, xrefs: 0044BDEC
DrawThemeBackground, xrefs: 0044BBBE
OpenThemeData, xrefs: 0044BB9A
GetThemeSysColorBrush, xrefs: 0044BDB6
GetThemeAppProperties, xrefs: 0044BE7C
CloseThemeData, xrefs: 0044BBAC
HitTestThemeBackground, xrefs: 0044BC4E
GetThemePosition, xrefs: 0044BD14
GetThemePartSize, xrefs: 0044BC06
GetThemeBackgroundRegion, xrefs: 0044BC3C
IsAppThemed, xrefs: 0044BE34
IsThemeActive, xrefs: 0044BE22
DrawThemeParentBackground, xrefs: 0044BEC4
DrawThemeIcon, xrefs: 0044BC72

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2754715182-2910565190
Opcode ID: 2001b9481bd4323523c3a6d9ee5d3feebd5ce703d364f315cb0e33d3a930df2d
Instruction ID: 345b4916510d3cb7c096cba84ec2b1d1bd9d6ff2ab3c947e91cb1c242a843473
Opcode Fuzzy Hash: 2001b9481bd4323523c3a6d9ee5d3feebd5ce703d364f315cb0e33d3a930df2d
Instruction Fuzzy Hash: 49A16AB0A41A50EBEB00EFF5DC86A2A37A8EB15B14B1405BBB444EF295D678DC048F5D

Function 00493FEC Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,004944E1,?,?,?,?,00000000,00000000,00000000), ref: 0049402C
FindWindowA.USER32(00000000,00000000), ref: 0049405D

Strings

OEMTOCHARBUFF, xrefs: 0049443F
LOADDLL, xrefs: 004942EF
POSTBROADCASTMESSAGE, xrefs: 00494247
SENDMESSAGE, xrefs: 004940B1
SENDBROADCASTMESSAGE, xrefs: 004941F9
CALLDLLPROC, xrefs: 00494351
REGISTERWINDOWMESSAGE, xrefs: 004941BF
FINDWINDOWBYCLASSNAME, xrefs: 00494039
FREEDLL, xrefs: 004943D8
SENDNOTIFYMESSAGE, xrefs: 00494163
FINDWINDOWBYWINDOWNAME, xrefs: 00494075
POSTMESSAGE, xrefs: 00494107
CHARTOOEMBUFF, xrefs: 00494482
SLEEP, xrefs: 00494016
CREATEMUTEX, xrefs: 0049440D
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0049429B

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 834d3c12a7b8cb1b7f9a51084d0e5a3396d1cd2c1371b045a5ef52030d7eb881
Instruction ID: aaf63752e06fee66a7d05b71673dc8e7902340e663ecb0da5339ca9489632561
Opcode Fuzzy Hash: 834d3c12a7b8cb1b7f9a51084d0e5a3396d1cd2c1371b045a5ef52030d7eb881
Instruction Fuzzy Hash: 7EC14060B0421027DB14FB7ACC4692E5A999BD4704750CA3FB40AEB78BDE3CDC0B4799

Function 0041CE5C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CE90
CreateCompatibleDC.GDI32(?), ref: 0041CE9C
CreateBitmap.GDI32(0041AD94,?,00000001,00000001,00000000), ref: 0041CEC0
CreateCompatibleBitmap.GDI32(?,0041AD94,?), ref: 0041CED0
SelectObject.GDI32(0041D28C,00000000), ref: 0041CEEB
FillRect.USER32(0041D28C,?,?), ref: 0041CF26
SetTextColor.GDI32(0041D28C,00000000), ref: 0041CF3B
SetBkColor.GDI32(0041D28C,00000000), ref: 0041CF52
PatBlt.GDI32(0041D28C,00000000,00000000,0041AD94,?,00FF0062), ref: 0041CF68
CreateCompatibleDC.GDI32(?), ref: 0041CF7B
SelectObject.GDI32(00000000,00000000), ref: 0041CFAC
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CFC4
RealizePalette.GDI32(00000000), ref: 0041CFCD
SelectPalette.GDI32(0041D28C,00000000,00000001), ref: 0041CFDC
RealizePalette.GDI32(0041D28C), ref: 0041CFE5
SetTextColor.GDI32(00000000,00000000), ref: 0041CFFE
SetBkColor.GDI32(00000000,00000000), ref: 0041D015
BitBlt.GDI32(0041D28C,00000000,00000000,0041AD94,?,00000000,00000000,00000000,00CC0020), ref: 0041D031
SelectObject.GDI32(00000000,?), ref: 0041D03E
DeleteDC.GDI32(00000000), ref: 0041D054

Part of subcall function 0041A4A8: GetSysColor.USER32(?), ref: 0041A4B2

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 5e0ecd7f746a94368510dc98cd5b3d13ae19e4ca4739b00519ae71ef4424a664
Instruction ID: f3cd37e79d0242250547ce8a95e3067296a2558137ee74c5e82542f4c8f5946c
Opcode Fuzzy Hash: 5e0ecd7f746a94368510dc98cd5b3d13ae19e4ca4739b00519ae71ef4424a664
Instruction Fuzzy Hash: 6F61CD71A44604AFDB10EBE9DC46FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Function 00499CB8 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,0049A050,?,?,00000000,?,00000000,00000000,?,0049A407,00000000,0049A411,?,00000000), ref: 00499D3B
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049A050,?,?,00000000,?,00000000,00000000,?,0049A407,00000000), ref: 00499D4E
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049A050,?,?,00000000,?,00000000,00000000), ref: 00499D5E
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00499D7F
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049A050,?,?,00000000,?,00000000), ref: 00499D8F

Part of subcall function 0042D89C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D92A,?,?,?,00000001,?,0045681A,00000000,00456882), ref: 0042D8D1

Strings

.msg, xrefs: 00499DB2
Inno-Setup-RegSvr-Mutex, xrefs: 00499D45
.lst, xrefs: 00499DCC
/REGU, xrefs: 00499D11
/REG, xrefs: 00499CED
Setup, xrefs: 00499D27

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: f654155fb34d055394fc85bea44293c4c9637fd4ac0bd6824ad9b47078b18af5
Instruction ID: 24b702ce4587ab849973673670b37801b9677cadbfb3bf4f1077f7c12e9ac28d
Opcode Fuzzy Hash: f654155fb34d055394fc85bea44293c4c9637fd4ac0bd6824ad9b47078b18af5
Instruction Fuzzy Hash: 5591C430A04205AFDF11EF69C852BAEBBB4EB49304F51447AF500AB792C63DAC05CB6D

Function 0045AED4 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045B190,?,?,?,?,?,00000006,?,00000000,00499145,?,00000000,004991E8), ref: 0045B042

Strings

.lnk, xrefs: 0045AFAF
Deleting file: %s, xrefs: 0045AFE1
Failed to strip read-only attribute., xrefs: 0045B027
The file appears to be in use (%d). Will delete on restart., xrefs: 0045B08B
.chw, xrefs: 0045AF89
.gid, xrefs: 0045AF24
Failed to delete the file; it may be in use (%d)., xrefs: 0045B131
.fts, xrefs: 0045AF48
.hlp, xrefs: 0045AF0B
Stripped read-only attribute., xrefs: 0045B01B
.chm, xrefs: 0045AF70

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: bb1f64263b28a679f66124227ba0018ed3853e34b6043fd1366a165deaee20b3
Instruction ID: 1722664f16d817fc675012576ec738190a07adef69c32437d7057340c1fc2b4b
Opcode Fuzzy Hash: bb1f64263b28a679f66124227ba0018ed3853e34b6043fd1366a165deaee20b3
Instruction Fuzzy Hash: 3271AE307006445BDB01EB6A88927AE7BA5EF49755F50846BFC01EB383CB7C8E49879D

Function 0045D3BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045D3D6
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045D3F6
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045D403
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045D410
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045D41E

Part of subcall function 0045D2C4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045D363,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045D33D

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045D611,?,?,00000000), ref: 0045D4D7
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045D611,?,?,00000000), ref: 0045D4E0

Strings

advapi32.dll, xrefs: 0045D3F1
GetNamedSecurityInfoW, xrefs: 0045D3FD
SetEntriesInAclW, xrefs: 0045D418
W, xrefs: 0045D4EE
SetNamedSecurityInfoW, xrefs: 0045D40A

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 0336fb35fd749793045182d1361f828010284629c3cee937cf748adbc12729e9
Instruction ID: 1fdbc06bdf38f6500452038ca5d2f44928d617c4984e35671f0aa61f53d98d16
Opcode Fuzzy Hash: 0336fb35fd749793045182d1361f828010284629c3cee937cf748adbc12729e9
Instruction Fuzzy Hash: D35183B1D00208EFDB20DF99C841BAEB7B8EF49315F14806AF904B7382D6789945CF69

Function 0041B7FC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B813
CreateCompatibleDC.GDI32(00000000), ref: 0041B81D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B82F
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B846
GetDC.USER32(00000000), ref: 0041B852
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B87F
ReleaseDC.USER32(00000000,00000000), ref: 0041B8A5
SelectObject.GDI32(00000000,?), ref: 0041B8C0
SelectObject.GDI32(?,00000000), ref: 0041B8CF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B8FB
SelectObject.GDI32(00000000,00000000), ref: 0041B909
SelectObject.GDI32(?,00000000), ref: 0041B917
DeleteDC.GDI32(00000000), ref: 0041B920
DeleteDC.GDI32(?), ref: 0041B929

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 545e798d89bfd874ee53134500b0446245b84f374f10eb2ff5fc30c629433f8f
Instruction ID: 5456327a1e321ce8c2b8187df1c916a831ebe275c46a8a968a344784d91ca00b
Opcode Fuzzy Hash: 545e798d89bfd874ee53134500b0446245b84f374f10eb2ff5fc30c629433f8f
Instruction Fuzzy Hash: FC419F71E44609ABDB10EAE9C845FEFB7BCEB08704F104466F614F7281D7786D418BA8

Function 00454FDC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegQueryValueExA.ADVAPI32(0045B366,00000000,00000000,?,00000000,?,00000000,00455275,?,0045B366,00000003,00000000,00000000,004552AC), ref: 004550F5

Part of subcall function 0042ED18: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004539D7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED37

RegQueryValueExA.ADVAPI32(0045B366,00000000,00000000,00000000,?,00000004,00000000,004551BF,?,0045B366,00000000,00000000,?,00000000,?,00000000), ref: 00455179
RegQueryValueExA.ADVAPI32(0045B366,00000000,00000000,00000000,?,00000004,00000000,004551BF,?,0045B366,00000000,00000000,?,00000000,?,00000000), ref: 004551A8

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00455013
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045504C
, xrefs: 00455066
RegOpenKeyEx, xrefs: 00455078

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 743cb199dc3a3da6c1c56a8bbbad152aa06b8a2b3acb5eb09b12aa19e4435355
Instruction ID: 06452bf81ef06fa34888f2ab1cc7b3841a1100f4c60e90cd60a05f06e497d7d6
Opcode Fuzzy Hash: 743cb199dc3a3da6c1c56a8bbbad152aa06b8a2b3acb5eb09b12aa19e4435355
Instruction Fuzzy Hash: E0913371D04608ABDB10DFA5C952BEEB7F8EB08305F50406BF904F7282D6799E088B69

Function 00459C54 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459B60: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459C9D,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459BAD

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459CFB
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459D65

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459DCC

Strings

.NET Framework version %s not found, xrefs: 00459E05
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00459D18
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459D7F
v2.0.50727, xrefs: 00459D57
v4.0.30319, xrefs: 00459CED
v1.1.4322, xrefs: 00459DBE
.NET Framework not found, xrefs: 00459E19
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459CAE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 8b9e0b07a6d71abb33b342f656cf4b7e33db3fac7b3c8c62fd281b3a753bfe81
Instruction ID: 13a12a4b366685baa8d6a2e304724611cbcec49206d2204e0959de5a5d6478e2
Opcode Fuzzy Hash: 8b9e0b07a6d71abb33b342f656cf4b7e33db3fac7b3c8c62fd281b3a753bfe81
Instruction Fuzzy Hash: 6451B235A04104EFCB04DB66D862BEE77BADB49305F1844BBA941D7382E7799E0D8B18

Function 00459240 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00459277
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00459293
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004592A1
GetExitCodeProcess.KERNEL32(?), ref: 004592B2
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004592F9
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00459315

Strings

Helper process exited, but failed to get exit code., xrefs: 004592EB
Stopping 64-bit helper process. (PID: %u), xrefs: 00459269
Helper isn't responding; killing it., xrefs: 00459283
Helper process exited., xrefs: 004592C1
Helper process exited with failure code: 0x%x, xrefs: 004592DF

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 31b27d8f62d02e899c0d97eb0d56d88208b7e03077a427ba71f983c97253ffae
Instruction ID: 475b633a8f1197f12a32b7740e8dffccf3703e2e74a756bc360da45c31bde27f
Opcode Fuzzy Hash: 31b27d8f62d02e899c0d97eb0d56d88208b7e03077a427ba71f983c97253ffae
Instruction Fuzzy Hash: 7B215C70604700EAC720EA7DC486B5B77D49F49305F048D2EB899DB693DA7CEC489B2A

Function 00454C90 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E234: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E260

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00454E67,?,00000000,00454F2B), ref: 00454DB7
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00454E67,?,00000000,00454F2B), ref: 00454EF3

Part of subcall function 0042ED18: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004539D7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED37

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454CFF
, xrefs: 00454D19
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454CCF
RegCreateKeyEx, xrefs: 00454D2B

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 1197bea157b5a55131a0cea8d3ccf824884cadf2e94b9edc1da3d2d803b073c1
Instruction ID: 61cb1c98edcfe528623c145d9993427f2b00fea00e486b8f0244815ce8f04fab
Opcode Fuzzy Hash: 1197bea157b5a55131a0cea8d3ccf824884cadf2e94b9edc1da3d2d803b073c1
Instruction Fuzzy Hash: 18810175900209ABDB01DFD5C942BDEB7B8FB49709F50442AF900FB282D7789A49CB69

Function 00498538 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00454024: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454113
Part of subcall function 00454024: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454123

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004985B5
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00498709), ref: 004985D6
CreateWindowExA.USER32(00000000,STATIC,00498718,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 004985FD
SetWindowLongA.USER32(?,000000FC,00497D90), ref: 00498610
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004986DC,?,?,000000FC,00497D90,00000000,STATIC,00498718), ref: 00498640
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004986B4
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004986DC,?,?,000000FC,00497D90,00000000), ref: 004986C0

Part of subcall function 00454498: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0045457F

DestroyWindow.USER32(?,004986E3,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004986DC,?,?,000000FC,00497D90,00000000,STATIC), ref: 004986D6

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0049866F
STATIC, xrefs: 004985F6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 33f0aa1e6c66ba33127d106aa60bf689e86794d53dcbda2b1297c66d72ebb552
Instruction ID: 19a9ac76a87cbdbac9fefc72f4bc8d66673aab5a8439699f4ab81f25108c8d39
Opcode Fuzzy Hash: 33f0aa1e6c66ba33127d106aa60bf689e86794d53dcbda2b1297c66d72ebb552
Instruction Fuzzy Hash: 78414771A54204AFDF00EBA5CC42F9E7BF8EB09714F51457AF500FB291DA799E048B58

Function 0042E868 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E96D,?,00000000,0047F9E0,00000000), ref: 0042E891
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E897
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E96D,?,00000000,0047F9E0,00000000), ref: 0042E8E5

Strings

kernel32.dll, xrefs: 0042E88C
Locale, xrefs: 0042E8D4
Control Panel\Desktop\ResourceLocale, xrefs: 0042E8F4
.DEFAULT\Control Panel\International, xrefs: 0042E8BC
hE, xrefs: 0042E927, 0042E92F, 0042E93A, 0042E95C
GetUserDefaultUILanguage, xrefs: 0042E887

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll$hE
API String ID: 4190037839-2100363064
Opcode ID: 58c30dd9f85b062d47b06f98ac05074f4c591b85530fc523b77ad03276e46551
Instruction ID: 343416b7bfae85f45959abe8e21461bd4048f30ead5244c3b453dfa896624356
Opcode Fuzzy Hash: 58c30dd9f85b062d47b06f98ac05074f4c591b85530fc523b77ad03276e46551
Instruction Fuzzy Hash: 06214470B00229EBDB50EAA7DC42BAE77A8EB44314F904477A500E7281DB7C9E45DB1C

Function 004635E4 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004635F0
GetModuleHandleA.KERNEL32(user32.dll), ref: 00463604
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00463611
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0046361E
GetWindowRect.USER32(?,00000000), ref: 0046366A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 004636A8

Strings

(, xrefs: 00463649
user32.dll, xrefs: 004635FF
MonitorFromWindow, xrefs: 0046360B
GetMonitorInfoA, xrefs: 00463618

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 5d54fb813e64eee8d2e1fd1d869d3f84fcc541412d8aec38238ce219d7c6ea2a
Instruction ID: 23225dc964baf5770c03b9449d190f9fd0809e25ab0c2f23061680c52a7637e8
Opcode Fuzzy Hash: 5d54fb813e64eee8d2e1fd1d869d3f84fcc541412d8aec38238ce219d7c6ea2a
Instruction Fuzzy Hash: AE21C2B17006446BD320EE68CC45F3B76D9EB84B05F09452EF944DB3C1EA78DD004B5A

Function 0042F614 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F620
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F634
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F641
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F64E
GetWindowRect.USER32(?,00000000), ref: 0042F69A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F6D8

Strings

(, xrefs: 0042F679
MonitorFromWindow, xrefs: 0042F63B
GetMonitorInfoA, xrefs: 0042F648
user32.dll, xrefs: 0042F62F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 9e18f176ca51f207d9f48e4ded0b32e3445f45e6b18c2f86467d84d44384674f
Instruction ID: 8e363f887434259cf3ecd6bfca6d9ac669349ab4594bae960fb014309ef79425
Opcode Fuzzy Hash: 9e18f176ca51f207d9f48e4ded0b32e3445f45e6b18c2f86467d84d44384674f
Instruction Fuzzy Hash: BC21C2B27006146FD600EA68DC85F3B72A9EB84704F89463AF944DB391DA78DC098B59

Function 00459418 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004595F7,?,00000000,0045965A,?,?,00000000,00000000), ref: 00459475
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000,00000001,00000000,00000000,00000000,004595F7), ref: 004594D2
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000,00000001,00000000,00000000,00000000,004595F7), ref: 004594DF
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0045952B
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00459565,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000), ref: 00459551
GetLastError.KERNEL32(?,?,00000000,00000001,00459565,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000), ref: 00459558

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

TransactNamedPipe, xrefs: 004594EB
CreateEvent, xrefs: 00459483

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 8c882674e4e7badbb1dce3e2dfa1fdcbe7e98f1f80990b5ca878147d0da0e0cb
Instruction ID: 77fbb71d8e7aac064b87aac98c1c55f9fcb2258c1561d492b861e589c0c855dd
Opcode Fuzzy Hash: 8c882674e4e7badbb1dce3e2dfa1fdcbe7e98f1f80990b5ca878147d0da0e0cb
Instruction Fuzzy Hash: CF418B71A00208FFDB11DF99C981F9EB7F9EB48710F5040AAF904E7282D6789E54CB68

Function 004574BC Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00457621,?,?,00000031,?), ref: 004574E4
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 004574EA
LoadTypeLib.OLEAUT32(00000000,?), ref: 00457537

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

UnRegisterTypeLib, xrefs: 004575A3
GetProcAddress, xrefs: 004574F7
LoadTypeLib, xrefs: 00457542
ITypeLib::GetLibAttr, xrefs: 0045756D
UnRegisterTypeLib, xrefs: 004574DA
OLEAUT32.DLL, xrefs: 004574DF

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: b2a57cb5d0d4215bed9739cbf0b7be67a86da8044cbf193a82d044f72dd204c0
Instruction ID: 559faf3bdf9cccbe36ab56d48fd8e4aa4276a02661c60707683b87f46ce48c1c
Opcode Fuzzy Hash: b2a57cb5d0d4215bed9739cbf0b7be67a86da8044cbf193a82d044f72dd204c0
Instruction Fuzzy Hash: 8131B471A04604BFCB01EFAADC01D5FB7BEEB8975571044B6BD04D3652EA38DD04CA68

Function 004171D0 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00417263
SaveDC.GDI32(?), ref: 00417277
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0041729A
RestoreDC.GDI32(?,?), ref: 004172B5
CreateSolidBrush.GDI32(00000000), ref: 00417335
FrameRect.USER32(?,?,?), ref: 00417368
DeleteObject.GDI32(?), ref: 00417372
CreateSolidBrush.GDI32(00000000), ref: 00417382
FrameRect.USER32(?,?,?), ref: 004173B5
DeleteObject.GDI32(?), ref: 004173BF

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 53338b723e60019b0e5d7787f83bb0eaf38aae583f1cfacba6e60a06ab1a3e99
Instruction ID: 6654575de22a121332528345891e4d9aada139d791074539051cb87a9fd886f5
Opcode Fuzzy Hash: 53338b723e60019b0e5d7787f83bb0eaf38aae583f1cfacba6e60a06ab1a3e99
Instruction Fuzzy Hash: 30515D712086455FDB50EF69C8C0B9B7BE8AF48314F1455AAFD588B286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 00422638 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422683
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004226A1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226AE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226BB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226C8
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004226D5
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 004226E2
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 004226EF
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042270D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422729

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 28c3c26aa58a7b1d0b737a17757400c93c751d32761aa9437bbdc0a385d65993
Instruction ID: df9c0873c136ddd24b8aa988775969986c1613bec62327c4069b14a2c43cb384
Opcode Fuzzy Hash: 28c3c26aa58a7b1d0b737a17757400c93c751d32761aa9437bbdc0a385d65993
Instruction Fuzzy Hash: 5F2156743847047AE721E724CD8BF9B7BD89B54748F144069B6487F2D3C6FCAA40869C

Function 00462174 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004621AF
GetActiveWindow.USER32 ref: 00462213
CoInitialize.OLE32(00000000), ref: 00462227
SHBrowseForFolder.SHELL32(?), ref: 0046223E
CoUninitialize.OLE32(0046227F,00000000,?,?,?,?,?,00000000,00462303), ref: 00462253
SetActiveWindow.USER32(?,0046227F,00000000,?,?,?,?,?,00000000,00462303), ref: 00462269
SetActiveWindow.USER32(?,?,0046227F,00000000,?,?,?,?,?,00000000,00462303), ref: 00462272

Strings

A, xrefs: 004621E7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: caefdfe045defb9a034f2c4a917009fdef53ece79d7542ea0497d69e424cd409
Instruction ID: 1e82777cc352b96db12449cf8796706bfa71e84f11e11660080683620fe74db3
Opcode Fuzzy Hash: caefdfe045defb9a034f2c4a917009fdef53ece79d7542ea0497d69e424cd409
Instruction Fuzzy Hash: E23130B0E04208AFDB00EFB5D945ADEBBF8EB09304F51447AF914E7251E7789A04CB59

Function 0045DAB0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045DAB9
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045DAC9
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045DAD9
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045DAE9

Strings

inflateEnd, xrefs: 0045DAD3
inflateReset, xrefs: 0045DAE3
inflate, xrefs: 0045DAC3
inflateInit_, xrefs: 0045DAB3

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 5abc5c05f731a0f84057b652f47985810eed84a0374322df604e0c431af132d1
Instruction ID: 9991d33b7b3f44c4a287d390de66c621eb38f0a325e11cae05c3c9c0ae6f74c7
Opcode Fuzzy Hash: 5abc5c05f731a0f84057b652f47985810eed84a0374322df604e0c431af132d1
Instruction Fuzzy Hash: ED016CB0D00710DAE324DF335C827223AA79B94306F1584376B4853266D3FC184DCE2D

Function 0041AD2C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041AE09
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041AE43
SetBkColor.GDI32(?,?), ref: 0041AE58
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AEA2
SetTextColor.GDI32(00000000,00000000), ref: 0041AEAD
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AEBD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AEFC
SetTextColor.GDI32(00000000,00000000), ref: 0041AF06
SetBkColor.GDI32(00000000,?), ref: 0041AF13

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: b2e79564dac12e93c58a92479de6674996e515196b856df7b31fa3c4552ba36b
Instruction ID: 4ec4bb7d7ecd06ab75a809c898bbb7394ceff3bd51f581de865bbf99f3132505
Opcode Fuzzy Hash: b2e79564dac12e93c58a92479de6674996e515196b856df7b31fa3c4552ba36b
Instruction Fuzzy Hash: E761A6B5A01605EFC740EFADE985E9AB7F9EF08318B108566F518DB251C734ED408F98

Function 0044D750 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D781
GetSysColor.USER32(00000014), ref: 0044D788
SetTextColor.GDI32(00000000,00000000), ref: 0044D7A0
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D7C9
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D7D3
GetSysColor.USER32(00000010), ref: 0044D7DA
SetTextColor.GDI32(00000000,00000000), ref: 0044D7F2
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D81B
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D846

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: c732eae71167dd8aa6631ccdc206b1dcbb1a1316a8d8e9d7e0f026f0b59abdf9
Instruction ID: 83f763003a0c4173e52025d9049416b14570b2719a823760897ab970dc451d42
Opcode Fuzzy Hash: c732eae71167dd8aa6631ccdc206b1dcbb1a1316a8d8e9d7e0f026f0b59abdf9
Instruction Fuzzy Hash: B221ACB46015047FC710FB2ACD8AE8AB7DC9F59319B00857BB918EB3A3C67CDE444669

Function 00497DDC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00451070: SetEndOfFile.KERNEL32(?,?,0045CB3E,00000000,0045CCC9,?,00000000,00000002,00000002), ref: 00451077

Part of subcall function 004073A0: DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

GetWindowThreadProcessId.USER32(00000000,?), ref: 00497E6D
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00497E81
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00497E9B
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497EA7
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497EAD
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497EC0

Strings

Deleting Uninstall data files., xrefs: 00497DE3

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 76f4a073d4d431fcb8e24e0d71c40f55804fe31760389f23b01cbf0fd8bd04be
Instruction ID: 7989a93d4f85e89f9f4a8d52eef74e044f35551c753dc98037dc67a034be62a8
Opcode Fuzzy Hash: 76f4a073d4d431fcb8e24e0d71c40f55804fe31760389f23b01cbf0fd8bd04be
Instruction Fuzzy Hash: 78213270718204BEEF10EBB6AC42B5737A8E755758F15497BF500961E2EA7C5C048B1D

Function 00471058 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00471155,?,?,?,?,00000000), ref: 004710BF
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00471155), ref: 004710D6
AddFontResourceA.GDI32(00000000), ref: 004710F3
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00471107

Strings

Failed to open Fonts registry key., xrefs: 004710DD
AddFontResource, xrefs: 00471111
Failed to set value in Fonts registry key., xrefs: 004710C8

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: d2650c09efab2342c88601fb656fd69d62d4c4481d526fc4f3ba2e1576b0a7ab
Instruction ID: e530b8863bd5b0940b7b47d45e6c2b04f0dd933a31ed90210a2cbfb1d5868c86
Opcode Fuzzy Hash: d2650c09efab2342c88601fb656fd69d62d4c4481d526fc4f3ba2e1576b0a7ab
Instruction Fuzzy Hash: 3821B27074024477D710EA6A9C42F9A77ACCB09708F60C43BBA04EB3D2DA7CDE05862D

Function 00463A24 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416860: GetClassInfoA.USER32(00400000,?,?), ref: 004168CF
Part of subcall function 00416860: UnregisterClassA.USER32(?,00400000), ref: 004168FB
Part of subcall function 00416860: RegisterClassA.USER32(?), ref: 0041691E

GetVersion.KERNEL32 ref: 00463A54
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00463A92
SHGetFileInfo.SHELL32(00463B30,00000000,?,00000160,00004011), ref: 00463AAF
LoadCursorA.USER32(00000000,00007F02), ref: 00463ACD
SetCursor.USER32(00000000,00000000,00007F02,00463B30,00000000,?,00000160,00004011), ref: 00463AD3
SetCursor.USER32(?,00463B13,00007F02,00463B30,00000000,?,00000160,00004011), ref: 00463B06

Strings

Explorer, xrefs: 00463A6E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 08ef91ce8ca4084e417ba220884df78b79a66e01962786801913a20119982a52
Instruction ID: 0956d246c88e4b13c617490cc10e92cdb10fa67267cb1644ec11604dcab5a564
Opcode Fuzzy Hash: 08ef91ce8ca4084e417ba220884df78b79a66e01962786801913a20119982a52
Instruction Fuzzy Hash: 6A212C307403446AE710BFB58C47F9A76989B08708F5000BFBA09EE1C3EABD9D4586AD

Function 004795B8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021C79E8,?,?,?,021C79E8,0047977C,00000000,0047989A,?,?,?,?), ref: 004795D1
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004795D7
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C79E8,?,?,?,021C79E8,0047977C,00000000,0047989A,?,?,?,?), ref: 004795EA
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C79E8,?,?,?,021C79E8), ref: 00479614
CloseHandle.KERNEL32(00000000,?,?,?,021C79E8,0047977C,00000000,0047989A,?,?,?,?), ref: 00479632

Strings

kernel32.dll, xrefs: 004795CC
GetFinalPathNameByHandleA, xrefs: 004795C7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 1947a9aaa15eabe4036a12787753409495eb16ca8dbead4cdc7f2695ecfe1c22
Instruction ID: 19ddb68189d16dccfde8b10573e35333770f7cebea86a77b7f1be6907437da3a
Opcode Fuzzy Hash: 1947a9aaa15eabe4036a12787753409495eb16ca8dbead4cdc7f2695ecfe1c22
Instruction Fuzzy Hash: CC01D26034470436E52131BA4C86FBB248C8B50768F148237BA1CEA2E2EDAD9E0601AE

Function 0045A608 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A78A,?,00000000,00000000,00000000,?,00000006,?,00000000,00499145,?,00000000,004991E8), ref: 0045A6CE

Part of subcall function 00454B5C: FindClose.KERNEL32(000000FF,00454C52), ref: 00454C41

Strings

Stripped read-only attribute., xrefs: 0045A690
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0045A743
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 0045A6A8
Failed to delete directory (%d)., xrefs: 0045A764
Failed to strip read-only attribute., xrefs: 0045A69C
Failed to delete directory (%d). Will retry later., xrefs: 0045A6E7
Deleting directory: %s, xrefs: 0045A657

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 85732bd228a2a83cae158566f07fa3d639507cacb6524005fd82c17153421e64
Instruction ID: 6800a92dfaec35f14ad088af188abd42280c19cea7490fe80134e7d3278dcbe3
Opcode Fuzzy Hash: 85732bd228a2a83cae158566f07fa3d639507cacb6524005fd82c17153421e64
Instruction Fuzzy Hash: 62418630A002485ACB10EB6988017AE7AF59B4D306F55867FAC11A7393DB7CCE1D875B

Function 004298D0 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004298DA
GetTextMetricsA.GDI32(00000000), ref: 004298E3

Part of subcall function 0041A638: CreateFontIndirectA.GDI32(?), ref: 0041A6F7

SelectObject.GDI32(00000000,00000000), ref: 004298F2
GetTextMetricsA.GDI32(00000000,?), ref: 004298FF
SelectObject.GDI32(00000000,00000000), ref: 00429906
ReleaseDC.USER32(00000000,00000000), ref: 0042990E
GetSystemMetrics.USER32(00000006), ref: 00429933
GetSystemMetrics.USER32(00000006), ref: 0042994D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 493c3e02d1035430593376a4cfe0bac28c29019347665ee68c3eba71a2dbb902
Instruction ID: 0ef879b540a67ceb128a5e1141d84f2d1524799c58b88ee5a2ee57f477153a9f
Opcode Fuzzy Hash: 493c3e02d1035430593376a4cfe0bac28c29019347665ee68c3eba71a2dbb902
Instruction Fuzzy Hash: 8401A19170971127F310667A9CC2B6F6688DB54368F44053EFA86963E3D96C8C81876E

Function 0041E274 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041E277
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041E281
ReleaseDC.USER32(00000000,00000000), ref: 0041E28E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041E29D
GetStockObject.GDI32(00000007), ref: 0041E2AB
GetStockObject.GDI32(00000005), ref: 0041E2B7
GetStockObject.GDI32(0000000D), ref: 0041E2C3
LoadIconA.USER32(00000000,00007F00), ref: 0041E2D4

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: db53187b583683c3da25eb47fc51b38c63e1255722fbf2352793706f85574c6b
Instruction ID: 718266ba1944efb5b46721f14e799226cd24d8dfc19287898d5783b558d94fa9
Opcode Fuzzy Hash: db53187b583683c3da25eb47fc51b38c63e1255722fbf2352793706f85574c6b
Instruction Fuzzy Hash: 1111FB70A453015AE340BFA69D52BAA3691D724709F00813BF608EF3D2DB7D5C809BAD

Function 00463E34 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00463F38
SetCursor.USER32(00000000,00000000,00007F02,00000000,00463FCD), ref: 00463F3E
SetCursor.USER32(?,00463FB5,00007F02,00000000,00463FCD), ref: 00463FA8

Strings

, xrefs: 004641CE
, xrefs: 004641B3
Internal error: Item already expanding, xrefs: 00463ED5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 2e72c9ebfc19e7403a65945d55937a119cc11725f60109d9f94943b84faf3f65
Instruction ID: aa82ab3995de3935e6727d947cb2bd0e3876d59c6d9623ce98a17a39b04bf081
Opcode Fuzzy Hash: 2e72c9ebfc19e7403a65945d55937a119cc11725f60109d9f94943b84faf3f65
Instruction Fuzzy Hash: 67B1E230A00244DFDB14DF65C549B9EBBF1AF45304F1584AAE8459B392E778EE84CB0A

Function 00454498 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0045457F

Strings

MoveFileEx, xrefs: 0045478F
NUL, xrefs: 00454641
[rename], xrefs: 004545E2, 0045461E
WININIT.INI, xrefs: 0045452D
.tmp, xrefs: 0045453B

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 7fc08df52904c59b3176bd425c815c443ddc94d3e7b0bfcf8c3a045116732771
Instruction ID: e87d0749b1697b84d3b9cc82c23e20e51564d8fa8ce324392089b518a873d649
Opcode Fuzzy Hash: 7fc08df52904c59b3176bd425c815c443ddc94d3e7b0bfcf8c3a045116732771
Instruction Fuzzy Hash: B8913334E001499BDB01EFA5D882BDEB7B5EF49309F508467E900BB292D77C9E49CB58

Function 0047E980 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047EAF4,?,?,?,?,00000000,0047EC49,?,?,?,00000000,?,0047ED58), ref: 0047EAD0
FindClose.KERNEL32(000000FF,0047EAFB,0047EAF4,?,?,?,?,00000000,0047EC49,?,?,?,00000000,?,0047ED58,00000000), ref: 0047EAEE

Strings

TG, xrefs: 0047EB72, 0047EA9F, 0047EAA5, 0047EB75
TG, xrefs: 0047E9C0, 0047E9D7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: TG$TG
API String ID: 2066263336-2531790037
Opcode ID: b0e8c0ab68be89f93ee12764341254d4567c72d9188f1650ca356d27e1af81f5
Instruction ID: 49c023a3d40347f396a503d53546bb693b8cfca30f5629bd36de7deb8458e88f
Opcode Fuzzy Hash: b0e8c0ab68be89f93ee12764341254d4567c72d9188f1650ca356d27e1af81f5
Instruction Fuzzy Hash: F5812C7490024D9FDF11DF96C841ADFBBB9EF4D304F1081EAE508A7291D6399A46CF54

Function 00408B70 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408DB8,?,?,?,?,00000000,00000000,00000000,?,00409DBF,00000000,00409DD2), ref: 00408B8A

Part of subcall function 004089B8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049D4C4,00000001,?,00408A83,?,00000000,00408B62), ref: 004089D6

Part of subcall function 00408A04: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00408C06,?,?,?,00000000,00408DB8), ref: 00408A17

Strings

mmmm d, yyyy, xrefs: 00408C7B
m/d/yy, xrefs: 00408C59
:mm, xrefs: 00408D6C
:mm:ss, xrefs: 00408D86
AMPM, xrefs: 00408D55

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: c69c3147cd56940e9f4fd8337a0fbc887525be67d32930313bc35b703755f031
Instruction ID: a8d7ab9d838d1b353a0e5ff474912d8a0235132b07344be0acb9e4c83fee81e1
Opcode Fuzzy Hash: c69c3147cd56940e9f4fd8337a0fbc887525be67d32930313bc35b703755f031
Instruction Fuzzy Hash: D8513D34B001486BDB01FBA5DA41A9F77A9DB98308F50947FB181BB7C6CE3CDA068759

Function 00411B44 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411D49), ref: 00411BDC
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 00411C9A

Part of subcall function 00411EFC: CreatePopupMenu.USER32 ref: 00411F16

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411D26

Part of subcall function 00411EFC: CreateMenu.USER32 ref: 00411F20

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 00411D0D

Strings

,, xrefs: 00411BEF
?, xrefs: 00411BF6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: c987c748b65508a950cf3f2169e5bd87e5634fb74b346734da7ef3b4f05fb7f7
Instruction ID: 125356fab78159fbe3d4b3b77ff780d7a0eb3536e5c02055c9c5492709250fea
Opcode Fuzzy Hash: c987c748b65508a950cf3f2169e5bd87e5634fb74b346734da7ef3b4f05fb7f7
Instruction Fuzzy Hash: 7D512674A001049BDB10EF6AED815EE7BF9EF08304B1141BAFA04E73A2E738D941CB58

Function 0041C2B3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041C378
GetObjectA.GDI32(?,00000018,?), ref: 0041C387
GetBitmapBits.GDI32(?,?,?), ref: 0041C3D8
GetBitmapBits.GDI32(?,?,?), ref: 0041C3E6
DeleteObject.GDI32(?), ref: 0041C3EF
DeleteObject.GDI32(?), ref: 0041C3F8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041C415

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 8204310b78e8d6a6cf9899529667619705c527fa466c5b93b01e90bd2c764378
Instruction ID: 7028de2688ff158aa25c0b8276400e232655bb6670dd4605646626e5bfc1af4e
Opcode Fuzzy Hash: 8204310b78e8d6a6cf9899529667619705c527fa466c5b93b01e90bd2c764378
Instruction Fuzzy Hash: F651F671E002199FCB50DFE9C8819EEB7F9EB48314B218066F914E7295D638AD81CB68

Function 0041D328 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041D34E
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041D36D
SelectPalette.GDI32(?,?,00000001), ref: 0041D3D3
RealizePalette.GDI32(?), ref: 0041D3E2
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041D44C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D48A
SelectPalette.GDI32(?,?,00000001), ref: 0041D4AF

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 11edf0dba9517228aa32d7039567d0e1bdcd43b434536bf7bada936ddc7c4efc
Instruction ID: 60201597840efc574cdf5035eb35bbfd27a544e021146ecd029e3556dfc27432
Opcode Fuzzy Hash: 11edf0dba9517228aa32d7039567d0e1bdcd43b434536bf7bada936ddc7c4efc
Instruction Fuzzy Hash: 305121B0A00604AFD714DFA9C985F9AB7F9EF08304F14859AB944D7392C778ED80CB58

Function 00457AD8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00457B2A

Part of subcall function 004246CC: GetWindowTextA.USER32(?,?,00000100), ref: 004246EC

Part of subcall function 0041F2F4: GetCurrentThreadId.KERNEL32 ref: 0041F343
Part of subcall function 0041F2F4: EnumThreadWindows.USER32(00000000,0041F2A4,00000000), ref: 0041F349

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457B91
TranslateMessage.USER32(?), ref: 00457BAF
DispatchMessageA.USER32(?), ref: 00457BB8

Strings

[Paused] , xrefs: 00457B60

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 8f39b929066e5dde17ef7bf9f49813106d9eceee4e0607b45077cfdd9f9bed8a
Instruction ID: d952aa0340fda6d06c899081e645d661bac1146de2c671e539639067201b9655
Opcode Fuzzy Hash: 8f39b929066e5dde17ef7bf9f49813106d9eceee4e0607b45077cfdd9f9bed8a
Instruction Fuzzy Hash: BB3196309082445EDB11DFB9E845FDE7BF8DB49318F5180B7E814E7292D67CA909CB29

Function 0046C0E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046C21F), ref: 0046C19C
LoadCursorA.USER32(00000000,00007F02), ref: 0046C1AA
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046C21F), ref: 0046C1B0
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046C21F), ref: 0046C1BA
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046C21F), ref: 0046C1C0

Strings

CheckPassword, xrefs: 0046C144

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: fb7cbc278dcb9edee9e8d2e5e9978fa6a8b16ca413f22061223fbaac6efefb0a
Instruction ID: ee4704442a97aa51a819b3d11b93b6eea7a80086b594a8aac8f18d25b90f0006
Opcode Fuzzy Hash: fb7cbc278dcb9edee9e8d2e5e9978fa6a8b16ca413f22061223fbaac6efefb0a
Instruction Fuzzy Hash: 063175346402449FD711EF69C8C9F9E7BE4AF49304F5580BAB9449B3E2E7789E40CB49

Function 00478EB4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00478DDC: GetWindowThreadProcessId.USER32(00000000), ref: 00478DE4
Part of subcall function 00478DDC: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478EDB,0049E0AC,00000000), ref: 00478DF7
Part of subcall function 00478DDC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00478DFD

SendMessageA.USER32(00000000,0000004A,00000000,0047926E), ref: 00478EE9
GetTickCount.KERNEL32 ref: 00478F2E
GetTickCount.KERNEL32 ref: 00478F38
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00478F8D

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 00478F76
CallSpawnServer: Unexpected response: $%x, xrefs: 00478F1E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: b2e1d8d59d79f67ca6a224e872d53bca437999279a7be28f50c91e0342c7e9be
Instruction ID: 2b74b3330966d0da2430542d23b63ad4dc4eec681a1128910255243e8f8c0985
Opcode Fuzzy Hash: b2e1d8d59d79f67ca6a224e872d53bca437999279a7be28f50c91e0342c7e9be
Instruction Fuzzy Hash: E0319374F502149ADB10EBB9884A7EE76A19F48304F50843EF148EB382DA7C4D0187A9

Function 00459F80 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045A03B

Strings

Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045A046
CreateAssemblyCache, xrefs: 0045A032
Fusion.dll, xrefs: 00459FDB
Failed to load .NET Framework DLL "%s", xrefs: 0045A020
.NET Framework CreateAssemblyCache function failed, xrefs: 0045A05E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: d95d5d40fddf0b6030493c953464f742ef4760e894d11a5ea04ccacfdf112554
Instruction ID: ac224aa19d502af52a8aeeb8631c7515eb40ef1487658bef2565bb8923ebe5d4
Opcode Fuzzy Hash: d95d5d40fddf0b6030493c953464f742ef4760e894d11a5ea04ccacfdf112554
Instruction Fuzzy Hash: 7931A971E006059FDB10EFA5C88169EB7B4AF44715F50867BE814E7382D7389E18C79A

Function 0041C598 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C498: GetObjectA.GDI32(?,00000018), ref: 0041C4A5

GetFocus.USER32 ref: 0041C5B8
GetDC.USER32(?), ref: 0041C5C4
SelectPalette.GDI32(?,?,00000000), ref: 0041C5E5
RealizePalette.GDI32(?), ref: 0041C5F1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C608
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C630
ReleaseDC.USER32(?,?), ref: 0041C63D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 13ad04b8ebeec00c1d7dbe87a4843d5f0ce23703817d7fa7e30356844582fb0f
Instruction ID: 5608d60df95c2c9a4937b8f20fdaccdf81dd4bf5f719291f5ec9f8ce647d196e
Opcode Fuzzy Hash: 13ad04b8ebeec00c1d7dbe87a4843d5f0ce23703817d7fa7e30356844582fb0f
Instruction Fuzzy Hash: 00116DB1A00619BBDF10DBA9CC85FAFB7FCEF48700F14446AB614E7281D67899008B28

Function 004190A4 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 004190C0
GetSystemMetrics.USER32(0000000D), ref: 004190C8
6F522980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 004190CE

Part of subcall function 00410C48: 6F51C400.COMCTL32(?,000000FF,00000000,004190FC,00000000,00419158,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 00410C4C

6F58CB00.COMCTL32(?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 0041911E
6F58C740.COMCTL32(00000000,?,?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00419129
6F58CB00.COMCTL32(?,00000001,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000), ref: 0041913C
6F520860.COMCTL32(?,0041915F,?,00000000,?,?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000,0000000E), ref: 00419152

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MetricsSystem$C400C740F520860F522980
String ID:
API String ID: 2856677924-0
Opcode ID: 3537cdd0f738fbfcd60e26d14cefecc9ad32e9dd8feb771d9bbef366dd2eac9a
Instruction ID: 9903b46d79d4c0b31f098cc3390b5efedd2ad94e5cf824da9eef417fc70482b9
Opcode Fuzzy Hash: 3537cdd0f738fbfcd60e26d14cefecc9ad32e9dd8feb771d9bbef366dd2eac9a
Instruction Fuzzy Hash: 0611B971B44204BBEB14EFA5CC87F9E73B9EB09704F504166B604EB2C1E5B99D848B58

Function 00485058 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00485110), ref: 004850F5

Strings

ProductType, xrefs: 00485094
LanmanNT, xrefs: 004850BF
ServerNT, xrefs: 004850D9
System\CurrentControlSet\Control\ProductOptions, xrefs: 0048507C
WinNT, xrefs: 004850A5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: f7ac7d87b6566833f8f94ca2fdfd92b371a3bfc49258f80580d53ac0ca8de827
Instruction ID: 02a49102d00d8724c0d73e8972acf5231ddb46999e19ea23a0f5791770e41de6
Opcode Fuzzy Hash: f7ac7d87b6566833f8f94ca2fdfd92b371a3bfc49258f80580d53ac0ca8de827
Instruction Fuzzy Hash: FE11B230A04644ABDB00F766DC56B5F7BA8DB42744F508877A800DB782D73D9E41975D

Function 0044CD48 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044CD18: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0044CD30

LoadLibraryA.KERNEL32(00000000,00000000,0044CE0A,?,?,?,?,00000000,00000000), ref: 0044CD92
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044CDA3
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044CDB3

Strings

LresultFromObject, xrefs: 0044CD9D
oleacc.dll, xrefs: 0044CD7F
CreateStdAccessibleObject, xrefs: 0044CDAD

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2141747552-1050967733
Opcode ID: ea022944773ab25f9a4076fd398f24179dfceb8cd9828e0392caa77096e119c9
Instruction ID: 55534d0cd89e21a5042de7d2cb1dd0110792ae2e246426a933e63f936c6ed6e6
Opcode Fuzzy Hash: ea022944773ab25f9a4076fd398f24179dfceb8cd9828e0392caa77096e119c9
Instruction Fuzzy Hash: 361151B0A01704AFF710EFA1DCC2B5A7BA8E758719F64047BE400666A1DBBD9D448A1C

Function 00496DF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00496E01

Part of subcall function 0041A638: CreateFontIndirectA.GDI32(?), ref: 0041A6F7

SelectObject.GDI32(00000000,00000000), ref: 00496E23
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004973A1), ref: 00496E37
GetTextMetricsA.GDI32(00000000,?), ref: 00496E59
ReleaseDC.USER32(00000000,00000000), ref: 00496E76

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00496E2E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: aae36943e4c039aea34424998f68ade3a8833365680bc7432fe66356b3d4646c
Instruction ID: 569e85929f3d385eaff6f9e1b1d1d5c6dd8a65a34f46b30b3a8bef4bdf425d44
Opcode Fuzzy Hash: aae36943e4c039aea34424998f68ade3a8833365680bc7432fe66356b3d4646c
Instruction Fuzzy Hash: 36018476A04608AFDB05DBE9CC41F5FB7ECDB49704F11047ABA04E7281D678AE008B68

Function 0041B8B2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B8C0
SelectObject.GDI32(?,00000000), ref: 0041B8CF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B8FB
SelectObject.GDI32(00000000,00000000), ref: 0041B909
SelectObject.GDI32(?,00000000), ref: 0041B917
DeleteDC.GDI32(00000000), ref: 0041B920
DeleteDC.GDI32(?), ref: 0041B929

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: c5d1e2e3ff328356a4e4238c7f450765dbf7839f38aeea7c0d55facf19ccd353
Instruction ID: b8528283d587f8f5f7158778d976388ea9280e6d202ec49eeb693ac58173ed71
Opcode Fuzzy Hash: c5d1e2e3ff328356a4e4238c7f450765dbf7839f38aeea7c0d55facf19ccd353
Instruction Fuzzy Hash: 5A118EB2F04619ABDB10D6DDC885FEFB7BCEB08314F044415B614FB241C678AD418B54

Function 004237E4 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004237FF
WindowFromPoint.USER32(?,?), ref: 0042380C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042381A
GetCurrentThreadId.KERNEL32 ref: 00423821
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042383A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423851
SetCursor.USER32(00000000), ref: 00423863

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: bca67253d695687129505d4dd6b4be75de0481567bd8dbfc76009214d22bf118
Instruction ID: d55a13ab3e3fc67d9c1f0c697d1027359b93869cc9afd0973a071b09e334c979
Opcode Fuzzy Hash: bca67253d695687129505d4dd6b4be75de0481567bd8dbfc76009214d22bf118
Instruction Fuzzy Hash: 9901D42230521036D6207B7A5C86E2F22E8CBC5B65F51443FB609BF282D93D8C01976D

Function 00496C14 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00496C24
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00496C31
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00496C3E

Strings

MonitorFromRect, xrefs: 00496C2B
GetMonitorInfoA, xrefs: 00496C38
user32.dll, xrefs: 00496C1F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 1a62ebb246959f38fae6f97a16ae9b6e3f147e8fdc483f677f644595477796c0
Instruction ID: 0100053a3692f287516410ec157e21cb1b88c24c6f2ed11ec452f60a58bd69cd
Opcode Fuzzy Hash: 1a62ebb246959f38fae6f97a16ae9b6e3f147e8fdc483f677f644595477796c0
Instruction Fuzzy Hash: 5AF0F692701B1526DA1025764C81B7B698CCBC27A0F060037BD85A7382E9AD9C0552AD

Function 0045D984 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D98D
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D99D
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D9AD

Strings

ISCryptGetVersion, xrefs: 0045D987
ArcFourCrypt, xrefs: 0045D9A7
ArcFourInit, xrefs: 0045D997

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: a120c3d2ef62b36cbcf1f94c94fb794ce275c00622819f97a022044a312cbe17
Instruction ID: 0705cba7109997b41c54f5ec5154c4026f190107a5f336fc7dc4235633f43cad
Opcode Fuzzy Hash: a120c3d2ef62b36cbcf1f94c94fb794ce275c00622819f97a022044a312cbe17
Instruction Fuzzy Hash: E9F030F1901620EBF314EF77AC457273695EBA4302F14843BA445E11B2D7BA085AEA2C

Function 0045DE84 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045DE8D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045DE9D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045DEAD

Strings

BZ2_bzDecompressInit, xrefs: 0045DE87
BZ2_bzDecompressEnd, xrefs: 0045DEA7
BZ2_bzDecompress, xrefs: 0045DE97

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 69782b4271ac4a522c1cbf050024bd159fbeab52ed8ba1f2270972ee26ec74bc
Instruction ID: ffc1661d06bbefe96a91e36acebf6432405697aaa326f86a6f465272ccde7cfc
Opcode Fuzzy Hash: 69782b4271ac4a522c1cbf050024bd159fbeab52ed8ba1f2270972ee26ec74bc
Instruction Fuzzy Hash: 84F01DB1D00A18DED724DF37AC4A72736D5EF74316F08843BA9465A2A2D7B80858DF1D

Function 0042EE6C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000,00482671), ref: 0042EE85
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE8B
InterlockedExchange.KERNEL32(0049D66C,00000001), ref: 0042EE9C

Part of subcall function 0042EDFC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EEC0,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EE12
Part of subcall function 0042EDFC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE18
Part of subcall function 0042EDFC: InterlockedExchange.KERNEL32(0049D664,00000001), ref: 0042EE29

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EEB0

Strings

ChangeWindowMessageFilterEx, xrefs: 0042EE7B
user32.dll, xrefs: 0042EE80

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 147ab314087a4e3dcf6e16000bf7a92f8a6b53821ee1abd9afb0821482d3c5ed
Instruction ID: d923442659e3b0e51499426f76f6993fec2ee5a704375d7ef0c30b5e995126c2
Opcode Fuzzy Hash: 147ab314087a4e3dcf6e16000bf7a92f8a6b53821ee1abd9afb0821482d3c5ed
Instruction Fuzzy Hash: 1AE06DF1B40724AAEF107B766C86B9B2668EB50769F55003BF104A61E1C7FD0C408A6C

Function 00479E68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0049A50C), ref: 00479E6E
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00479E7B
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00479E8B

Strings

kernel32.dll, xrefs: 00479E69
VerifyVersionInfoW, xrefs: 00479E85
VerSetConditionMask, xrefs: 00479E75

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 4eb8c5683a80416fa23ca28207be772c3a68f7a3a60c78b74a0383d4a233a3f9
Instruction ID: 2eb801612c02c2f681ec2550ef92dd2b82403b3208254216f30f7223daafca7c
Opcode Fuzzy Hash: 4eb8c5683a80416fa23ca28207be772c3a68f7a3a60c78b74a0383d4a233a3f9
Instruction Fuzzy Hash: BFC0C9E1680710A9D600F7725C82DBB2548D510B25310883FB499651D2E7BD0C144A2C

Function 0041BABC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BB95
GetDC.USER32(?), ref: 0041BBA1
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BBD6
RealizePalette.GDI32(00000000), ref: 0041BBE2
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC10
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BC44

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: 2f364fcd98ee6a1d62b7c654a57492f5fb96a9e1e42606f87797115b42be741f
Instruction ID: d5c29bb792210f064481fc70285f12689ccfb8d13ad776c980584781b3891df8
Opcode Fuzzy Hash: 2f364fcd98ee6a1d62b7c654a57492f5fb96a9e1e42606f87797115b42be741f
Instruction Fuzzy Hash: E4511E74A002099FCF11DFA9C895AEEBBB5FF49704F10406AF500A7790D779AD81CBA9

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BE67
GetDC.USER32(?), ref: 0041BE73
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BEAD
RealizePalette.GDI32(00000000), ref: 0041BEB9
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BEDD
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BF11

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: 6a42abb991037a6bf202db87d3771568c300b6986fb43c24206afdf92edcb334
Instruction ID: 6bf5c6e251c24ad455d3524f1730cbba616f151bd8f8db37d5e0169c444cf9bf
Opcode Fuzzy Hash: 6a42abb991037a6bf202db87d3771568c300b6986fb43c24206afdf92edcb334
Instruction Fuzzy Hash: FD511875A002089FCB11DFA9C891AAEBBF5FF49700F11846AF504EB390D7789D40CBA8

Function 0041B958 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B9CE
GetDC.USER32(?), ref: 0041B9DA
GetDeviceCaps.GDI32(?,00000068), ref: 0041B9F6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041BA13
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041BA2A
ReleaseDC.USER32(?,?), ref: 0041BA76

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: aaad342ca44b07dec6af6486a8a42c1cb8d3efc41e270446eeb3d15c1de1c0ff
Instruction ID: 59801f7e5fcc4ac8ef53bb63f5e7b2fd9dc64a74171921ba3453a8653c00992f
Opcode Fuzzy Hash: aaad342ca44b07dec6af6486a8a42c1cb8d3efc41e270446eeb3d15c1de1c0ff
Instruction Fuzzy Hash: A941C371A042189FCB10DFB9C885A9FBBB4EF49740F1484AAF940EB351D2389D11CBA5

Function 0045D848 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D914,?,?,?,?,00000000), ref: 0045D8B3
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D980,?,00000000,0045D914,?,?,?,?,00000000), ref: 0045D8F2

Strings

CLASSES_ROOT, xrefs: 0045D878
USERS, xrefs: 0045D8A5
MACHINE, xrefs: 0045D896
CURRENT_USER, xrefs: 0045D887

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: bceaa7c9d38e855be30fb0ce12922fb4a40a0d74626b7c5ce76b3f9998da2675
Instruction ID: 7ee2480e64cf5dcc37247868779a06df4fe5ff89f2b42202383772de8024ccfa
Opcode Fuzzy Hash: bceaa7c9d38e855be30fb0ce12922fb4a40a0d74626b7c5ce76b3f9998da2675
Instruction Fuzzy Hash: 4811BB75A04204AFE731EBE1C941B9E76ADDF44306F604077AD0496383D67C5F0A952D

Function 0041C1DC Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041C225
GetSystemMetrics.USER32(0000000C), ref: 0041C22F
GetDC.USER32(00000000), ref: 0041C239
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041C260
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041C26D
ReleaseDC.USER32(00000000,00000000), ref: 0041C2A6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3e92d3a5d6c5ecb792e0ebd5600fae34c9b68402c42568e6e1a494463c386ac3
Instruction ID: bd62dbbe377736d475eb9c8390e540ebf9edbe2df99a0055a8dbd9c6863756d8
Opcode Fuzzy Hash: 3e92d3a5d6c5ecb792e0ebd5600fae34c9b68402c42568e6e1a494463c386ac3
Instruction Fuzzy Hash: CA214A74E44608AFEB00EFE9C942BEEB7B4EB48700F10806AF514B7381D6785940CB69

Function 00474770 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045D848: SetLastError.KERNEL32(00000057,00000000,0045D914,?,?,?,?,00000000), ref: 0045D8B3

GetLastError.KERNEL32(00000000,00000000,00000000,00474844,?,?,0049E1E4,00000000), ref: 004747FD
GetLastError.KERNEL32(00000000,00000000,00000000,00474844,?,?,0049E1E4,00000000), ref: 00474813

Strings

I, xrefs: 00474785
Setting permissions on registry key: %s\%s, xrefs: 004747C2
Could not set permissions on the registry key because it currently does not exist., xrefs: 00474807
Failed to set permissions on registry key (%d)., xrefs: 00474824

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s$I
API String ID: 1452528299-1959139981
Opcode ID: fa1a9a8d389e764d463da442ef7f1c9e05787aef6c03ccc219f4a1874d89d582
Instruction ID: 89f83d431bb9d789a293ecef52b9ab2aae7d8ed3921fa29d9781309811a141fd
Opcode Fuzzy Hash: fa1a9a8d389e764d463da442ef7f1c9e05787aef6c03ccc219f4a1874d89d582
Instruction Fuzzy Hash: 15217774A042485FDB00EBA9C8416FEBBE8DB89314F51817BE414E7392DB785D058BAA

Function 0047FA5C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047FA6A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046DA09), ref: 0047FA90
GetWindowLongA.USER32(?,000000EC), ref: 0047FAA0
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047FAC1
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047FAD5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047FAF1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: abe530f147a2c3f98821beb69050e02df951cc1f08551c366297f014f152c27b
Instruction ID: ffd9c37a1d4b3a018da72acb707aca8a1d598a80d0625303fdebb2ead6bb840a
Opcode Fuzzy Hash: abe530f147a2c3f98821beb69050e02df951cc1f08551c366297f014f152c27b
Instruction Fuzzy Hash: D301E9B6A54210ABD600DB78CD41F6637E8AB0C310F0A4776FA5DDF3E3C679D8048A08

Function 0041B6C0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041AB30: CreateBrushIndirect.GDI32 ref: 0041AB9B

UnrealizeObject.GDI32(00000000), ref: 0041B6CC
SelectObject.GDI32(?,00000000), ref: 0041B6DE
SetBkColor.GDI32(?,00000000), ref: 0041B701
SetBkMode.GDI32(?,00000002), ref: 0041B70C
SetBkColor.GDI32(?,00000000), ref: 0041B727
SetBkMode.GDI32(?,00000001), ref: 0041B732

Part of subcall function 0041A4A8: GetSysColor.USER32(?), ref: 0041A4B2

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 591f5e0a38fc1ca3dbe863e806ec08e439b2c286ec032ca355b2d19c4403f824
Instruction ID: 4060aa1d5abe481981ad85160ceff6bfe730d60da31349b060da60163fdb8f1a
Opcode Fuzzy Hash: 591f5e0a38fc1ca3dbe863e806ec08e439b2c286ec032ca355b2d19c4403f824
Instruction Fuzzy Hash: AAF0CD75601100ABDE04FFBADACAE4B77989F043097048057B908DF197CA7CE8A08B3A

Function 00499644 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

ShowWindow.USER32(?,00000005,00000000,004998A9,?,?,00000000), ref: 0049967A

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 004076F8: SetCurrentDirectoryA.KERNEL32(00000000,?,004996A2,00000000,00499875,?,?,00000005,00000000,004998A9,?,?,00000000), ref: 00407703

Part of subcall function 0042D89C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D92A,?,?,?,00000001,?,0045681A,00000000,00456882), ref: 0042D8D1

Strings

IMsg, xrefs: 0049974E
.msg, xrefs: 004996E0
Uninstall, xrefs: 00499660
.dat, xrefs: 004996C1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: b59174c22afc0cb4d84e45ba041c7c5ab1d45157887829cd53cd9da25efcf179
Instruction ID: 4da38b6a349b60b5a60df07f01633cb26419001f7db46277bbb3aa66fc0d4d29
Opcode Fuzzy Hash: b59174c22afc0cb4d84e45ba041c7c5ab1d45157887829cd53cd9da25efcf179
Instruction Fuzzy Hash: A1313074A10114AFCB01FFAACC5295E7B75FB49318B51887AF800A7352EB39AD04CB59

Function 0042EEF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EF2A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EF30
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EF59

Strings

ShutdownBlockReasonCreate, xrefs: 0042EF20
user32.dll, xrefs: 0042EF25

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: 0a1a7f0b35af10bec52672da06a2906d532a44599cf47327945e1bb0849fc05d
Instruction ID: 50bd107db23699165094570332042a9a2090c4fb9dd7a9a9ac1c8e9692f1be1d
Opcode Fuzzy Hash: 0a1a7f0b35af10bec52672da06a2906d532a44599cf47327945e1bb0849fc05d
Instruction Fuzzy Hash: D7F0F0E134062237E620B27FAC86F7F55CC8F94729F150036B608EA2C2EA7C9905426F

Function 0042EDFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EEC0,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EE12
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE18
InterlockedExchange.KERNEL32(0049D664,00000001), ref: 0042EE29

Strings

ChangeWindowMessageFilter, xrefs: 0042EE08
user32.dll, xrefs: 0042EE0D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 2ae9261505c9f67baa706182e7b3239f9e45ce3b55a3ca64683e2b7ae62260b5
Instruction ID: 37ab6c1781d9ace597be808b0f82a5ae7151ca86b9dce60fc565c366ef428a29
Opcode Fuzzy Hash: 2ae9261505c9f67baa706182e7b3239f9e45ce3b55a3ca64683e2b7ae62260b5
Instruction Fuzzy Hash: 76E0ECB1B41320AAEA1137726C8AF5726559B2471DF950437F108671E2C6FC1C84C91D

Function 00478DDC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00478DE4
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478EDB,0049E0AC,00000000), ref: 00478DF7
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00478DFD

Strings

user32.dll, xrefs: 00478DF2
AllowSetForegroundWindow, xrefs: 00478DED

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: baaddf851ddbcde89e908f2650d0d7dd5a96bc2ff5b27e890b2c54087906d01e
Instruction ID: c95bb4f0dd120990503e7052118a19d741abdcedadff55ee9c16c600a1fe714f
Opcode Fuzzy Hash: baaddf851ddbcde89e908f2650d0d7dd5a96bc2ff5b27e890b2c54087906d01e
Instruction Fuzzy Hash: EFD09EB168060165E910B3B69D4AE9B235C89847647248C3FB458E2586DF7CD894457D

Function 0041707C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 004170A2
SaveDC.GDI32(?), ref: 004170D3
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00417195), ref: 00417134
RestoreDC.GDI32(?,?), ref: 0041715B
EndPaint.USER32(00000000,?,0041719C,00000000,00417195), ref: 0041718F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: d3cb791d7785fb4fc35c1181fb0c895e71633609ec102f90fedaf0bd5e116ec9
Instruction ID: 2d0e89e5730252ba578d2efb55dda1d595b63161fefa896777b830b1b9f6ffa1
Opcode Fuzzy Hash: d3cb791d7785fb4fc35c1181fb0c895e71633609ec102f90fedaf0bd5e116ec9
Instruction Fuzzy Hash: 9B412170A08204AFDB04DFA5C985FAA77F9FF48314F1544AEE4059B362C7789D85CB18

Function 00414C50 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414C86
MulDiv.KERNEL32(?,?,?), ref: 00414CA0
MulDiv.KERNEL32(?,?,?), ref: 00414CC9
MulDiv.KERNEL32(?,?,?), ref: 00414CF4
MulDiv.KERNEL32(00000000,?,00000000), ref: 00414D3C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea1a8f7c9869be2cd73ede4559f3beb1d50bc075a71ac7122178a7397227914
Instruction ID: f067b59d413d1c4671d71e094a7f62e666ee1dcd53ee7561759f320ec3b01eff
Opcode Fuzzy Hash: eea1a8f7c9869be2cd73ede4559f3beb1d50bc075a71ac7122178a7397227914
Instruction Fuzzy Hash: 6F314F70605740AFC720EF69D984BABB7E8AF89314F04891EF9D5C7751D638EC808B59

Function 0041C008 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041C01A
GetSystemMetrics.USER32(0000000C), ref: 0041C024
GetDC.USER32(00000000), ref: 0041C062
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041C0A9
DeleteObject.GDI32(00000000), ref: 0041C0EA

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: e9779dfffb4f21f61e506df0ae377518d2b748fc237c0f7807fdb933fd26a7eb
Instruction ID: f919feb2cfdf9cb53746996a9db251afb7e4286801c3fccb61a5d2ca1bdc7bf1
Opcode Fuzzy Hash: e9779dfffb4f21f61e506df0ae377518d2b748fc237c0f7807fdb933fd26a7eb
Instruction Fuzzy Hash: A3313E74A40205EFDB04DFA5C981AAEB7F5EB48704F11856AF510AB381D7789E80DB98

Function 00429C1C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429C58
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429C87
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429CA3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429CCE
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429CEC

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5ef5cab32e95011e4c7cfb0abff5a7214c11a7d164d3b5ed8cb8a22c4c4654b6
Instruction ID: 0478e77fbb77d274a7bfb783d11adee83c5a4069cdde94f0426c34ba09fc350e
Opcode Fuzzy Hash: 5ef5cab32e95011e4c7cfb0abff5a7214c11a7d164d3b5ed8cb8a22c4c4654b6
Instruction Fuzzy Hash: 222190707107147AE710AFA7DC82F4B76EC9B40704F90443E7906AB2D2DAB8ED41861D

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 67daf853af92f19bd36af3157ccd0aae30d6e3cf77030be0de76c974993ddc75
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: 67daf853af92f19bd36af3157ccd0aae30d6e3cf77030be0de76c974993ddc75
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 00414830 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414869
RealizePalette.GDI32(00000000), ref: 00414871
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414885
RealizePalette.GDI32(00000000), ref: 0041488B
ReleaseDC.USER32(00000000,00000000), ref: 00414896

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: fa3b9403a46652b92fdf4541f93f936de0ad42420f7af6617674ce52f43e61da
Instruction ID: aeb03e62d8ddadf83c94429ec28f403801e3a8d1cb621d3e7bfc21001d019430
Opcode Fuzzy Hash: fa3b9403a46652b92fdf4541f93f936de0ad42420f7af6617674ce52f43e61da
Instruction Fuzzy Hash: 3201DF7520C3806AD600B63D8C85A9F6BEC9FCA314F15946EF484DB3C2CA7AC8018761

Function 004073F4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407453
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 004074CD
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 00407525

Strings

Z, xrefs: 0040748C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: ef725f5677505cc1ece444b72ce86a205eac34b3eeee73834d2775d04d947be5
Instruction ID: 2310e9831ee7c99a0a8649866770d0a98cc310fb2cf5807583ec8a4e9daa3455
Opcode Fuzzy Hash: ef725f5677505cc1ece444b72ce86a205eac34b3eeee73834d2775d04d947be5
Instruction Fuzzy Hash: 41519070E04208AFDB11DF99C845A9EBBB9EB49314F1448BAE400B72D1D778AE418B5A

Function 0044D598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D626
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D651
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D6D9

Strings

, xrefs: 0044D60B

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 118ce66f65fc30a3616beabd50b84bb536d9a0cd1ba8fe4db387a67cc8cfb132
Instruction ID: 5f00bac91b28cdab45bfb944687f04cfacea2c0ae70fe3b1c590f7ffbabf3d5b
Opcode Fuzzy Hash: 118ce66f65fc30a3616beabd50b84bb536d9a0cd1ba8fe4db387a67cc8cfb132
Instruction Fuzzy Hash: 7C517271E00248AFDB11DFA9C885BDEBBF8AF49304F15847AE805EB252D7389944CB64

Function 0042F400 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042F42A

Part of subcall function 0041A638: CreateFontIndirectA.GDI32(?), ref: 0041A6F7

SelectObject.GDI32(?,00000000), ref: 0042F44D
ReleaseDC.USER32(00000000,?), ref: 0042F52C

Strings

...\, xrefs: 0042F4DE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: d1b66580af5f8b118005d8afe4c27e7b3c53fe3fbe43e40283f5066ed8c29eea
Instruction ID: 21909acc4746510f695b318a8719c62c66087a48e53e42bcbae852ee139bb065
Opcode Fuzzy Hash: d1b66580af5f8b118005d8afe4c27e7b3c53fe3fbe43e40283f5066ed8c29eea
Instruction Fuzzy Hash: E1314270B00229ABDB11EF9AD851BAEB7F9EB48308F90447BF410A7291C7785E45CA59

Function 00454024 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454113
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454123

Strings

_iu, xrefs: 004540B5
.tmp, xrefs: 004540C7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 2a078343c1ee0e1e426b7682a7e14f96dd8f6dbcb1786daf15018a65187b9764
Instruction ID: 59545500d2eeb09234598e35ee9a1648d273934097dc79d2b475452d37d3be57
Opcode Fuzzy Hash: 2a078343c1ee0e1e426b7682a7e14f96dd8f6dbcb1786daf15018a65187b9764
Instruction Fuzzy Hash: 8431C570E00209ABCF11EB95C942BEEBBB5AF54309F20452AF900BB3D2D7385F459759

Function 00416860 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004168CF
UnregisterClassA.USER32(?,00400000), ref: 004168FB
RegisterClassA.USER32(?), ref: 0041691E

Strings

@, xrefs: 00416879

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 9f70a0ac69facbd643e5dc069cf4c50d07a0174cb3081c66f42998cae8c8bb67
Instruction ID: c7ae62685634f2feb307fa6559a912500e41153472d9d2bb59c10c8b55fc2cbc
Opcode Fuzzy Hash: 9f70a0ac69facbd643e5dc069cf4c50d07a0174cb3081c66f42998cae8c8bb67
Instruction Fuzzy Hash: C6318E706043008BDB10EF68C885B9B77E9AB89308F00457FF985DB392DB39DD458B5A

Function 00499AF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,0049A448,00000000,00499BEE,?,?,00000000,0049D62C), ref: 00499B68
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0049A448,00000000,00499BEE,?,?,00000000,0049D62C), ref: 00499B91
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00499BAA

Strings

isRS-%.3u.tmp, xrefs: 00499B47

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: 88eac6fa2fd00287dbaa55a3b9bd3a1b65409462b653a3bc96acdfff81af7d31
Instruction ID: 0b841a000e743cb9e8da0cfb8565bc532e10ded45a2cf007f5af54a585f9ef1c
Opcode Fuzzy Hash: 88eac6fa2fd00287dbaa55a3b9bd3a1b65409462b653a3bc96acdfff81af7d31
Instruction Fuzzy Hash: 54212171D14119ABCF00EBA9D881AAFBBB8BB58314F11457EA814B72D1D63C6E018A59

Function 00457398 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042CC54: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CC78

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 004573EC
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00457419

Strings

RegisterTypeLib, xrefs: 00457424
LoadTypeLib, xrefs: 004573F7

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 18df84fe9d86e2862f6386675fb05e4dd3e507c86707e069f339337bab75705e
Instruction ID: 195147ed2e8b8ae7ced7006412bb8845aee82bd7b9f018cfdf51d436bcb33606
Opcode Fuzzy Hash: 18df84fe9d86e2862f6386675fb05e4dd3e507c86707e069f339337bab75705e
Instruction Fuzzy Hash: C911D630B04204BFDB01DFA6DC51A4EBBADEB4A305F108076FD04D3652DA389E04C618

Function 00457950 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045796A
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457A07

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00457996
Failed to create DebugClientWnd, xrefs: 004579D0

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 96d37884a0109ccc9dd8bbdd55bd34cbe6755c3aabe39c11de9650ea9973cdf2
Instruction ID: b12cfe17c44d9b7297a0742d7ace06ebf4c30bfebd2037bde928bbf0dce3c7c1
Opcode Fuzzy Hash: 96d37884a0109ccc9dd8bbdd55bd34cbe6755c3aabe39c11de9650ea9973cdf2
Instruction Fuzzy Hash: 1311C4B16082509BE310AB299C81B5F77949B54319F04443BF9849F383D3B99C18C7AE

Function 00479934 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

GetFocus.USER32 ref: 0047999F
GetKeyState.USER32(0000007A), ref: 004799B1
WaitMessage.USER32(?,00000000,004799D8,?,00000000,004799FF,?,?,00000001,00000000,?,?,0048174F,00000000,00482671), ref: 004799BB

Strings

Wnd=$%x, xrefs: 00479983

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: c7714a687ecd515da0b3d99d6b7bbb34f6b1e8ac2199ab9b74b109a4a99a3c73
Instruction ID: 0ce6ec70c77c992717eb959f135b56f98f7128e6f958ad4e09c8363bf76ba6b5
Opcode Fuzzy Hash: c7714a687ecd515da0b3d99d6b7bbb34f6b1e8ac2199ab9b74b109a4a99a3c73
Instruction Fuzzy Hash: 0511A3B0604244AFDB00FF69D842ADEB7B8EB49704B51C5BBF508E7381D738AD00CA69

Function 0046F428 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046F430
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046F43F

Strings

(invalid), xrefs: 0046F4C2
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046F4B4

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: b3309c05ae6708dc9511693656f5da53199351be95235e45feba58672e8eaade
Instruction ID: b1f3f51ab816b97a6d4fd488e4796d5760ecc8acc51059d8482d4647201c4143
Opcode Fuzzy Hash: b3309c05ae6708dc9511693656f5da53199351be95235e45feba58672e8eaade
Instruction Fuzzy Hash: F111F5A040C3919AD340DF2AC44072BBAE4AB99708F44896FF9C8D6381E779C948DB67

Function 004546DE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 004546EB

Part of subcall function 004073A0: DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

MoveFileA.KERNEL32(00000000,00000000), ref: 00454710

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

DeleteFile, xrefs: 004546FC
MoveFile, xrefs: 00454719

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: cd51b7d6411f51ddff926bfb4089fa62fb2906befb808aa5ea3769e8c14f62c4
Instruction ID: 274a2e09890dd6abd1f20e60e4879b25532b4b8e44e7f96c1dbb1ac345d4d7c6
Opcode Fuzzy Hash: cd51b7d6411f51ddff926bfb4089fa62fb2906befb808aa5ea3769e8c14f62c4
Instruction Fuzzy Hash: 53F08B746141445BE701FBA5D94265FA7ECEB8431EF50403BB800BB6C3DB3C9D08492D

Function 00484FB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00484FF1
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00485014

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00484FBE
CSDVersion, xrefs: 00484FE8

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 8d7ca411ea9e754ca79f01cf2f30b9d2c9f8e2d0c9492ca206519446712ee48d
Instruction ID: 3d9820a6fde95d05ac542d305ffe0a0e534a7c1f4e1b62a11fb8fb702f882c01
Opcode Fuzzy Hash: 8d7ca411ea9e754ca79f01cf2f30b9d2c9f8e2d0c9492ca206519446712ee48d
Instruction Fuzzy Hash: E7F04975A40608E6DF10FAD18C55BDF73BCAB05704F604967E510E7281E7399A049BAE

Function 00465214 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044BB28: LoadLibraryA.KERNEL32(00000000,00000000,0044BF0B,?,?,?,?,00000000,00000000,?,0044FD4D,0049A4DA), ref: 0044BB8A
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044BBA2
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044BBB4
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044BBC6
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044BBD8
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBEA
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBFC
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044BC0E
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044BC20
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044BC32
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044BC44
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044BC56
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044BC68
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044BC7A

Part of subcall function 004651E8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004651FB

LoadLibraryA.KERNEL32(00000000,SHPathPrepareForWriteA,00000000,0046528A,?,?,?,?,00000000,00000000,?,0049A502), ref: 0046525F
GetProcAddress.KERNEL32(00000000,00000000), ref: 00465265

Strings

SHPathPrepareForWriteA, xrefs: 00465231
shell32.dll, xrefs: 0046524C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad$DirectorySystem
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 1442766254-2683653824
Opcode ID: 19c949dbb77f1a78b4d411d9c1a27eb2db95fd8b53bd2c0869d9e8e17518ae75
Instruction ID: 415eb7409d81aa8454bb2dd4c72fa8b3e514a75415032da6adba06dceafb32ff
Opcode Fuzzy Hash: 19c949dbb77f1a78b4d411d9c1a27eb2db95fd8b53bd2c0869d9e8e17518ae75
Instruction Fuzzy Hash: F5F04470640A08BFD700FB62DC53F5E7BACEB45718FA044B7B400B6591EA7C9E04892D

Function 00459B60 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459C9D,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459BAD

Strings

InstallRoot, xrefs: 00459B9C
.NET Framework not found, xrefs: 00459BBC
SOFTWARE\Microsoft\.NETFramework, xrefs: 00459B80

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: deea85188aa12689871c1150ceca2f68809688995ae8b7fb4ba5acb78cb4dab7
Instruction ID: 9ff5366a1843594bb80037a440052cb9e88b760eaf161db27522a6c9f4c26c6f
Opcode Fuzzy Hash: deea85188aa12689871c1150ceca2f68809688995ae8b7fb4ba5acb78cb4dab7
Instruction Fuzzy Hash: 2AF0AF31300121EBEB10EB17AC41B5E6789DB91316F18443BFA81C7253F6BCDC46862E

Function 0042DD40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,004542C2,00000000,00454365,?,?,00000000,00000000,00000000,00000000,00000000,?,00454755,00000000), ref: 0042DD5A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042DD60

Strings

GetSystemWow64DirectoryA, xrefs: 0042DD50
kernel32.dll, xrefs: 0042DD55

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 5abbe40046ba00350f24005cef1803a495b962ffc597d09d0b22329c5a666800
Instruction ID: 2c7f72bc3db4c40d16b1b765d912767d34fa58fe4c646cc18e222b4ed7f6fe44
Opcode Fuzzy Hash: 5abbe40046ba00350f24005cef1803a495b962ffc597d09d0b22329c5a666800
Instruction Fuzzy Hash: 0FE02660B60F1113D70071BA5C8379B208D4B84718F90043F3984F52C6DDBDD9490A6E

Function 0042EFA4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EF20), ref: 0042EFB2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EFB8

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EFA8
user32.dll, xrefs: 0042EFAD

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: baf4c7a8591a40d7dc6da6f15e5b4dc27338d30cfca151258ddc16df194b77c5
Instruction ID: 02ec898c6c75b1ba26151a3eebd585b8454ae7040b346800783755fde70e6890
Opcode Fuzzy Hash: baf4c7a8591a40d7dc6da6f15e5b4dc27338d30cfca151258ddc16df194b77c5
Instruction Fuzzy Hash: 01D0A993302B3332AA1071FB3DC19BB02CC8D202AA3670033F600E2280EA8CCC4012AC

Function 0044FD1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049A4DA), ref: 0044FD57
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044FD5D

Strings

NotifyWinEvent, xrefs: 0044FD4D
user32.dll, xrefs: 0044FD52

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: 21449735c4530238711e5baf3f7e6c6119c4b5ed48e58139290ccade4ce38153
Instruction ID: af032255d430417ffea63134fe83afc5c4b4dbba1536058c56e775f9f11b8dd5
Opcode Fuzzy Hash: 21449735c4530238711e5baf3f7e6c6119c4b5ed48e58139290ccade4ce38153
Instruction Fuzzy Hash: B2E012E0E417449AFB00BBB96D467193AD0EF6471DF10007FB540A6291C77C44489B1D

Function 0049A250 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049A530,00000001,00000000,0049A554), ref: 0049A25A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049A260

Strings

user32.dll, xrefs: 0049A255
DisableProcessWindowsGhosting, xrefs: 0049A250

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 51550ffda035ac84042d4bddea94f20537adf7cd2f58fd56988f617bc6aacde1
Instruction ID: dac1c8ebddd32ae9bf6a035aad1c8d1f3cf840f271d0053423bdda14aa0d062e
Opcode Fuzzy Hash: 51550ffda035ac84042d4bddea94f20537adf7cd2f58fd56988f617bc6aacde1
Instruction Fuzzy Hash: 09B09281686A01509C4033F20C06A1B0E08484171871800B73400F12C6CE6E842404FF

Function 00476744 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042F2BC: GetTickCount.KERNEL32 ref: 0042F2C2

Part of subcall function 0042F0D8: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042F10D

GetLastError.KERNEL32(00000000,004768B9,?,?,0049E1E4,00000000), ref: 004767A2

Strings

MoveFileEx, xrefs: 00476807
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00476877
, xrefs: 004767DA, 004767F5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: 8eaaafc540fa06bad9d6eea7ef7bbf1a6ac798413101102947ce635ddcc39cda
Instruction ID: 03a236e7dc5f504d91790a0ce298dd5dba96fa6117a2cc3ee4ad00c9fc2b7c38
Opcode Fuzzy Hash: 8eaaafc540fa06bad9d6eea7ef7bbf1a6ac798413101102947ce635ddcc39cda
Instruction Fuzzy Hash: 53418474A006098BCB00EFA5D882ADE77B9EF48314F52853BE414B7391D7389E05CBAD

Function 00414148 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00414196
GetDesktopWindow.USER32 ref: 0041424E

Part of subcall function 00419310: 6F58C6F0.COMCTL32(00000000,?,0041427E,?,?,?,?,00413F43,00000000,00413F56), ref: 0041932C
Part of subcall function 00419310: ShowCursor.USER32(00000001,00000000,?,0041427E,?,?,?,?,00413F43,00000000,00413F56), ref: 00419349

SetCursor.USER32(00000000,?,?,?,?,00413F43,00000000,00413F56), ref: 0041428C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: cfce6284985b2a2f885b46e24aab87199b3bad27be3208afe6f8a3dae0a7e5f2
Instruction ID: 6a264f145c0982e92da272f414c83554030b66ece25ea6070dcdf00fca6814f6
Opcode Fuzzy Hash: cfce6284985b2a2f885b46e24aab87199b3bad27be3208afe6f8a3dae0a7e5f2
Instruction Fuzzy Hash: 30414170A10151AFC710EF6DDD89B5677E5ABA9318B05807BE409CB366C738DC81CB1D

Function 00408EA4 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408EC5
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408F34
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408FCF
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0040900E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 6a14109298dd6aa5b23f5014bc90c14a5f309fa4690e2bc273b58c6e1dd153b9
Instruction ID: d606a76aa49eec759d07c5becdfef17a6c6b9766ea912d15a143196380f0994c
Opcode Fuzzy Hash: 6a14109298dd6aa5b23f5014bc90c14a5f309fa4690e2bc273b58c6e1dd153b9
Instruction Fuzzy Hash: C73162706083815AD330EB65C945BDBB7D99F8A304F00483FB6C8D72D2DB799904876B

Function 0044EE9C Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044EEE5

Part of subcall function 0044D528: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044D55A

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044EF69

Part of subcall function 0042C004: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042C018

IsRectEmpty.USER32(?), ref: 0044EF2B
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044EF4E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 975d6f0bacda975cfe83ce1eab8afcd9494905b79e3112c8c9d866416d3664bd
Instruction ID: 5be5a2c99a49a2f339bd726f9f517b743d06364a043e5a66e7e3b57b404dc1d6
Opcode Fuzzy Hash: 975d6f0bacda975cfe83ce1eab8afcd9494905b79e3112c8c9d866416d3664bd
Instruction Fuzzy Hash: 5B118C3170031027E610BA7E8C82B5F66C99B88748F01483FB60AEB387DDB8DC09835E

Function 0049720C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00497270
OffsetRect.USER32(?,00000000,?), ref: 0049728B
OffsetRect.USER32(?,?,00000000), ref: 004972A5
OffsetRect.USER32(?,00000000,?), ref: 004972C0

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 1a73e688525ba1e930e3dbf3898af9d30e9465d405d6debb224a7eeb0afca85c
Instruction ID: e718e50738441f611e1ccbf74e0cde98489d487b8bfa6672397ae6e260ffa509
Opcode Fuzzy Hash: 1a73e688525ba1e930e3dbf3898af9d30e9465d405d6debb224a7eeb0afca85c
Instruction Fuzzy Hash: BE214FB67142016BCB00DF69CD85E5BB7EEEBD4340F14CA2AF544C728AD634E9448796

Function 00496EC4 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 00496ED9
MulDiv.KERNEL32(50142444,00000008,?), ref: 00496EED
MulDiv.KERNEL32(F6E65FE8,00000008,?), ref: 00496F01
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 00496F1F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865696dda9c04e972e54b31ac7a717d8d8d580924cf1526e353e6871edb84c7d
Instruction ID: e3308cc84e827548128d2b2e4dd5895a6eb2c6c5d9673f95432de963ba277a10
Opcode Fuzzy Hash: 865696dda9c04e972e54b31ac7a717d8d8d580924cf1526e353e6871edb84c7d
Instruction Fuzzy Hash: CB113372604204AFCF40DFA9D8C4D9B7BECEF4D324B15516AF918DB24AD634ED408BA4

Function 0041F8D0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F8C0,?), ref: 0041F8F1
UnregisterClassA.USER32(0041F8C0,00400000), ref: 0041F91A
RegisterClassA.USER32(0049B598), ref: 0041F924
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F95F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: ae6de89eb0d2e6a3729d1e0b10ea6149efd73b68be0a0487beae6f0a454497aa
Instruction ID: 2f8fb42507e3cd1bc96778dfed7eead12d65e2047fb8f4462c71738803dd6c65
Opcode Fuzzy Hash: ae6de89eb0d2e6a3729d1e0b10ea6149efd73b68be0a0487beae6f0a454497aa
Instruction Fuzzy Hash: B7012DB16141047BCB10FBA8ED81E9A379CD719318B11423BB505E72A1D739D8168BAC

Function 0040D460 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D477
LoadResource.KERNEL32(00400000,72756F73,0040AC18,00400000,00000001,00000000,?,0040D3D4,00000000,?,00000000,?,?,0047DE64,0000000A,00000000), ref: 0040D491
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040AC18,00400000,00000001,00000000,?,0040D3D4,00000000,?,00000000,?,?,0047DE64), ref: 0040D4AB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040AC18,00400000,00000001,00000000,?,0040D3D4,00000000,?,00000000,?), ref: 0040D4B5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 073da2e1467bd4923794a1699de9deb8666d8abafae58723814b459cf24724ae
Instruction ID: 736189130eb46f944708fe8ab0dcf7c2da2e7d83e7efdb8d5663637d3260b2f8
Opcode Fuzzy Hash: 073da2e1467bd4923794a1699de9deb8666d8abafae58723814b459cf24724ae
Instruction Fuzzy Hash: FCF04FB3A005046F8B04EE9DA881D5B76DCDE88364310013AFD08EB282DA38DD018B78

Function 00456538 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045BFAA,?,?,?,?,?,00000000,0045BFD1), ref: 00456574
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045BFAA,?,?,?,?,?,00000000), ref: 0045657D
RemoveFontResourceA.GDI32(00000000), ref: 0045658A
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0045659E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 18bbce5fff6d48609ef0ee32c883151f01d971de8c147fc0902137a50bd33190
Instruction ID: 60fc6220e6421739c6cddc48edde2e304ed69df2a150d613f8e8855ad9854c81
Opcode Fuzzy Hash: 18bbce5fff6d48609ef0ee32c883151f01d971de8c147fc0902137a50bd33190
Instruction Fuzzy Hash: 27F054B174531076EA10B6B6AC47F5B22CC8F54749F54483A7604EB2C3D57CDD04966D

Function 00470C50 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 00470CA1

Strings

Setting NTFS compression on directory: %s, xrefs: 00470C6F
Failed to set NTFS compression state (%d)., xrefs: 00470CB2
Unsetting NTFS compression on directory: %s, xrefs: 00470C87

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: dfbe84044b29f3d57c509b65a983513d49cbe1f7a65d8e2e78e9d92552162f9b
Instruction ID: 2f8c6a7a6e35e8588bbb9e762321129d74c961a1f58895d436786832a4f1a68a
Opcode Fuzzy Hash: dfbe84044b29f3d57c509b65a983513d49cbe1f7a65d8e2e78e9d92552162f9b
Instruction Fuzzy Hash: 04018B30D09248AACB15D7ED94812DDFBE89F0D305F54C1EFA459E7342DF790A08879A

Function 004713FC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0047144D

Strings

Setting NTFS compression on file: %s, xrefs: 0047141B
Failed to set NTFS compression state (%d)., xrefs: 0047145E
Unsetting NTFS compression on file: %s, xrefs: 00471433

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: fe182551a98f743fcb6dc7018ea21a6c51c49eaeb083c5d16317d3ad1726425c
Instruction ID: a30ff693f52cd42e459b797e94763e7277481e0955e0c4e592f957c66b82d28b
Opcode Fuzzy Hash: fe182551a98f743fcb6dc7018ea21a6c51c49eaeb083c5d16317d3ad1726425c
Instruction Fuzzy Hash: 41016730D0424866CB1497AD64422DDBBE89F4D315F94C1EFA458E7352DE790A0887AA

Function 0047944C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,00000001,00000000,00000002,00000000,00482671,?,?,?,?,?,0049A5C3,00000000,0049A5EB), ref: 00479455
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,00000001,00000000,00000002,00000000,00482671,?,?,?,?,?,0049A5C3,00000000), ref: 0047945B
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,00000001,00000000,00000002,00000000,00482671), ref: 0047947D
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,00000001,00000000,00000002,00000000,00482671), ref: 0047948E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 6d49464bdbc91184ad7f6ac62fff289a707b850c7d11bd8742fde9f2fb834cc3
Instruction ID: 6505384fcc0360b3c734b71afb4e1a1a4ab6f9baee95e57f14d901b11eacad59
Opcode Fuzzy Hash: 6d49464bdbc91184ad7f6ac62fff289a707b850c7d11bd8742fde9f2fb834cc3
Instruction Fuzzy Hash: 90F030716447006BD600EAB58D82E9B73DCEB44354F04883EBE98CB2C1D678DC08AB76

Function 00424690 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042469C
IsWindowVisible.USER32(?), ref: 004246AD
IsWindowEnabled.USER32(?), ref: 004246B7
SetForegroundWindow.USER32(?), ref: 004246C1

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 6de0995d0e447abcc63ecfbcb3df3be24c1d568dc5660fd48fcf8973f81aa8b9
Instruction ID: 92c4e0b2622c21c1aafdf32b5a5e60d634be871c9bac48645995030a32fad986
Opcode Fuzzy Hash: 6de0995d0e447abcc63ecfbcb3df3be24c1d568dc5660fd48fcf8973f81aa8b9
Instruction Fuzzy Hash: BBE01261B0293157AA31FA7AA885A9F118CDD47BC43460277BC41F7297DB2CDC1045FD

Function 0040627C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040627F
GlobalUnlock.KERNEL32(00000000), ref: 00406286
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040628B
GlobalLock.KERNEL32(00000000), ref: 00406291

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 024a49765fc045a09389489d8ed5919b86daafa6bea6a005e9f609907830066e
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 64B009C6925A46B8EC0473B24C4BD3F041CE88472C3809A6E7554BA0839C7C9C002E3A

Function 0047B524 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047CE0D,?,00000000,00000000,00000001,00000000,0047B7C1,?,00000000), ref: 0047B785

Strings

Failed to parse "reg" constant, xrefs: 0047B78C
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047B5F9

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 684bb0749049f9b56ef336efe55875cadaaeb758c41cb9d5aa092f380e5d2a32
Instruction ID: f1421b174eee6fc7f54e6f8e7a43c19df08b7389384ab18ee26f4796af10067b
Opcode Fuzzy Hash: 684bb0749049f9b56ef336efe55875cadaaeb758c41cb9d5aa092f380e5d2a32
Instruction Fuzzy Hash: 89815175E00208AFCB10DFA5D481BDEBBF9EF48354F50816AE454A7391DB38AE05CB99

Function 004775F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00477727,?,00000000,00477738,?,00000000,00477781), ref: 004776F8
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00477727,?,00000000,00477738,?,00000000,00477781), ref: 0047770C

Strings

Extracting temporary file: , xrefs: 00477634

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: 8d8d29b45fb9742880719863d89589a4356bfd1e7f13b2e05d84abbcd72ab195
Instruction ID: 13e9f88ccb8282ea38195536ff5c63a907cbb836f3d7a61bc1ee4cb3f854d839
Opcode Fuzzy Hash: 8d8d29b45fb9742880719863d89589a4356bfd1e7f13b2e05d84abbcd72ab195
Instruction Fuzzy Hash: 4041B774A04649AFCB01DF65CC91AEFBBB8EB09304F51847AF910A7391D678A901CB98

Function 0046D8CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046D9F8
Failed to proceed to next wizard page; aborting., xrefs: 0046D9E4

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: add31560b0341e522612951ad2314b824f5c06f277653e44a4d324fe3becfdea
Instruction ID: 84e2974eb34e4f2dda2b8c8cb2eefec3d4715c8d151fead2dfc4afe0ae77ca03
Opcode Fuzzy Hash: add31560b0341e522612951ad2314b824f5c06f277653e44a4d324fe3becfdea
Instruction Fuzzy Hash: 4D319E70F04204EFD711EB69D989BA977F5EB05304F6500BBE408AB3A2D7786E44CB1A

Function 0045080C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004508A1
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004508D2

Strings

open, xrefs: 004508C5

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ecebf72486316a37e3830fd15e4a4b51011a10e5760c3bac1abab3b5df80333e
Instruction ID: f57ce05e9eba324e121f638db0535f08eb0d68243c76b72727f5d658c61a4d86
Opcode Fuzzy Hash: ecebf72486316a37e3830fd15e4a4b51011a10e5760c3bac1abab3b5df80333e
Instruction Fuzzy Hash: 4C216075E00604BFDB00EFA9C981E9EB7F8EB44705F10817AB904F7292D7789A45CB88

Function 004559F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00455A94
GetLastError.KERNEL32(0000003C,00000000,00455ADD,?,?,?), ref: 00455AA5

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Strings

<, xrefs: 00455A4E

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: d516e6598b8be20c8747e6ec9c3ac67b1ec18d9ef1beef7a885f0700c60fe9ff
Instruction ID: 1dd1e4a4b05f96b02f6cdc30b2026c57645841094811f513de853399c4f5318c
Opcode Fuzzy Hash: d516e6598b8be20c8747e6ec9c3ac67b1ec18d9ef1beef7a885f0700c60fe9ff
Instruction Fuzzy Hash: 482151B0A00649AFDB00DF65D8926AE7BE8EF08345F50413BF844E7281E7789E49CB58

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049D420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049D420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049D420,0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049D420,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049D420,00401A89,00000000,00401A82,?,?,0040222E,0222C000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: b1c34bbcfa7d0433af8c48dff581505e6c7889bd18d36f496ad8d1521465f649
Instruction ID: 570f99ef1d3d95e4b4d80a2adc1962b98f522b57bc72750d6ce688ebb538822c
Opcode Fuzzy Hash: b1c34bbcfa7d0433af8c48dff581505e6c7889bd18d36f496ad8d1521465f649
Instruction Fuzzy Hash: CE110131B042046FEB25AF799F1A62AAAD4D79575CB64087FF404F32D2D9BD9C02826C

Function 00498416 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00498451

Strings

@, xrefs: 0049841C
/INITPROCWND=$%x , xrefs: 0049847C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 3a83e6e038dbafd0e3ea01eb6dd6426255c1a8b46f58718dc6178500fe069b44
Instruction ID: a9318bdce5e824465d4436be78f64917a5ae5ef5b8220d929174e0d313b11457
Opcode Fuzzy Hash: 3a83e6e038dbafd0e3ea01eb6dd6426255c1a8b46f58718dc6178500fe069b44
Instruction Fuzzy Hash: EF119370A082059FDB01DBA9D851BAEBBE8EF49314F11847BE504E7292EA3C99058B58

Function 004478B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00447966

Strings

NIL Interface Exception, xrefs: 00447908
Unknown Method, xrefs: 0044793F

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: ea7a85b9692c4460c5906b58765fb64bf6ee6b5f46e4d7caecedcff591b2af5e
Instruction ID: 10ddd43a001eab7360299ad3f405319ab988bcee1c7d5b08318f9ee426dd8228
Opcode Fuzzy Hash: ea7a85b9692c4460c5906b58765fb64bf6ee6b5f46e4d7caecedcff591b2af5e
Instruction Fuzzy Hash: 9211E9716042089FEB10EFA58D51A6FBBBDEB09304F91403AF500F7281C7789D01C769

Function 00497C88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00497D50,?,00497D44,00000000,00497D2B), ref: 00497CF6
CloseHandle.KERNEL32(00497D90,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00497D50,?,00497D44,00000000), ref: 00497D0D

Part of subcall function 00497BE0: GetLastError.KERNEL32(00000000,00497C78,?,?,?,?), ref: 00497C04

Strings

D, xrefs: 00497CD0

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: a880bfa9a77c93c91fa9ab75ae7060b7f78cb32e3cfe05dc5138aae6885ad4e0
Instruction ID: a89f5070db7a5e6d261d16ca7c1b7ea99db6432e353ebe52f8e4aa70fd7af1a9
Opcode Fuzzy Hash: a880bfa9a77c93c91fa9ab75ae7060b7f78cb32e3cfe05dc5138aae6885ad4e0
Instruction Fuzzy Hash: 1001A1B0608248AFDB00DBA5DC42FAF7BACDF09704F60013BF504E72C1E6785E008668

Function 0042E1B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042E1C8
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042E208

Strings

Inno Setup: No Icons, xrefs: 0042E1C6

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 5fa1588eb3983bc8147b11ac52db8119f930d32b550c0df0fd023eaaf2352da0
Instruction ID: e7333c3f072e055346127a6a42ec618886ffe365ff3054ef7f5207155727e60c
Opcode Fuzzy Hash: 5fa1588eb3983bc8147b11ac52db8119f930d32b550c0df0fd023eaaf2352da0
Instruction Fuzzy Hash: 3C01DB32745371A9F73145137D41B7B65CC8B42B60F64057BF941FA2C1DA68AC0592BE

Function 004535CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,?,00000000,0045362D,?,?,-00000001,?), ref: 00453607
GetLastError.KERNEL32(00000000,?,00000000,0045362D,?,?,-00000001,?), ref: 0045360F

Strings

@8H, xrefs: 0045363D

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: @8H
API String ID: 1799206407-3762495883
Opcode ID: 65c44507f9335e4e2a077e4ee2190135d3d5d768f820153090acd923ffb3f295
Instruction ID: 2a718f5fbeded0ca4f0ca1a684ecb9b724474f3cd93569f9f0dcaab09f3de9c7
Opcode Fuzzy Hash: 65c44507f9335e4e2a077e4ee2190135d3d5d768f820153090acd923ffb3f295
Instruction Fuzzy Hash: 49F0F971A04204BBCB10DF7AAC4249EF7ECDB49362711457BFC14D3342E6784E088598

Function 004998EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047E3D0: FreeLibrary.KERNEL32(00000000,00482E1B), ref: 0047E3E6

Part of subcall function 0047E0A8: GetTickCount.KERNEL32 ref: 0047E0F2

Part of subcall function 00457A90: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 00457AAF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049A243), ref: 00499941
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049A243), ref: 00499947

Strings

Detected restart. Removing temporary directory., xrefs: 004998FB

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: cf4eeb9d2890f889123e5d43942b6b9d65dcdfa64d28096ccc0edee5f77a06bc
Instruction ID: 3ff60914118e938cb0b4ccf38de38d34f2fcffefe5e82e60aedbfe03ba6cc694
Opcode Fuzzy Hash: cf4eeb9d2890f889123e5d43942b6b9d65dcdfa64d28096ccc0edee5f77a06bc
Instruction Fuzzy Hash: 7DE0E5B12086446EDE1277AB6C1796B3F8CD74A76CB11447FF80491652E82D4C108A3D

Function 00455E10 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455E2F
Sleep.KERNEL32(?), ref: 00455E3F
GetLastError.KERNEL32 ref: 00455E52
GetLastError.KERNEL32 ref: 00455E5C

Memory Dump Source

Source File: 00000001.00000002.2460775187.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2460760233.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460824547.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460839672.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460860353.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2460876391.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_geosetter_setup.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 162f6e589a9a3ecbf727cd3144cb36b5133ad9a431805f826c669b7668a8d72d
Instruction ID: 0e0098d5c51f6c3332c54b3c49cab550602dc5c9badc8da443834b62d3c24bba
Opcode Fuzzy Hash: 162f6e589a9a3ecbf727cd3144cb36b5133ad9a431805f826c669b7668a8d72d
Instruction Fuzzy Hash: BCF02B32F00914E74F30A76AA88393F628CDA417A6720012BFC04DB303D53CDE0586A8

Analysis Process: exiftool.exePID: 2352, Parent PID: 2300COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	619
Total number of Limit Nodes:	16

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00402C00 Relevance: 96.9, APIs: 42, Strings: 13, Instructions: 601
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00402CCD
GetUserNameA.ADVAPI32 ref: 00402CE0
_strdup.MSVCRT(?,00404E0E), ref: 00402D15
strlen.MSVCRT ref: 00402D23
malloc.MSVCRT ref: 00402D2F
sprintf.MSVCRT ref: 00402D58
_strdup.MSVCRT(?,00404E0E), ref: 00402D9A
strlen.MSVCRT ref: 00402DB3
malloc.MSVCRT ref: 00402DF6
sprintf.MSVCRT ref: 00402E20
_mkdir.MSVCRT ref: 00402E2E
malloc.MSVCRT ref: 00402E33
_strdup.MSVCRT ref: 00402E4F
strlen.MSVCRT ref: 00402E76
_open.MSVCRT ref: 00402E9A
_getpid.MSVCRT ref: 00402EBC
sprintf.MSVCRT ref: 00402EE4
_mkdir.MSVCRT ref: 00402F37
free.MSVCRT ref: 00402F41
_strdup.MSVCRT ref: 00403015
strlen.MSVCRT ref: 0040350B
malloc.MSVCRT ref: 00403516
sprintf.MSVCRT ref: 0040352C
_strdup.MSVCRT(?,00404E0E), ref: 00403591

Strings

SYSTEM, xrefs: 00402F69
PAR_TEMP, xrefs: 00402C10, 00402F48
H, xrefs: 00403603
PATH, xrefs: 00402E3A
), xrefs: 00403641
C, xrefs: 004035F8
E, xrefs: 0040360E
C, xrefs: 00403072
USER, xrefs: 00402C83, 00402CE6
A, xrefs: 004035ED
PAR_TMPDIR, xrefs: 00402C41, 00402D69
WinDir, xrefs: 004034F3
PAR_CLEAN, xrefs: 00402EB0

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _strdupmalloc$sprintfstrlen$_mkdir$NameUser_getpid_openfree
String ID: )$A$C$C$E$H$PAR_CLEAN$PAR_TEMP$PAR_TMPDIR$PATH$SYSTEM$USER$WinDir
API String ID: 1490068907-1419490637
Opcode ID: 99c6b2c196e125a5974f596c858e125f71f7c47fc780143b4c733c630f8b03d6
Instruction ID: 96ee18b81bfab86ee2e117cd2157b4b0068cc0dd61eb516ff8acf4e4b38a178f
Opcode Fuzzy Hash: 99c6b2c196e125a5974f596c858e125f71f7c47fc780143b4c733c630f8b03d6
Instruction Fuzzy Hash: B9424DB05087818FD764DF29C58429FBBE4BF84344F04893EE9C99B382DB789949CB56

Function 00401180 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 206
sleeplibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 0040120F
SetUnhandledExceptionFilter.KERNEL32 ref: 004012A4
GetProcAddress.KERNEL32 ref: 004012C2
malloc.MSVCRT ref: 00401367
strlen.MSVCRT ref: 00401386
malloc.MSVCRT ref: 00401391
memcpy.MSVCRT ref: 004013AD
_cexit.MSVCRT ref: 00401417
GetStartupInfoA.KERNEL32 ref: 00401483

Strings

p8@, xrefs: 00401273

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: malloc$AddressExceptionFilterInfoProcSleepStartupUnhandled_cexitmemcpystrlen
String ID: p8@
API String ID: 2757201259-3404942377
Opcode ID: 77446bd1682eddfe0307c864796214e7501aab2eeb9ee576db12e78ca3cf51db
Instruction ID: 121a9b54076622c3c1d934349d751556844a9244dcdcaa8c7b0a4bc37fad42c5
Opcode Fuzzy Hash: 77446bd1682eddfe0307c864796214e7501aab2eeb9ee576db12e78ca3cf51db
Instruction Fuzzy Hash: 16915BB09043018FD714EF69D88966A7BF4FB54304F01493EE984EB3A1D77C9848EB96

Function 00404DEA Relevance: 51.0, APIs: 23, Strings: 6, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402C00: malloc.MSVCRT ref: 00402CCD
Part of subcall function 00402C00: GetUserNameA.ADVAPI32 ref: 00402CE0
Part of subcall function 00402C00: _strdup.MSVCRT(?,00404E0E), ref: 00402D15
Part of subcall function 00402C00: strlen.MSVCRT ref: 00402D23
Part of subcall function 00402C00: malloc.MSVCRT ref: 00402D2F
Part of subcall function 00402C00: sprintf.MSVCRT ref: 00402D58
Part of subcall function 00402C00: _strdup.MSVCRT(?,00404E0E), ref: 00402D9A
Part of subcall function 00402C00: strlen.MSVCRT ref: 00402DB3

_mkdir.MSVCRT ref: 00404E1F
_strdup.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004013FA), ref: 00404E3B

Part of subcall function 004026A0: GetModuleFileNameA.KERNEL32(00000000,00000000,763269C0,00000000,00402E69), ref: 004026DA
Part of subcall function 004026A0: strchr.MSVCRT ref: 004026F2

_errno.MSVCRT ref: 00404EDA
fprintf.MSVCRT ref: 00404F06
exit.MSVCRT ref: 00404F12
sprintf.MSVCRT ref: 00404F2F
sprintf.MSVCRT ref: 00404F57
LoadLibraryA.KERNELBASE ref: 00404F7C
GetProcAddress.KERNEL32 ref: 00404F92
_spawnvpe.MSVCRT ref: 00404FD4
exit.MSVCRT ref: 00404FE9
_errno.MSVCRT ref: 00404FF4
_errno.MSVCRT ref: 00405000
fprintf.MSVCRT ref: 00405028
_errno.MSVCRT ref: 00405032
_open.MSVCRT ref: 0040506B
_read.MSVCRT ref: 00405091
_close.MSVCRT ref: 00405099
_open.MSVCRT ref: 004050B4
_write.MSVCRT ref: 004050D7
_close.MSVCRT ref: 004050DF
fprintf.MSVCRT ref: 00405104
fprintf.MSVCRT ref: 00405129

Strings

h`@, xrefs: 00404E74
PAR_SPAWNED, xrefs: 00404FAD
p`@, xrefs: 00404EAB
PAR_ARGC, xrefs: 00404F36
d`@, xrefs: 00404E83
PATH, xrefs: 00404E2E

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _errnofprintf$_strdupsprintf$Name_close_openexitmallocstrlen$AddressFileLibraryLoadModuleProcUser_mkdir_read_spawnvpe_writestrchr
String ID: PAR_ARGC$PAR_SPAWNED$PATH$d`@$h`@$p`@
API String ID: 2223366566-3023816417
Opcode ID: 4762c7085a74fb9042d0fe0ac47c485ceab007b31219a10c0ecdf30889200343
Instruction ID: 89d9aa9a66fef974caaa118e58418cbfdd7f870c607dc3cfa3dd3cc4899d3fc6
Opcode Fuzzy Hash: 4762c7085a74fb9042d0fe0ac47c485ceab007b31219a10c0ecdf30889200343
Instruction Fuzzy Hash: F19114B4A087459FCB00EF69C98452EBBF0BF88304F01882EF584AB391D7789845DF5A

Function 00404DE0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 162
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402C00: malloc.MSVCRT ref: 00402CCD
Part of subcall function 00402C00: GetUserNameA.ADVAPI32 ref: 00402CE0
Part of subcall function 00402C00: _strdup.MSVCRT(?,00404E0E), ref: 00402D15
Part of subcall function 00402C00: strlen.MSVCRT ref: 00402D23
Part of subcall function 00402C00: malloc.MSVCRT ref: 00402D2F
Part of subcall function 00402C00: sprintf.MSVCRT ref: 00402D58
Part of subcall function 00402C00: _strdup.MSVCRT(?,00404E0E), ref: 00402D9A
Part of subcall function 00402C00: strlen.MSVCRT ref: 00402DB3

_mkdir.MSVCRT ref: 00404E1F
_strdup.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004013FA), ref: 00404E3B

Part of subcall function 004026A0: GetModuleFileNameA.KERNEL32(00000000,00000000,763269C0,00000000,00402E69), ref: 004026DA
Part of subcall function 004026A0: strchr.MSVCRT ref: 004026F2

_errno.MSVCRT ref: 00404EDA
fprintf.MSVCRT ref: 00404F06
exit.MSVCRT ref: 00404F12
sprintf.MSVCRT ref: 00404F2F
sprintf.MSVCRT ref: 00404F57
LoadLibraryA.KERNELBASE ref: 00404F7C
GetProcAddress.KERNEL32 ref: 00404F92
_spawnvpe.MSVCRT ref: 00404FD4
exit.MSVCRT ref: 00404FE9
_errno.MSVCRT ref: 00404FF4
_errno.MSVCRT ref: 00405000
fprintf.MSVCRT ref: 00405028
_errno.MSVCRT ref: 00405032
_open.MSVCRT ref: 0040506B
_read.MSVCRT ref: 00405091
_close.MSVCRT ref: 00405099
_open.MSVCRT ref: 004050B4
_write.MSVCRT ref: 004050D7
_close.MSVCRT ref: 004050DF
fprintf.MSVCRT ref: 00405104
fprintf.MSVCRT ref: 00405129

Strings

h`@, xrefs: 00404E74
PAR_SPAWNED, xrefs: 00404FAD
p`@, xrefs: 00404EAB
PAR_ARGC, xrefs: 00404F36
d`@, xrefs: 00404E83
PATH, xrefs: 00404E2E

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _errnofprintf$_strdupsprintf$Name_close_openexitmallocstrlen$AddressFileLibraryLoadModuleProcUser_mkdir_read_spawnvpe_writestrchr
String ID: PAR_ARGC$PAR_SPAWNED$PATH$d`@$h`@$p`@
API String ID: 2223366566-3023816417
Opcode ID: a8471bc49b2e285468eb65ce394d1288d70f230c0ca3254a6505522b7a15ebca
Instruction ID: befc847408a4b858ddcbcdbe2108d19c984e606b319fb97465c01712d77d9e59
Opcode Fuzzy Hash: a8471bc49b2e285468eb65ce394d1288d70f230c0ca3254a6505522b7a15ebca
Instruction Fuzzy Hash: 1B6126B4A097059FCB00EF69C98456EBBF4BF89304F01882EF594EB391D7789845CB96

Function 00403569 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00402DB3
malloc.MSVCRT ref: 00402DF6
sprintf.MSVCRT ref: 00402E20
_mkdir.MSVCRT ref: 00402E2E
malloc.MSVCRT ref: 00402E33
_strdup.MSVCRT ref: 00402E4F
strlen.MSVCRT ref: 00402E76
_open.MSVCRT ref: 00402E9A
_getpid.MSVCRT ref: 00402EBC
sprintf.MSVCRT ref: 00402EE4
_mkdir.MSVCRT ref: 00402F37
free.MSVCRT ref: 00402F41
_strdup.MSVCRT(?,00404E0E), ref: 00403591
memset.MSVCRT ref: 004035C5

Strings

PAR_TEMP, xrefs: 00402F48
PATH, xrefs: 00402E3A
PAR_CLEAN, xrefs: 00402EB0

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _mkdir_strdupmallocsprintfstrlen$_getpid_openfreememset
String ID: PAR_CLEAN$PAR_TEMP$PATH
API String ID: 2558232494-1314801006
Opcode ID: 9beb7242399591a14f4bda3bbd263a7ee10ea0f59bc7f6c771e48f5b1923a9ff
Instruction ID: 8ba11c3d67bc646238ee5580b6db11e0e03fba0ea79bb5f1b4edf475a9e03a75
Opcode Fuzzy Hash: 9beb7242399591a14f4bda3bbd263a7ee10ea0f59bc7f6c771e48f5b1923a9ff
Instruction Fuzzy Hash: 1541A9B06057418BC704BF76958421EBAE4BF84348F05483EE9C5A73C6E77CC9499B5A

Function 004036F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lseek.MSVCRT ref: 00403711
_read.MSVCRT ref: 00403725
fprintf.MSVCRT ref: 0040374E
_lseek.MSVCRT ref: 00403766
_read.MSVCRT ref: 0040377A
fprintf.MSVCRT ref: 004037A4
_lseek.MSVCRT ref: 004037D8
fprintf.MSVCRT ref: 004037FF

Strings

PE, xrefs: 0040377F
@, xrefs: 00403716

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _lseekfprintf$_read
String ID: @$PE
API String ID: 819318318-957972822
Opcode ID: 08067681b96a759904c6aba2f19af30de43eac545c1e7eb20bfac73dd60b239d
Instruction ID: 4642096e6e14aa2d17bde28101a47ca9ccc12f89f1d5fed319e6d064e1209d9f
Opcode Fuzzy Hash: 08067681b96a759904c6aba2f19af30de43eac545c1e7eb20bfac73dd60b239d
Instruction Fuzzy Hash: 542105F54087419BD710AF16D48422EFEE4BFD4745F01C82EF6C86B291D3788988DB9A

Function 00402550 Relevance: 15.1, APIs: 10, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 0040256A
strlen.MSVCRT ref: 00402576
malloc.MSVCRT ref: 00402586
sprintf.MSVCRT ref: 004025A0
_open.MSVCRT ref: 004025BA
_write.MSVCRT ref: 004025E7
_close.MSVCRT ref: 00402603
_chmod.MSVCRT ref: 0040261E
_errno.MSVCRT ref: 00402630
_open.MSVCRT ref: 00402678

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _openstrlen$_chmod_close_errno_writemallocsprintf
String ID:
API String ID: 3898673071-0
Opcode ID: b94c7eb2631ca7688953e6f892f617229ac2d2e7a53994b53f391f695675100d
Instruction ID: 32073652d49bd8b0d8e96cd658b19dc9323b9424130cfc35d36ee2eb2edbcb40
Opcode Fuzzy Hash: b94c7eb2631ca7688953e6f892f617229ac2d2e7a53994b53f391f695675100d
Instruction Fuzzy Hash: 7A3118B06083019BC710EF39D98851EBBE0BF94354F15893EE998DB3C0E779D8459B4A

Function 00404AA0 Relevance: 9.2, APIs: 6, Instructions: 163
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat.MSVCRT ref: 00404AD7
strlen.MSVCRT ref: 00404B47
malloc.MSVCRT ref: 00404B94
memcpy.MSVCRT ref: 00404BAD
_stat.MSVCRT ref: 00404BCA
free.MSVCRT ref: 00404BE0

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _stat$freemallocmemcpystrlen
String ID:
API String ID: 2821670080-0
Opcode ID: 4432d9af3098799ca2e7295a522a7d6b74de5a4338b84f39fdb125deea6f8363
Instruction ID: 270b57a52959617ce593aa64688d69d8a93b92e969e13fa31cbac54dc6f36885
Opcode Fuzzy Hash: 4432d9af3098799ca2e7295a522a7d6b74de5a4338b84f39fdb125deea6f8363
Instruction Fuzzy Hash: 15514DF050D7558EE720DF29C08132BBBE2AFC9300F55852BEA94A7391D339D9459B8A

Function 00404C6C Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat.MSVCRT ref: 00404AD7

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _stat
String ID:
API String ID: 2107477818-0
Opcode ID: fc3d07b0820b274de90c0d11ddc5157f673283181061d7fa86f79c4a4cd3f2de
Instruction ID: 1b72df1b976d9d9649bf6bfaa4c1a899c4772b63d0d026c615675efea39d1c5e
Opcode Fuzzy Hash: fc3d07b0820b274de90c0d11ddc5157f673283181061d7fa86f79c4a4cd3f2de
Instruction Fuzzy Hash: 1E012BB86097059FC380CF29C08050AFBF0BB89314F518A2EE9A8D3750E335E9658F86

Function 00402500 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404AA0: _stat.MSVCRT ref: 00404AD7

_access.MSVCRT ref: 0040253F

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _access_stat
String ID:
API String ID: 2296130521-0
Opcode ID: 02a9fcb6c7f1324969ee45df8893dcaee4d01bb2b798894876fdca146f9af2d3
Instruction ID: ed033902c37e5fd3a1350666c169422871beae94785840c746d4540f52a29d71
Opcode Fuzzy Hash: 02a9fcb6c7f1324969ee45df8893dcaee4d01bb2b798894876fdca146f9af2d3
Instruction Fuzzy Hash: DFE092F06093014AD3049F3A9D9632B75E4ABC4304F44883EE584E23C1E77CC414A60A

Non-executed Functions

Function 00404700 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040474F
UnhandledExceptionFilter.KERNEL32 ref: 0040475F
GetCurrentProcess.KERNEL32 ref: 00404768
TerminateProcess.KERNEL32 ref: 00404779
abort.MSVCRT ref: 00404782

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 15ddc44d65b0adfa4faa70ba0915ba46c84b6ed5004719b954215d7167924214
Instruction ID: d340abfb47b99538e3d5b721e9a757abc8f19e5eebb20426b18af0e8e8d6bcc1
Opcode Fuzzy Hash: 15ddc44d65b0adfa4faa70ba0915ba46c84b6ed5004719b954215d7167924214
Instruction Fuzzy Hash: EF01B6B4805209CFD700EFB9E94996C7FF0BB58304F008929E989CB365E7799949EF52

Function 004026A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 109
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,00000000,763269C0,00000000,00402E69), ref: 004026DA
strchr.MSVCRT ref: 004026F2
_access.MSVCRT ref: 0040271F
_strdup.MSVCRT ref: 0040273B
strlen.MSVCRT ref: 00402752
strtok.MSVCRT ref: 0040276D
strcmp.MSVCRT ref: 00402799
strlen.MSVCRT ref: 004027A5
sprintf.MSVCRT ref: 004027E9
strtok.MSVCRT ref: 0040282C

Strings

PAR_TEMP, xrefs: 004026B0
\, xrefs: 004026E7
PAR_PROGNAME, xrefs: 004026FD, 0040272E

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: strlenstrtok$FileModuleName_access_strdupsprintfstrchrstrcmp
String ID: PAR_PROGNAME$PAR_TEMP$\
API String ID: 3013891303-1651481293
Opcode ID: d49f95d648a8c302aa3906fe87d98075f7cea8cc13599288084a6db662bd9203
Instruction ID: 4ec2e78935a41ca979bd7d9b1bfd9e286f42d918a9f15a5348fee6cdee0b69ff
Opcode Fuzzy Hash: d49f95d648a8c302aa3906fe87d98075f7cea8cc13599288084a6db662bd9203
Instruction Fuzzy Hash: 1D4163B15087419AD750BF2AD54831EBAE4BF84348F04883EF5C8E72C1EB7DC8559B56

Function 00403C70 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00403C9B
vfprintf.MSVCRT ref: 00403CB7
abort.MSVCRT ref: 00403CBC
VirtualQuery.KERNEL32 ref: 00403D71
VirtualQuery.KERNEL32 ref: 00403DA9
memcpy.MSVCRT ref: 00403DCE

Strings

@, xrefs: 00403E74

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: @
API String ID: 3828011698-2766056989
Opcode ID: 8a6f4d90ef81cacf49af18d69d46eeda1d6beb56159eee366484a52e78a9de18
Instruction ID: 7d039e58abd9efb0c1af86d81a41a504eaf006e19e524596081eef7a529b8f3b
Opcode Fuzzy Hash: 8a6f4d90ef81cacf49af18d69d46eeda1d6beb56159eee366484a52e78a9de18
Instruction Fuzzy Hash: 2B7105B59083019FD700EF2AD58451AFFE8BF88344F10892EE889E7351E739E944DB96

Function 00402370 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00402395
malloc.MSVCRT ref: 004023A2
sprintf.MSVCRT ref: 004023BC
_findfirst.MSVCRT ref: 004023CC
strchr.MSVCRT ref: 00402410

Strings

\, xrefs: 00402405

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _findfirstmallocsprintfstrchrstrlen
String ID: \
API String ID: 3832082714-2967466578
Opcode ID: 1be3dee618d7a82d0a36b229b14e439d4debc711bf2dbf1588ee36de555378a2
Instruction ID: da62ccb227a45dced61a355cc1c0f6fea6ce0c8a26ca6656852914fe21de9486
Opcode Fuzzy Hash: 1be3dee618d7a82d0a36b229b14e439d4debc711bf2dbf1588ee36de555378a2
Instruction Fuzzy Hash: BC111AB04083459ED710AF36D58861ABEE0AF95354F05483EF8D8972D2E77CC884DB56

Function 00402180 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 150
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00402198

Part of subcall function 00402080: _strnicmp.MSVCRT ref: 004020BB

strlen.MSVCRT ref: 004021B7
malloc.MSVCRT ref: 00402206
realloc.MSVCRT ref: 004022D2

Strings

PAR_CLEAN=, xrefs: 00402181

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: strlen$_strnicmpmallocrealloc
String ID: PAR_CLEAN=
API String ID: 1955955054-2921740407
Opcode ID: 344621a6d971a00fa159a3c6604aea814fe8a7d22585687f981d86c83fa7a42a
Instruction ID: fc23f72aafbb892704d4886e87244db957dfee2338a6c68c49a9ce8b262e3c5d
Opcode Fuzzy Hash: 344621a6d971a00fa159a3c6604aea814fe8a7d22585687f981d86c83fa7a42a
Instruction Fuzzy Hash: B551D1705082518FC714DF68D984726BBE1AF8A304F0845BEE894AB3E2D37DD905CB56

Function 00402B10 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00402B67
strlen.MSVCRT ref: 00402BAA
strlen.MSVCRT ref: 00402BB6
malloc.MSVCRT ref: 00402BC6
sprintf.MSVCRT ref: 00402BEA

Strings

LD_LIBRARY_PATH, xrefs: 00402B14, 00402B24
PATH, xrefs: 00402B3C

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: strlen$mallocsprintfstrstr
String ID: LD_LIBRARY_PATH$PATH
API String ID: 1441940856-3236830189
Opcode ID: 14ec61aeb2a2f49b37299beb2d28db92a29fd7e8820c372e0be61df77664bcc3
Instruction ID: 0b3f441f945c41683d7a14e7a17bc790833228f53f46062357654264bf9872f8
Opcode Fuzzy Hash: 14ec61aeb2a2f49b37299beb2d28db92a29fd7e8820c372e0be61df77664bcc3
Instruction Fuzzy Hash: 772139B09083419BD714AF26858821FBFF4BF84358F00883EF9986B291D7B9D8068B56

Function 00402EEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00402EF0
_getpid.MSVCRT ref: 00402F00
sprintf.MSVCRT ref: 00402F2F
_mkdir.MSVCRT ref: 00402F37
free.MSVCRT ref: 00402F41

Strings

PAR_TEMP, xrefs: 00402F48

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _errno_getpid_mkdirfreesprintf
String ID: PAR_TEMP
API String ID: 2269416805-905909478
Opcode ID: 1e57a97c705811b5421acd86121d2aa4be0688a7d0fcefd431a40d0f1ef9a412
Instruction ID: 0adcda75f5221add8445d1fe69b759c424b6741590f5b77bf464b49e6ca81525
Opcode Fuzzy Hash: 1e57a97c705811b5421acd86121d2aa4be0688a7d0fcefd431a40d0f1ef9a412
Instruction Fuzzy Hash: 7FF044B15457048BC3007F26DC8801EBBF0FF81358F41893EF5D8AB291D778994A9B96

Function 00403A10 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00403A3F
signal.MSVCRT ref: 00403AB1
signal.MSVCRT ref: 00403B6F

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 24ccd62951481ebe7004b8ebad74f72b61bdb02ad40ded8d3773a57f92ffda5a
Instruction ID: 97753c74cf5bbcc81e36e8bcca928e3c7f71a53073ffe58d3c00da0e0fa4ece6
Opcode Fuzzy Hash: 24ccd62951481ebe7004b8ebad74f72b61bdb02ad40ded8d3773a57f92ffda5a
Instruction Fuzzy Hash: 6A3172B02082008AD720AF29948431B7AD4AF85339F154A2BE5E5EB3D1C77DCDC58B5B

Function 00404B3C Relevance: 7.6, APIs: 5, Instructions: 76stringCOMMON

Download Yara Rule

APIs

_stat.MSVCRT ref: 00404AD7
strlen.MSVCRT ref: 00404B47
malloc.MSVCRT ref: 00404B94
memcpy.MSVCRT ref: 00404BAD
_stat.MSVCRT ref: 00404BCA
free.MSVCRT ref: 00404BE0

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: _stat$freemallocmemcpystrlen
String ID:
API String ID: 2821670080-0
Opcode ID: fdc4a0e784f26c4932d7e0779090feca0aa7002e12bbe1f6dc4452c00d2d1c6e
Instruction ID: 43c980c23014ad3558e6b4134d313301909ffad070c2e94056ecce73e74064ec
Opcode Fuzzy Hash: fdc4a0e784f26c4932d7e0779090feca0aa7002e12bbe1f6dc4452c00d2d1c6e
Instruction Fuzzy Hash: 1931D4B45097559FC350DF29C08061AFBF1BF89300F45892EE9A897391E338E9969F86

Function 00404630 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00404687
GetCurrentProcessId.KERNEL32 ref: 0040469C
GetCurrentThreadId.KERNEL32 ref: 004046A4
GetTickCount.KERNEL32 ref: 004046AC
QueryPerformanceCounter.KERNEL32 ref: 004046BB

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: c35e83cdf0111b7fcde69af6b29bc0628e58b4bbd9a601d4fa90af385587a251
Instruction ID: 28b56b034bbfe03a5250bdd86f5b99c72c15cdd12c2d5a72cc548f36be200a53
Opcode Fuzzy Hash: c35e83cdf0111b7fcde69af6b29bc0628e58b4bbd9a601d4fa90af385587a251
Instruction Fuzzy Hash: A011B7B58083488FC310EF69D54851ABBF0BB8D344F454E2EEA9597310EB39DA19EF42

Function 00403930 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00403959
__dllonexit.MSVCRT ref: 00403993
_unlock.MSVCRT ref: 004039C3
_onexit.MSVCRT ref: 004039D3

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: bd91df8d28ff26bb98523c2f8cf12b7c21e53ce0062e3ceffa3a54af965e5cba
Instruction ID: 04bd8849c825ba93387d251161d66a61aa6bd2a67335e247f7afb634fe3a0374
Opcode Fuzzy Hash: bd91df8d28ff26bb98523c2f8cf12b7c21e53ce0062e3ceffa3a54af965e5cba
Instruction Fuzzy Hash: 1F11CDB49083018BC700EF79D88152EBBE4BB98305F014D2EF4C4E7392E77889889B92

Function 00404890 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 004048AF
free.MSVCRT ref: 004048FF
LeaveCriticalSection.KERNEL32 ref: 0040490B

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 0a557945c4928c59cad7bb59741bc7c24c46c1d14634ce5aaf2c6916d263180c
Instruction ID: 4384ea7cc0e8fc0a39df2ee6a0d8e42d5671801a5efa021d1bb976c5e30611fa
Opcode Fuzzy Hash: 0a557945c4928c59cad7bb59741bc7c24c46c1d14634ce5aaf2c6916d263180c
Instruction Fuzzy Hash: BE0192F6A042458FC700FF78D88442A7BF1BB94300B258D79EA85DB395F7389859EB46

Function 00404790 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040479E
TlsGetValue.KERNEL32 ref: 004047C5
GetLastError.KERNEL32 ref: 004047CC
LeaveCriticalSection.KERNEL32 ref: 004047EC

Memory Dump Source

Source File: 00000009.00000002.2697019166.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2696991923.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697046843.0000000000406000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.0000000000407000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697075143.000000000057F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697240526.00000000005EC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697267899.00000000005ED000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697295387.00000000005F7000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2697323479.00000000005FA000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 7071aa11a38e3c57621858676629779fcba5bdd6db2ec511ea845adb0464b329
Instruction ID: 46401e4bec968091738f5556b139132095cec4b6d9c1767d184e2db1189f27dd
Opcode Fuzzy Hash: 7071aa11a38e3c57621858676629779fcba5bdd6db2ec511ea845adb0464b329
Instruction Fuzzy Hash: C9F028B59007198FC710BFB8E88482B7BF4FA58300B050539EE448B345E738E81DCBA2

Analysis Process: exiftool.exePID: 7056, Parent PID: 2232COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	359
Total number of Limit Nodes:	42

Executed Functions

Function 00401180 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 206
sleeplibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 0040120F
SetUnhandledExceptionFilter.KERNEL32 ref: 004012A4
GetProcAddress.KERNEL32 ref: 004012C2
malloc.MSVCRT ref: 00401367
strlen.MSVCRT ref: 00401386
malloc.MSVCRT ref: 00401391
memcpy.MSVCRT ref: 004013AD
_cexit.MSVCRT ref: 00401417
GetStartupInfoA.KERNEL32 ref: 00401483

Strings

`V@, xrefs: 00401273
_set_invalid_parameter_handler, xrefs: 004012B7

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: malloc$AddressExceptionFilterInfoProcSleepStartupUnhandled_cexitmemcpystrlen
String ID: _set_invalid_parameter_handler$`V@
API String ID: 2757201259-2512680895
Opcode ID: 04d675a59146fc535cb55354436bdc01e78fefea1af45d5486d17085725c69fa
Instruction ID: 5c2e3cb38274742ea8207141c97af8518500a390dfec1317df2d8cc8d1f4b367
Opcode Fuzzy Hash: 04d675a59146fc535cb55354436bdc01e78fefea1af45d5486d17085725c69fa
Instruction Fuzzy Hash: 37915CB1D043009FD710EFA9D98575A7BE0FB44348F01853EE889BB3A1D7789949CB9A

Function 6DC0E060 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageA.KERNEL32 ref: 6DC0E09E
LocalAlloc.KERNEL32 ref: 6DC0E0C0
GetLastError.KERNEL32 ref: 6DC0E0D1
sprintf.MSVCRT ref: 6DC0E0F2
Perl_get_context.PERL524 ref: 6DC0E14B
Perl_sv_setpvn.PERL524 ref: 6DC0E167
LocalFree.KERNEL32 ref: 6DC0E173

Strings

@, xrefs: 6DC0E0B1

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: Local$AllocErrorFormatFreeLastMessagePerl_get_contextPerl_sv_setpvnsprintf
String ID: @
API String ID: 1796322246-2766056989
Opcode ID: a469c093ecc72941e23849fe8317cb28b60f9f2d452700e8b22856400eb7bb7d
Instruction ID: d413b9bb4cb1d52618b8bba047a3eb1a4751a14d85057da5f5d682898995ca48
Opcode Fuzzy Hash: a469c093ecc72941e23849fe8317cb28b60f9f2d452700e8b22856400eb7bb7d
Instruction Fuzzy Hash: 143146B164C3099FC7009F2AC48436ABBF4BB89354F04882DF898CB351E3768445DB92

Function 00405271 Relevance: 54.4, APIs: 28, Strings: 3, Instructions: 200
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Perl_get_context.PERL524 ref: 0040528D
Perl_get_context.PERL524 ref: 00405291
Perl_get_context.PERL524 ref: 004052B6
strcmp.MSVCRT ref: 0040531A
Perl_get_context.PERL524 ref: 00405332
Perl_av_fetch.PERL524 ref: 0040534B
Perl_get_context.PERL524 ref: 00405366
Perl_sv_2pv_flags.PERL524 ref: 0040537F
Perl_get_context.PERL524 ref: 00405397
Perl_get_context.PERL524 ref: 004053C9
Perl_sv_setpv.PERL524 ref: 004053DA
Perl_get_context.PERL524 ref: 004053EB
Perl_get_context.PERL524 ref: 0040542B
Perl_sv_setpv.PERL524 ref: 00405438
Perl_get_context.PERL524 ref: 0040543A
Perl_get_sv.PERL524 ref: 0040544F
Perl_get_context.PERL524 ref: 00405457
Perl_sv_setpv.PERL524 ref: 00405468
Perl_get_context.PERL524 ref: 0040546A
Perl_get_context.PERL524 ref: 00405487
Perl_get_context.PERL524 ref: 00405497
_mkdir.MSVCRT ref: 004054AE

Strings

PAR_TEMP, xrefs: 00405470
PAR_INITIALIZED, xrefs: 0040529A
PAR_PROGNAME, xrefs: 00405412

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setpv$Perl_av_fetchPerl_get_svPerl_sv_2pv_flags_mkdirstrcmp
String ID: PAR_INITIALIZED$PAR_PROGNAME$PAR_TEMP
API String ID: 674391251-2853059720
Opcode ID: f6fb234d177059682f656cd75b0a60c5134f1d60fd5bfbaa2c934e7829799bb8
Instruction ID: a3e3ee627eedb4d7a30bb4958642aeb7f3165177c59dc237d28b09ad30804d24
Opcode Fuzzy Hash: f6fb234d177059682f656cd75b0a60c5134f1d60fd5bfbaa2c934e7829799bb8
Instruction Fuzzy Hash: DB810CB09087019FD710EF69C98861ABBE4EF84354F15887EE884E73A1DB78D845CF5A

Function 6DC10AD0 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 161
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControls.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6DBA20B7), ref: 6DC10ADC
GetVersionExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6DBA20B7), ref: 6DC10AF3
GetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6DBA20B7), ref: 6DC10B44
RegOpenKeyExW.KERNEL32 ref: 6DC10B84
RegOpenKeyExW.KERNEL32 ref: 6DC10BBE

Strings

;, xrefs: 6DC10C54
", xrefs: 6DC10C72

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: Open$CommonControlsEnvironmentInitVariableVersion
String ID: "$;
API String ID: 3315731743-2221622046
Opcode ID: 2f941fae3ea84459f5db8b399d579a6c0720f51e7b0f2de4f6da1fcecc2254ac
Instruction ID: 21069775face71034324ad63ffd87c02e5e7cee9f423e44429c06839d5786a4a
Opcode Fuzzy Hash: 2f941fae3ea84459f5db8b399d579a6c0720f51e7b0f2de4f6da1fcecc2254ac
Instruction Fuzzy Hash: 5F6104B050C31D8FD700AF66D88462ABBF4BF85748F02896DD9888B251F774D454EB97

Function 6DBC5540 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Perl_ckwarn.PERL524 ref: 6DBC558B
Perl_PerlIO_fileno.PERL524 ref: 6DBC55B5
Perl_PerlIO_flush.PERL524 ref: 6DBC55EF
Perl_PerlIO_close.PERL524 ref: 6DBC560F
Perl_PerlIO_fileno.PERL524 ref: 6DBC5662
Perl_PerlIO_close.PERL524 ref: 6DBC5698
Perl_PerlIO_clearerr.PERL524 ref: 6DBC56D9
Perl_PerlIO_fileno.PERL524 ref: 6DBC56E5
Perl_PerlIO_stdin.PERL524 ref: 6DBC5917
Perl_warner.PERL524 ref: 6DBC594F
Perl_PerlIO_stdout.PERL524 ref: 6DBC5963
Perl_PerlIO_stderr.PERL524 ref: 6DBC5977

Strings

OUT, xrefs: 6DBC5A2F
ERR, xrefs: 6DBC5A36

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: PerlPerl_$O_fileno$O_close$O_clearerrO_flushO_stderrO_stdinO_stdoutPerl_ckwarnPerl_warner
String ID: ERR$OUT
API String ID: 2324420954-2006351519
Opcode ID: 312cf2a112ffc84b042b36aeaa67bf5ecfdf10b15fd5407fd4c946a3c62a0e82
Instruction ID: e0c9a6acb7146873d9c1ab8c14715a3e0a0f4147d3e1298dd82ba88fc77b1404
Opcode Fuzzy Hash: 312cf2a112ffc84b042b36aeaa67bf5ecfdf10b15fd5407fd4c946a3c62a0e82
Instruction Fuzzy Hash: 42D114B06097859FD324CF29C08076ABBE1FF89304F91886DE4D98B359EB35D881CB46

Function 6DC0B780 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 232
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 6DC0B79B
Perl_get_context.PERL524 ref: 6DC0B7A2

Part of subcall function 6DC137D0: GetLastError.KERNEL32(?,?,?,?,?,?,6DBF74F9,?,?,?,?,00000000,6DC25E00), ref: 6DC137DB
Part of subcall function 6DC137D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,6DBF74F9,?,?,?,?,00000000,6DC25E00), ref: 6DC137EB
Part of subcall function 6DC137D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,6DBF74F9,?,?,?,?,00000000,6DC25E00), ref: 6DC137F9

strlen.MSVCRT ref: 6DC0B7ED
CreateFileA.KERNEL32 ref: 6DC0B832
GetFileInformationByHandle.KERNEL32 ref: 6DC0B854
CloseHandle.KERNEL32 ref: 6DC0B86B
_stati64.MSVCRT ref: 6DC0B87B
GetFileAttributesA.KERNEL32 ref: 6DC0B8BD
strncpy.MSVCRT ref: 6DC0B900

Strings

:, xrefs: 6DC0BAE5
\, xrefs: 6DC0BAF0

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: File$ErrorHandleLaststrlen$AttributesCloseCreateInformationPerl_get_contextValue_stati64strncpy
String ID: :$\
API String ID: 2416492980-1166558509
Opcode ID: 237db348cf85faa0e4540a41ba3a621d5e745ab1465d19cb83222aee269a3e55
Instruction ID: 01abfc0951e3b635d9a5fa78637eb40a9db970c7f8782b0d3f4bcfbc9bff22d2
Opcode Fuzzy Hash: 237db348cf85faa0e4540a41ba3a621d5e745ab1465d19cb83222aee269a3e55
Instruction Fuzzy Hash: 7791C77180C74D8ED711DF29C48436ABBF2BF82364F154A1EE9E84B290E33A8545CB97

Function 00406930 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Perl_sys_init3.PERL524 ref: 00406954
perl_alloc.PERL524 ref: 0040696A
perl_construct.PERL524 ref: 00406980
Perl_get_context.PERL524 ref: 00406986
Perl_get_context.PERL524 ref: 0040698F
Perl_get_context.PERL524 ref: 00406998
Perl_safesysmalloc.PERL524 ref: 004069B8
perl_parse.PERL524 ref: 00406A30
perl_destruct.PERL524 ref: 00406A44
perl_free.PERL524 ref: 00406A60
Perl_sys_term.PERL524 ref: 00406A66
perl_run.PERL524 ref: 00406A7D
Perl_croak_nocontext.PERL524 ref: 00406ABF
Perl_get_context.PERL524 ref: 00406AC5
Perl_get_context.PERL524 ref: 00406AD0

Strings

PAR_SPAWNED, xrefs: 00406A4A
PAR_TEMP, xrefs: 00406A9A

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_croak_nocontextPerl_safesysmallocPerl_sys_init3Perl_sys_termperl_allocperl_constructperl_destructperl_freeperl_parseperl_run
String ID: PAR_SPAWNED$PAR_TEMP
API String ID: 843739711-4243957210
Opcode ID: 3324eac508c2b93f8617d440c9b77bc47c9bc63885b45acbafbdb1b29cacd88f
Instruction ID: 4b4c029833748c289a530f3f3a2e5993469a2020104bc91764861236088fb18e
Opcode Fuzzy Hash: 3324eac508c2b93f8617d440c9b77bc47c9bc63885b45acbafbdb1b29cacd88f
Instruction Fuzzy Hash: 83512EB0A043008FD710EF65DA886597BE4FB45354F05847EE885AB7A1DB38D858CF59

Function 6DBD1EC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 6DBD1F02
Perl_safesysfree.PERL524 ref: 6DBD1F19
Perl_savepv.PERL524 ref: 6DBD1F25
strxfrm.MSVCRT ref: 6DBD1F6E
strxfrm.MSVCRT ref: 6DBD1F88
Perl_safesysfree.PERL524 ref: 6DBD1FF8

Strings

POSIX, xrefs: 6DBD1F42
d, xrefs: 6DBD1F73

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: Perl_safesysfreestrxfrm$Perl_savepvstrcmp
String ID: POSIX$d
API String ID: 3523236933-8394547
Opcode ID: eddbc00cb03bf68de72db2a327333e02bc4c9dd224d82608c7c5dc3e8c4f1f58
Instruction ID: a073abd38d0825a5385381d349b4465d78162f12dc891838a58b33f6b8d8e4d7
Opcode Fuzzy Hash: eddbc00cb03bf68de72db2a327333e02bc4c9dd224d82608c7c5dc3e8c4f1f58
Instruction Fuzzy Hash: 2F414AB09083858FDBA19F24C18436ABAE1FF84744F09C87DD9C89F34AD7799449CB92

Function 6DBC8440 Relevance: 15.2, APIs: 10, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Perl_sv_setpvn.PERL524 ref: 6DBC84C4
Perl_PerlIO_fileno.PERL524 ref: 6DBC84E3
Perl_sv_2pv_flags.PERL524 ref: 6DBC85B8
Perl_sv_setpvn.PERL524 ref: 6DBC85E0
Perl_ckwarn.PERL524 ref: 6DBC862A
strlen.MSVCRT ref: 6DBC8636
Perl_warner.PERL524 ref: 6DBC8661
Perl_my_dirfd.PERL524 ref: 6DBC868B
Perl_mg_get.PERL524 ref: 6DBC86CE

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: Perl_sv_setpvn$O_filenoPerlPerl_Perl_ckwarnPerl_mg_getPerl_my_dirfdPerl_sv_2pv_flagsPerl_warnerstrlen
String ID:
API String ID: 374106082-0
Opcode ID: 7e0e1754dbb5710add06627d7f6893a7a7ee0e1fec917b0bf4fc235581c88bce
Instruction ID: cd643472eb4198c0a1264843ce05dd9dc3a3396de3e5a8829ab2aeeaed56df0e
Opcode Fuzzy Hash: 7e0e1754dbb5710add06627d7f6893a7a7ee0e1fec917b0bf4fc235581c88bce
Instruction Fuzzy Hash: 589138786083818FD741CF29C08076ABBE1FF85314F55896EE8A88B35AE774D841DB93

Function 6DC10820 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
stringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 6DC1083B
strlen.MSVCRT ref: 6DC10849
Perl_get_context.PERL524 ref: 6DC10855
LoadLibraryExA.KERNEL32 ref: 6DC1087D
strcpy.MSVCRT ref: 6DC1089F

Strings

/, xrefs: 6DC10830

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: LibraryLoadPerl_get_contextstrchrstrcpystrlen
String ID: /
API String ID: 3557389676-2043925204
Opcode ID: 7ce430ae763b030bebef009461eaf5180afb411a6b43591d7468d284e64c97cd
Instruction ID: 2b60d01a5bdc72f1714d2362cc4a05dd65d66bf4bd969b4e2554799b075a65d2
Opcode Fuzzy Hash: 7ce430ae763b030bebef009461eaf5180afb411a6b43591d7468d284e64c97cd
Instruction Fuzzy Hash: F311E7B190C32D8AE7215F26D994269BFF0BF45348F020A2DD8C897241E3758454FB92

Function 6DBD2060 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setlocale.MSVCRT ref: 6DBD20E6

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: setlocale
String ID:
API String ID: 1598674530-0
Opcode ID: d07467be226d4b9d31ff5638d936bb982e7c7d479ce09a9c981e13116cd93a61
Instruction ID: d8d873c7a0255f5b00f30a12d41c78fadaff779ac637821a3336b6a460d58269
Opcode Fuzzy Hash: d07467be226d4b9d31ff5638d936bb982e7c7d479ce09a9c981e13116cd93a61
Instruction Fuzzy Hash: 8251C9B0549789DFE7A19F64C58472ABBF0BF85710F05896DE9C88B319E334D841CB62

Function 6DC0EA50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCRT ref: 6DC0EA68
Perl_get_context.PERL524 ref: 6DC0EA77

Part of subcall function 6DC137D0: GetLastError.KERNEL32(?,?,?,?,?,?,6DBF74F9,?,?,?,?,00000000,6DC25E00), ref: 6DC137DB
Part of subcall function 6DC137D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,6DBF74F9,?,?,?,?,00000000,6DC25E00), ref: 6DC137EB
Part of subcall function 6DC137D0: SetLastError.KERNEL32(?,?,?,?,?,?,?,6DBF74F9,?,?,?,?,00000000,6DC25E00), ref: 6DC137F9

_open.MSVCRT ref: 6DC0EA9B

Strings

NUL, xrefs: 6DC0EA6F

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: ErrorLast$Perl_get_contextValue_open_stricmp
String ID: NUL
API String ID: 3126509927-1038343538
Opcode ID: 2eeca4ddb02cb6816fa016aaa3258b2a118615ccc483e9bb41c33806aeced766
Instruction ID: 2a3cf3b6e43cdb8e5a608e90f644cabde8de4a3e3be4b5cb07809f2fc835d374
Opcode Fuzzy Hash: 2eeca4ddb02cb6816fa016aaa3258b2a118615ccc483e9bb41c33806aeced766
Instruction Fuzzy Hash: 94F0F8F590D7199FC700AF299A8444ABFE4BF88218F138D6DE88987301E330D8409F52

Function 6DBFEF90 Relevance: 6.1, APIs: 4, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 6DBFEFC0
realloc.MSVCRT ref: 6DBFEFDE
LeaveCriticalSection.KERNEL32 ref: 6DBFEFFB
LeaveCriticalSection.KERNEL32 ref: 6DBFF053

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: CriticalSection$Leave$Enterrealloc
String ID:
API String ID: 2561680883-0
Opcode ID: 8581104f1ef2e55dbd96ccadc29697f1f474ca2b18e9a93c01dadcdaca0060b2
Instruction ID: a86a7756c177658cad1ef965cfd3328c2c7574ba58dc2a0fac429eb8e995f9d9
Opcode Fuzzy Hash: 8581104f1ef2e55dbd96ccadc29697f1f474ca2b18e9a93c01dadcdaca0060b2
Instruction Fuzzy Hash: F521A3B54097458FC701DF2AC18051AFBF0FF88718F45892DE99897305E734E95ACB86

Function 6DBFEEC0 Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Perl_warn_nocontext.PERL524(?,?,?,?,?,?,?,?,?,?,?,6DC01C56), ref: 6DBFEEF1

Part of subcall function 6DBF87C0: Perl_get_context.PERL524(?,?,?,?,?,?,?,?,?,?,6DBFEEF6), ref: 6DBF87C3
Part of subcall function 6DBF87C0: Perl_vwarn.PERL524(?,?,?,?,?,?,?,?,?,?,6DBFEEF6), ref: 6DBF87E3

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6DC01C56), ref: 6DBFEF16
free.MSVCRT ref: 6DBFEF37
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6DC01C56), ref: 6DBFEF3F

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterLeavePerl_get_contextPerl_vwarnPerl_warn_nocontextfree
String ID:
API String ID: 1024057756-0
Opcode ID: 939921407bee59fc6c73b2cf0f26549f185028a130c112756dacd91587800f16
Instruction ID: f875df095d6acb050f473b8b4e52ae6a695a477b5e2b5b4c56eb93e0926ad63d
Opcode Fuzzy Hash: 939921407bee59fc6c73b2cf0f26549f185028a130c112756dacd91587800f16
Instruction Fuzzy Hash: D401E9B4908341CFDB00EF19C18862EFBF1FF88704F01896DE9849B219D334A9498B93

Function 6DC11D30 Relevance: 6.0, APIs: 4, Instructions: 30
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 6DC11D45
Perl_croak_nocontext.PERL524 ref: 6DC11D72
Perl_croak_nocontext.PERL524 ref: 6DC11D7E
htonl.WS2_32 ref: 6DC11DA9

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: Perl_croak_nocontext$Startuphtonl
String ID:
API String ID: 1922733281-0
Opcode ID: 5b7a2a25c4beed1bdd0a3ff6fecb02caec790a124d972a8668da219590e6b244
Instruction ID: 82fba646c4a229ee6c618d6122c1e65c811992115748e886eabae309d6efb7eb
Opcode Fuzzy Hash: 5b7a2a25c4beed1bdd0a3ff6fecb02caec790a124d972a8668da219590e6b244
Instruction Fuzzy Hash: 9EF019B1D0865A8BD710FF68D40976EBAF0BB92309F42491CD88497204F7789149DB93

Function 6DBFEC50 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6DBFF668), ref: 6DBFEC69
malloc.MSVCRT ref: 6DBFEC7C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,6DBFF668), ref: 6DBFEC99
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,6DBFF668), ref: 6DBFECB8

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: CriticalSection$Leave$Entermalloc
String ID:
API String ID: 3130977980-0
Opcode ID: ba816db19cddd92495d5ebef8da8c8b23c77b281e65d7c9521d312b8992491e5
Instruction ID: 88c0f21da915a79ff7fcc6f71eef43db19e4b5f6d09b765646bada106797b5af
Opcode Fuzzy Hash: ba816db19cddd92495d5ebef8da8c8b23c77b281e65d7c9521d312b8992491e5
Instruction Fuzzy Hash: 5001DCB1808B468FCB00EF29C18551AFBF0BF88704F45896DE8899B205E730E959CB97

Function 6DC0EAD0 Relevance: 4.5, APIs: 3, Instructions: 24COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 6DC0EADA
GetConsoleMode.KERNEL32 ref: 6DC0EAF2
_errno.MSVCRT ref: 6DC0EB10

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: ConsoleMode_errno_get_osfhandle
String ID:
API String ID: 2083124694-0
Opcode ID: 5b424be2b8a72cf911ad5f39e59ebc489045c645ff5df3a0d4c17d2cc5e53393
Instruction ID: fd9d9ef023aca83ee50a1b6092e4b68fc2ad62495843d73feff3917ce7aea0ba
Opcode Fuzzy Hash: 5b424be2b8a72cf911ad5f39e59ebc489045c645ff5df3a0d4c17d2cc5e53393
Instruction Fuzzy Hash: 2DE065706043048FDB04AF36884832A77F1BFC8320F858A64E854CB654F7798559DF42

Function 6DC028C0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 6DC23950: malloc.MSVCRT ref: 6DC239AA

perl_alloc_using.PERL524 ref: 6DC02985

Part of subcall function 6DBA2120: Perl_set_context.PERL524 ref: 6DBA214B

Memory Dump Source

Source File: 0000000F.00000002.3063275862.000000006DAC1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6DAC0000, based on PE: true

Associated: 0000000F.00000002.3063243024.000000006DAC0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063395638.000000006DC26000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063433054.000000006DC2C000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063491507.000000006DC83000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063524943.000000006DC85000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063559141.000000006DC90000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063595105.000000006DC91000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.3063634114.000000006DC94000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6dac0000_exiftool.jbxd

Similarity

API ID: Perl_set_contextmallocperl_alloc_using
String ID:
API String ID: 3042708129-0
Opcode ID: 07163e5e353a247b26ff7134521c67801717e9bbc4db0dace2fb2aeb49b4ce41
Instruction ID: cb2685e60011a663dbbfab9498f88c992a836c42c545a6e7436da13e69238618
Opcode Fuzzy Hash: 07163e5e353a247b26ff7134521c67801717e9bbc4db0dace2fb2aeb49b4ce41
Instruction Fuzzy Hash: FB21B2B490530A8FCB44DF68C18469EFBF4BF48314F114679E998A7341E7309A81CF92

Non-executed Functions

Function 6560A76C Relevance: 24.1, APIs: 16, Instructions: 101COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560A26C
Perl_get_context.PERL524 ref: 6560A278
Perl_sv_grow.PERL524 ref: 6560A28D
Perl_get_context.PERL524 ref: 6560A297
Perl_get_context.PERL524 ref: 6560A2AC
Perl_get_context.PERL524 ref: 6560A2BE
Perl_get_context.PERL524 ref: 6560A312
Perl_get_context.PERL524 ref: 6560A321
Perl_get_context.PERL524 ref: 6560A330
Perl_get_context.PERL524 ref: 6560A341
Perl_get_context.PERL524 ref: 6560A353
Perl_sv_newmortal.PERL524 ref: 6560A358
Perl_get_context.PERL524 ref: 6560A36F
Perl_sv_setuv.PERL524 ref: 6560A388
Perl_get_context.PERL524 ref: 6560A38E
Perl_get_context.PERL524 ref: 6560A396
Perl_get_context.PERL524 ref: 6560A39A
Perl_get_context.PERL524 ref: 6560A770
Perl_get_context.PERL524 ref: 6560A790

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_growPerl_sv_newmortalPerl_sv_setuv
String ID:
API String ID: 269151090-0
Opcode ID: dca149403b15f617a9145960627f74358cf0992fa855ee618604b702b31409f5
Instruction ID: 40e3f19d6e46e1f4db1d9f079f6952f210c7762fa5bd9f3e94a1d8f77926300b
Opcode Fuzzy Hash: dca149403b15f617a9145960627f74358cf0992fa855ee618604b702b31409f5
Instruction Fuzzy Hash: 5341BD786182058FC754DF69C588E19F7E1FF88264F4A85A9E989CB722DB34E841CB06

Function 66E02810 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 66E0285F
UnhandledExceptionFilter.KERNEL32 ref: 66E0286F
GetCurrentProcess.KERNEL32 ref: 66E02878
TerminateProcess.KERNEL32 ref: 66E02889
abort.MSVCRT ref: 66E02892

Strings

Sf@Pfm, xrefs: 66E02868

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID: Sf@Pfm
API String ID: 520269711-4181869411
Opcode ID: 4a5b5d5c7bc669dbf3aeed36fd99b6a06febc6248fe1b3ec4918ae4119d5bcc1
Instruction ID: 68799b5006d63ef870ff13d9bfd3a78270d4812513963a1631fe0fe6cced9de1
Opcode Fuzzy Hash: 4a5b5d5c7bc669dbf3aeed36fd99b6a06febc6248fe1b3ec4918ae4119d5bcc1
Instruction Fuzzy Hash: 1401E8B0806225CFCF00EFA9C24854D7BF1BB8A304F10891DEA4487305E776686C8F92

Function 6560FC30 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6560FC7F
UnhandledExceptionFilter.KERNEL32 ref: 6560FC8F
GetCurrentProcess.KERNEL32 ref: 6560FC98
TerminateProcess.KERNEL32 ref: 6560FCA9
abort.MSVCRT ref: 6560FCB2

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: cdf67463759bcd80ce585cc185b32c9955f9de5fea47025e86df4bed300dc85f
Instruction ID: 10d2efc48ae2749bcaaf25082e201682bd278f4937b8f39f86ecc661ba2f6e2d
Opcode Fuzzy Hash: cdf67463759bcd80ce585cc185b32c9955f9de5fea47025e86df4bed300dc85f
Instruction Fuzzy Hash: 270172B0A143489FCF20EFBED24A569BBF0BB1A305F41852AE94597200EF749544CF97

Function 004064F0 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040653F
UnhandledExceptionFilter.KERNEL32 ref: 0040654F
GetCurrentProcess.KERNEL32 ref: 00406558
TerminateProcess.KERNEL32 ref: 00406569
abort.MSVCRT ref: 00406572

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: ce0ed217190266291961aa213940aef57dbe2ee2bba08c51a5fb236f5eab1c6f
Instruction ID: bc8e2f2fe6a866e2ae137e599d31fa6f27f2baa48516fa0a8de784d0dcb02cb1
Opcode Fuzzy Hash: ce0ed217190266291961aa213940aef57dbe2ee2bba08c51a5fb236f5eab1c6f
Instruction Fuzzy Hash: AB01A4B4C09204DFD700EFB9EA4854D7BF0BB48304F008A7DE945A7220E775A549DF5A

Function 656014C0 Relevance: 177.2, APIs: 100, Strings: 1, Instructions: 491COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 656014CD
Perl_get_context.PERL524 ref: 656014D1
Perl_get_context.PERL524 ref: 656014DE
Perl_get_context.PERL524 ref: 656014F8
Perl_get_context.PERL524 ref: 65601514
Perl_get_context.PERL524 ref: 6560152F
Perl_get_context.PERL524 ref: 65601537
Perl_sv_2uv_flags.PERL524 ref: 65601548
Perl_get_context.PERL524 ref: 65601550
Perl_get_context.PERL524 ref: 65601561
Perl_get_context.PERL524 ref: 6560157C
Perl_get_context.PERL524 ref: 65601584
Perl_sv_2uv_flags.PERL524 ref: 65601595
SetStdHandle.KERNEL32 ref: 656015A2
Perl_get_context.PERL524 ref: 656015B3
Perl_get_context.PERL524 ref: 656015B8
Perl_get_context.PERL524 ref: 656015C3
Perl_get_context.PERL524 ref: 656015C7
Perl_get_context.PERL524 ref: 656015D6
Perl_get_context.PERL524 ref: 656015EB
Perl_get_context.PERL524 ref: 656015FA
Perl_av_len.PERL524 ref: 65601607
Perl_get_context.PERL524 ref: 65601620
Perl_get_context.PERL524 ref: 65601635
Perl_get_context.PERL524 ref: 65601640
Perl_av_len.PERL524 ref: 6560164B
Perl_get_context.PERL524 ref: 65601685
Perl_croak_xs_usage.PERL524 ref: 656016A6
Perl_get_context.PERL524 ref: 656016BD
Perl_get_context.PERL524 ref: 656016C1
Perl_get_context.PERL524 ref: 656016CE
Perl_get_context.PERL524 ref: 656016E8
Perl_get_context.PERL524 ref: 65601704
Perl_get_context.PERL524 ref: 6560171F
Perl_get_context.PERL524 ref: 65601727
Perl_sv_2uv_flags.PERL524 ref: 65601738
Perl_get_context.PERL524 ref: 65601740
GetStdHandle.KERNEL32 ref: 65601748
Perl_get_context.PERL524 ref: 65601755
Perl_newSViv.PERL524 ref: 65601766
Perl_get_context.PERL524 ref: 6560176E
Perl_sv_2mortal.PERL524 ref: 65601777
Perl_get_context.PERL524 ref: 6560177F
Perl_get_context.PERL524 ref: 65601783

Strings

; ae, xrefs: 65601B07

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flags$HandlePerl_av_len$Perl_croak_xs_usagePerl_newPerl_sv_2mortal
String ID: ; ae
API String ID: 1311114589-2132617581
Opcode ID: 63fdd3f503c12683e62dd12463abc4a2ea3efc8ea40feb8d50ae84d8207927c5
Instruction ID: 6d4dfd45c6789e6c267d9dd7abcf11cbb737b1e7124daf9d9953e5f621d7ffc7
Opcode Fuzzy Hash: 63fdd3f503c12683e62dd12463abc4a2ea3efc8ea40feb8d50ae84d8207927c5
Instruction Fuzzy Hash: 25122B759183058FC710DF79C988A59FBF1FF49324F4A859AE9898B362DB34E840CB46

Function 6560EF80 Relevance: 159.5, APIs: 87, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560EF8C
Perl_xs_handshake.PERL524 ref: 6560EFB1
Perl_get_context.PERL524 ref: 6560EFB9
Perl_get_context.PERL524 ref: 6560EFBB
Perl_get_context.PERL524 ref: 6560EFC0
Perl_newXS_deffile.PERL524 ref: 6560EFDB
Perl_get_context.PERL524 ref: 6560EFDD
Perl_newXS_deffile.PERL524 ref: 6560EFF2
Perl_get_context.PERL524 ref: 6560EFF4
Perl_newXS_deffile.PERL524 ref: 6560F009
Perl_get_context.PERL524 ref: 6560F00B
Perl_newXS_deffile.PERL524 ref: 6560F020
Perl_get_context.PERL524 ref: 6560F022
Perl_newXS_deffile.PERL524 ref: 6560F037
Perl_get_context.PERL524 ref: 6560F039
Perl_newXS_deffile.PERL524 ref: 6560F04E
Perl_get_context.PERL524 ref: 6560F050
Perl_newXS_deffile.PERL524 ref: 6560F065
Perl_get_context.PERL524 ref: 6560F067
Perl_newXS_deffile.PERL524 ref: 6560F07C
Perl_get_context.PERL524 ref: 6560F07E
Perl_newXS_deffile.PERL524 ref: 6560F093
Perl_get_context.PERL524 ref: 6560F095
Perl_newXS_deffile.PERL524 ref: 6560F0AA
Perl_get_context.PERL524 ref: 6560F0AC
Perl_newXS_deffile.PERL524 ref: 6560F0C1
Perl_get_context.PERL524 ref: 6560F0C3
Perl_newXS_deffile.PERL524 ref: 6560F0D8
Perl_get_context.PERL524 ref: 6560F0DA
Perl_newXS_deffile.PERL524 ref: 6560F0EF
Perl_get_context.PERL524 ref: 6560F0F1
Perl_newXS_deffile.PERL524 ref: 6560F106
Perl_get_context.PERL524 ref: 6560F108
Perl_newXS_deffile.PERL524 ref: 6560F11D
Perl_get_context.PERL524 ref: 6560F11F
Perl_newXS_deffile.PERL524 ref: 6560F134
Perl_get_context.PERL524 ref: 6560F136
Perl_newXS_deffile.PERL524 ref: 6560F14B
Perl_get_context.PERL524 ref: 6560F14D
Perl_newXS_deffile.PERL524 ref: 6560F162
Perl_get_context.PERL524 ref: 6560F164
Perl_newXS_deffile.PERL524 ref: 6560F179
Perl_get_context.PERL524 ref: 6560F17B
Perl_newXS_deffile.PERL524 ref: 6560F190
Perl_get_context.PERL524 ref: 6560F192
Perl_newXS_deffile.PERL524 ref: 6560F1A7
Perl_get_context.PERL524 ref: 6560F1A9
Perl_newXS_deffile.PERL524 ref: 6560F1BE
Perl_get_context.PERL524 ref: 6560F1C0
Perl_newXS_deffile.PERL524 ref: 6560F1D5
Perl_get_context.PERL524 ref: 6560F1D7
Perl_newXS_deffile.PERL524 ref: 6560F1EC
Perl_get_context.PERL524 ref: 6560F1EE
Perl_newXS_deffile.PERL524 ref: 6560F203
Perl_get_context.PERL524 ref: 6560F205
Perl_newXS_deffile.PERL524 ref: 6560F21A
Perl_get_context.PERL524 ref: 6560F21C
Perl_newXS_deffile.PERL524 ref: 6560F231
Perl_get_context.PERL524 ref: 6560F233
Perl_newXS_deffile.PERL524 ref: 6560F248
Perl_get_context.PERL524 ref: 6560F24A
Perl_newXS_deffile.PERL524 ref: 6560F25F
Perl_get_context.PERL524 ref: 6560F261
Perl_newXS_deffile.PERL524 ref: 6560F276
Perl_get_context.PERL524 ref: 6560F278
Perl_newXS_deffile.PERL524 ref: 6560F28D
Perl_get_context.PERL524 ref: 6560F28F
Perl_newXS_deffile.PERL524 ref: 6560F2A4
Perl_get_context.PERL524 ref: 6560F2A6
Perl_newXS_deffile.PERL524 ref: 6560F2BB
Perl_get_context.PERL524 ref: 6560F2BD
Perl_newXS_deffile.PERL524 ref: 6560F2D2
Perl_get_context.PERL524 ref: 6560F2D4
Perl_newXS_deffile.PERL524 ref: 6560F2E9
Perl_get_context.PERL524 ref: 6560F2EB
Perl_newXS_deffile.PERL524 ref: 6560F300
Perl_get_context.PERL524 ref: 6560F302
Perl_newXS_deffile.PERL524 ref: 6560F317
Perl_get_context.PERL524 ref: 6560F319
Perl_newXS_deffile.PERL524 ref: 6560F32E
Perl_get_context.PERL524 ref: 6560F330
Perl_newXS_deffile.PERL524 ref: 6560F345
Perl_get_context.PERL524 ref: 6560F347
Perl_newXS_deffile.PERL524 ref: 6560F35C
Perl_get_context.PERL524 ref: 6560F35E
Perl_newXS_deffile.PERL524 ref: 6560F373
Perl_get_context.PERL524 ref: 6560F375

Strings

m%ae, xrefs: 6560EF9E
e%ae, xrefs: 6560EF96
^%ae, xrefs: 6560EF8E
B*ae, xrefs: 6560F368

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_newS_deffile$Perl_xs_handshake
String ID: B*ae$^%ae$e%ae$m%ae
API String ID: 1948603558-3753478693
Opcode ID: 5f43d1211d13cb6f75908d12f5b721dc24ffd3d22c148101fadc08092b9e947a
Instruction ID: 3ef00f3dd617c38a87d2d345a0e6bc3eef1e774ef49737c1940ed96e600a1f2a
Opcode Fuzzy Hash: 5f43d1211d13cb6f75908d12f5b721dc24ffd3d22c148101fadc08092b9e947a
Instruction Fuzzy Hash: 56A1E0B0809755AAC715AF6AC99632EFEF0BE85640F51CC1DE4C98B210DB38C581DF8A

Function 65607549 Relevance: 126.5, APIs: 84, Instructions: 483COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606B66
Perl_get_context.PERL524 ref: 65606B7F
Perl_get_context.PERL524 ref: 65606B9E
Perl_get_context.PERL524 ref: 65606BAA
Perl_sv_2uv_flags.PERL524 ref: 65606BBB
Perl_get_context.PERL524 ref: 65606BC5
Perl_get_context.PERL524 ref: 65606BDE
Perl_get_context.PERL524 ref: 65606BF7
Perl_get_context.PERL524 ref: 65606C16
Perl_get_context.PERL524 ref: 65606C22
Perl_sv_2uv_flags.PERL524 ref: 65606C33
Perl_get_context.PERL524 ref: 65606C3D
Perl_get_context.PERL524 ref: 65606C56
Perl_get_context.PERL524 ref: 65606C6F
Perl_get_context.PERL524 ref: 65606C8E
Perl_get_context.PERL524 ref: 65606C9A
Perl_sv_2uv_flags.PERL524 ref: 65606CAB
Perl_get_context.PERL524 ref: 65606CB8
Perl_get_context.PERL524 ref: 65606CCA
Perl_get_context.PERL524 ref: 65606CDB
Perl_get_context.PERL524 ref: 65606CE9
Perl_get_context.PERL524 ref: 65606D00
Perl_get_context.PERL524 ref: 65606D12
Perl_get_context.PERL524 ref: 65606D24
Perl_get_context.PERL524 ref: 65606D39
Perl_get_context.PERL524 ref: 65606D54
Perl_get_context.PERL524 ref: 65606D60
Perl_sv_2uv_flags.PERL524 ref: 65606D75
Perl_get_context.PERL524 ref: 65606D7F
Perl_get_context.PERL524 ref: 65606D9C
Perl_get_context.PERL524 ref: 65606DB7
Perl_get_context.PERL524 ref: 65606DC3
Perl_sv_2pv_flags.PERL524 ref: 65606DE0
Perl_get_context.PERL524 ref: 65606DEA
Perl_get_context.PERL524 ref: 65606E03
Perl_get_context.PERL524 ref: 65606E1C
Perl_get_context.PERL524 ref: 65606E3B
Perl_get_context.PERL524 ref: 65606E4B
Perl_sv_pvn_force_flags.PERL524 ref: 65606E68
Perl_get_context.PERL524 ref: 65606E6E
Perl_get_context.PERL524 ref: 65606E9E
Perl_get_context.PERL524 ref: 65606EAE
Perl_sv_grow.PERL524 ref: 65606EC3
Perl_get_context.PERL524 ref: 65606ECD
Perl_get_context.PERL524 ref: 65606EE2
Perl_get_context.PERL524 ref: 65606EF4
Perl_get_context.PERL524(?), ref: 65606F19
Perl_get_context.PERL524 ref: 65606F2E
Perl_get_context.PERL524 ref: 65606F43
Perl_get_context.PERL524 ref: 65606F5E
Perl_get_context.PERL524 ref: 65606F6A
Perl_sv_pvn_force_flags.PERL524 ref: 65606F87
Perl_get_context.PERL524 ref: 65606F8D
Perl_get_context.PERL524 ref: 65606FB9
Perl_get_context.PERL524 ref: 65606FC5
Perl_sv_grow.PERL524 ref: 65606FDA
Perl_get_context.PERL524 ref: 65606FE4
Perl_get_context.PERL524 ref: 65606FF9
Perl_get_context.PERL524 ref: 6560700B
GetVolumeInformationW.KERNEL32(?), ref: 6560706B
Perl_get_context.PERL524(?), ref: 65607096
Perl_get_context.PERL524 ref: 656070B7
Perl_get_context.PERL524 ref: 656070C9
Perl_get_context.PERL524 ref: 656070ED
Perl_get_context.PERL524 ref: 656070F9
Perl_sv_setuv.PERL524 ref: 65607112
Perl_get_context.PERL524 ref: 65607118
Perl_get_context.PERL524 ref: 6560712E
Perl_get_context.PERL524 ref: 65607152
Perl_get_context.PERL524 ref: 6560715E
Perl_sv_setuv.PERL524 ref: 65607177
Perl_get_context.PERL524 ref: 6560717D
Perl_get_context.PERL524 ref: 65607193
Perl_get_context.PERL524 ref: 656071B7
Perl_get_context.PERL524 ref: 656071C3
Perl_sv_setuv.PERL524 ref: 656071DC
Perl_get_context.PERL524 ref: 656071E2
Perl_get_context.PERL524 ref: 656071F8
Perl_sv_newmortal.PERL524 ref: 656071FD
Perl_get_context.PERL524 ref: 6560721F
Perl_get_context.PERL524 ref: 65607223
Perl_sv_setsv_flags.PERL524 ref: 6560723E
Perl_get_context.PERL524 ref: 65607244
Perl_get_context.PERL524 ref: 6560724C
Perl_get_context.PERL524 ref: 65607250
Perl_get_context.PERL524 ref: 656072D0
Perl_get_context.PERL524 ref: 656072E9
Perl_get_context.PERL524 ref: 656072F8
Perl_av_len.PERL524 ref: 65607301
Perl_get_context.PERL524 ref: 65607550
Perl_get_context.PERL524 ref: 65607569
Perl_get_context.PERL524 ref: 65607578
Perl_av_len.PERL524 ref: 65607581
Perl_get_context.PERL524 ref: 65607661
Perl_get_context.PERL524 ref: 65607673
Perl_get_context.PERL524 ref: 65607A20
Perl_get_context.PERL524 ref: 65607A4F

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flags$Perl_sv_setuv$Perl_av_lenPerl_sv_growPerl_sv_pvn_force_flags$InformationPerl_sv_2pv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsVolume
String ID:
API String ID: 517291862-0
Opcode ID: 378aa6390c399f55bd51eb62e4b7b1f0ed658f5f37d4f0d1736c897c34fa1171
Instruction ID: 419d6ee40a5788db4ec2af504bc1435f01c5f5fa9062eca7115a859e9d16c22d
Opcode Fuzzy Hash: 378aa6390c399f55bd51eb62e4b7b1f0ed658f5f37d4f0d1736c897c34fa1171
Instruction Fuzzy Hash: 4C3286746183409FD754DF69C588E19FBE1FF89324F4A885DE8898B362DB74E844CB06

Function 65608AC9 Relevance: 126.5, APIs: 84, Instructions: 483COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 656080E6
Perl_get_context.PERL524 ref: 656080FF
Perl_get_context.PERL524 ref: 6560811E
Perl_get_context.PERL524 ref: 6560812A
Perl_sv_2uv_flags.PERL524 ref: 6560813B
Perl_get_context.PERL524 ref: 65608145
Perl_get_context.PERL524 ref: 6560815E
Perl_get_context.PERL524 ref: 65608177
Perl_get_context.PERL524 ref: 65608196
Perl_get_context.PERL524 ref: 656081A2
Perl_sv_2uv_flags.PERL524 ref: 656081B3
Perl_get_context.PERL524 ref: 656081BD
Perl_get_context.PERL524 ref: 656081D6
Perl_get_context.PERL524 ref: 656081EF
Perl_get_context.PERL524 ref: 6560820E
Perl_get_context.PERL524 ref: 6560821A
Perl_sv_2uv_flags.PERL524 ref: 6560822B
Perl_get_context.PERL524 ref: 65608238
Perl_get_context.PERL524 ref: 6560824A
Perl_get_context.PERL524 ref: 6560825B
Perl_get_context.PERL524 ref: 65608269
Perl_get_context.PERL524 ref: 65608280
Perl_get_context.PERL524 ref: 65608292
Perl_get_context.PERL524 ref: 656082A4
Perl_get_context.PERL524 ref: 656082B9
Perl_get_context.PERL524 ref: 656082D4
Perl_get_context.PERL524 ref: 656082E0
Perl_sv_2uv_flags.PERL524 ref: 656082F5
Perl_get_context.PERL524 ref: 656082FF
Perl_get_context.PERL524 ref: 6560831C
Perl_get_context.PERL524 ref: 65608337
Perl_get_context.PERL524 ref: 65608343
Perl_sv_2pv_flags.PERL524 ref: 65608360
Perl_get_context.PERL524 ref: 6560836A
Perl_get_context.PERL524 ref: 65608383
Perl_get_context.PERL524 ref: 6560839C
Perl_get_context.PERL524 ref: 656083BB
Perl_get_context.PERL524 ref: 656083CB
Perl_sv_pvn_force_flags.PERL524 ref: 656083E8
Perl_get_context.PERL524 ref: 656083EE
Perl_get_context.PERL524 ref: 6560841D
Perl_get_context.PERL524 ref: 6560842D
Perl_sv_grow.PERL524 ref: 65608442
Perl_get_context.PERL524 ref: 6560844C
Perl_get_context.PERL524 ref: 65608461
Perl_get_context.PERL524 ref: 65608473
Perl_get_context.PERL524(?), ref: 65608496
Perl_get_context.PERL524 ref: 656084AB
Perl_get_context.PERL524 ref: 656084C0
Perl_get_context.PERL524 ref: 656084DB
Perl_get_context.PERL524 ref: 656084E7
Perl_sv_pvn_force_flags.PERL524 ref: 65608504
Perl_get_context.PERL524 ref: 6560850A
Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5
Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 65608850
Perl_get_context.PERL524 ref: 65608869
Perl_get_context.PERL524 ref: 65608878
Perl_av_len.PERL524 ref: 65608881
Perl_get_context.PERL524 ref: 65608AD0
Perl_get_context.PERL524 ref: 65608AE9
Perl_get_context.PERL524 ref: 65608AF8
Perl_av_len.PERL524 ref: 65608B01
Perl_get_context.PERL524 ref: 65608ED8
Perl_get_context.PERL524 ref: 65608EE4
Perl_mg_set.PERL524 ref: 65608EED
Perl_get_context.PERL524 ref: 65608FA0
Perl_get_context.PERL524 ref: 65608FCB
Perl_get_context.PERL524 ref: 65609240
Perl_get_context.PERL524 ref: 6560925B
Perl_get_context.PERL524 ref: 65609267
Perl_sv_2pv_flags.PERL524 ref: 65609284
Perl_get_context.PERL524 ref: 65609292
Perl_get_context.PERL524 ref: 656092AD
Perl_get_context.PERL524 ref: 656092B5
Perl_sv_2pv_flags.PERL524 ref: 656092CE

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flags$Perl_sv_2pv_flagsPerl_sv_setuv$Perl_av_lenPerl_sv_growPerl_sv_pvn_force_flags$InformationPerl_mg_setPerl_sv_newmortalPerl_sv_setsv_flagsVolume
String ID:
API String ID: 4120940565-0
Opcode ID: d65e675e5b25fd1140184175c3a9b1efc09b15604c2626bab462936dc1a2e21f
Instruction ID: 772311dee1fbc73b6fa9642b54923b399536bb973c923fed458020acc506b121
Opcode Fuzzy Hash: d65e675e5b25fd1140184175c3a9b1efc09b15604c2626bab462936dc1a2e21f
Instruction Fuzzy Hash: F63286746183409FD754DF69C588E1AFBE1FF89324F4A885DE8898B362DB74E844CB06

Function 6560C94C Relevance: 118.9, APIs: 79, Instructions: 428stringCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560BBC8
Perl_get_context.PERL524 ref: 6560BBDA
Perl_get_context.PERL524 ref: 6560BBEF
Perl_get_context.PERL524 ref: 6560BC0A
Perl_get_context.PERL524 ref: 6560BC12
Perl_sv_2uv_flags.PERL524 ref: 6560BC23
Perl_get_context.PERL524 ref: 6560BC2D
Perl_get_context.PERL524 ref: 6560BC42
Perl_get_context.PERL524 ref: 6560BC53
Perl_get_context.PERL524 ref: 6560BC61
Perl_get_context.PERL524 ref: 6560BC78
Perl_get_context.PERL524 ref: 6560BC8A
Perl_get_context.PERL524 ref: 6560BC9C
Perl_get_context.PERL524 ref: 6560BCB1
Perl_get_context.PERL524 ref: 6560BCCC
Perl_get_context.PERL524 ref: 6560BCD4
Perl_sv_2uv_flags.PERL524 ref: 6560BCE5
Perl_get_context.PERL524 ref: 6560BCEF
Perl_get_context.PERL524 ref: 6560BD0C
Perl_get_context.PERL524 ref: 6560BD27
Perl_get_context.PERL524 ref: 6560BD2F
Perl_sv_2uv_flags.PERL524 ref: 6560BD40
Perl_get_context.PERL524 ref: 6560BD4A
Perl_get_context.PERL524 ref: 6560BD5F
Perl_get_context.PERL524 ref: 6560BD7A
Perl_get_context.PERL524 ref: 6560BD82
Perl_sv_2uv_flags.PERL524 ref: 6560BD93
Perl_get_context.PERL524 ref: 6560BD9D
Perl_get_context.PERL524 ref: 6560BDB6
Perl_get_context.PERL524 ref: 6560BDD5
Perl_get_context.PERL524 ref: 6560BDE1
Perl_sv_2pv_flags.PERL524 ref: 6560BDFA
Perl_get_context.PERL524 ref: 6560BE04
Perl_get_context.PERL524 ref: 6560BE19
Perl_get_context.PERL524 ref: 6560BE2E
Perl_get_context.PERL524 ref: 6560BE49
Perl_get_context.PERL524 ref: 6560BE55
Perl_sv_2uv_flags.PERL524 ref: 6560BE6A
Perl_get_context.PERL524 ref: 6560BE74
Perl_get_context.PERL524 ref: 6560BE8D
Perl_get_context.PERL524 ref: 6560BEAC
Perl_get_context.PERL524 ref: 6560BEBC
Perl_sv_2pv_flags.PERL524 ref: 6560BED9
Perl_get_context.PERL524 ref: 6560BEF7
Perl_get_context.PERL524 ref: 6560BF0C
Perl_get_context.PERL524 ref: 6560BF25
Perl_get_context.PERL524 ref: 6560BF3E
Perl_get_context.PERL524 ref: 6560BF5D
Perl_get_context.PERL524 ref: 6560BF6D
Perl_sv_pvn_force_flags.PERL524 ref: 6560BF8A
Perl_get_context.PERL524 ref: 6560BF90
Perl_get_context.PERL524 ref: 6560BFBF
Perl_get_context.PERL524 ref: 6560BFCF
Perl_sv_grow.PERL524 ref: 6560BFE4
Perl_get_context.PERL524 ref: 6560BFEE
Perl_get_context.PERL524 ref: 6560C003
Perl_get_context.PERL524 ref: 6560C015
DeviceIoControl.KERNEL32 ref: 6560C06C

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524 ref: 6560C08B
Perl_get_context.PERL524 ref: 6560C0A1
Perl_get_context.PERL524 ref: 6560C0C1
Perl_get_context.PERL524 ref: 6560C0CD
Perl_sv_setuv.PERL524 ref: 6560C0EA
Perl_get_context.PERL524 ref: 6560C0F0
Perl_get_context.PERL524 ref: 6560C102
Perl_sv_newmortal.PERL524 ref: 6560C107
Perl_get_context.PERL524 ref: 6560C12A
Perl_get_context.PERL524 ref: 6560C130
Perl_sv_setsv_flags.PERL524 ref: 6560C14B
Perl_get_context.PERL524 ref: 6560C151
Perl_get_context.PERL524 ref: 6560C159
Perl_get_context.PERL524 ref: 6560C160
Perl_get_context.PERL524 ref: 6560C6E4
Perl_get_context.PERL524 ref: 6560C6F7
Perl_get_context.PERL524 ref: 6560C70A
Perl_get_context.PERL524 ref: 6560C950
Perl_get_context.PERL524 ref: 6560C96B
Perl_get_context.PERL524 ref: 6560C973
Perl_sv_2pv_flags.PERL524 ref: 6560C98C
Perl_get_context.PERL524 ref: 6560C99A
Perl_get_context.PERL524 ref: 6560C9B5
Perl_get_context.PERL524 ref: 6560C9BD
Perl_sv_2pv_flags.PERL524 ref: 6560C9D6
Perl_get_context.PERL524 ref: 6560C9E5
Perl_get_context.PERL524 ref: 6560CA00
Perl_get_context.PERL524 ref: 6560CA08
Perl_sv_2pv_flags.PERL524 ref: 6560CA21
strtoul.MSVCRT ref: 6560CA3D
Perl_get_context.PERL524 ref: 6560CB50
Perl_get_context.PERL524 ref: 6560CB80
Perl_get_context.PERL524 ref: 6560CBB0

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2pv_flagsPerl_sv_2uv_flags$ControlDeviceErrorLastPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsPerl_sv_setuvstrtoul
String ID:
API String ID: 2523469590-0
Opcode ID: 93d8d2397843a1afa15606f052fa18c4f9c8dd457f18d4fe6a7783af1292f7da
Instruction ID: a729796994b5b1000d0422cd46055396c536a67b887aceb4be94f1e27ac8dddc
Opcode Fuzzy Hash: 93d8d2397843a1afa15606f052fa18c4f9c8dd457f18d4fe6a7783af1292f7da
Instruction Fuzzy Hash: 301281746183019FD754DF69C588E19FBE1FF89324F4A889DE8898B362DB74E844CB06

Function 65608A79 Relevance: 117.5, APIs: 78, Instructions: 452stringCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560815E
Perl_get_context.PERL524 ref: 65608177
Perl_get_context.PERL524 ref: 65608196
Perl_get_context.PERL524 ref: 656081A2
Perl_sv_2uv_flags.PERL524 ref: 656081B3
Perl_get_context.PERL524 ref: 656081BD
Perl_get_context.PERL524 ref: 656081D6
Perl_get_context.PERL524 ref: 656081EF
Perl_get_context.PERL524 ref: 6560820E
Perl_get_context.PERL524 ref: 6560821A
Perl_sv_2uv_flags.PERL524 ref: 6560822B
Perl_get_context.PERL524 ref: 65608238
Perl_get_context.PERL524 ref: 6560824A
Perl_get_context.PERL524 ref: 6560825B
Perl_get_context.PERL524 ref: 65608269
Perl_get_context.PERL524 ref: 65608280
Perl_get_context.PERL524 ref: 65608292
Perl_get_context.PERL524 ref: 656082A4
Perl_get_context.PERL524 ref: 656082B9
Perl_get_context.PERL524 ref: 656082D4
Perl_get_context.PERL524 ref: 656082E0
Perl_sv_2uv_flags.PERL524 ref: 656082F5
Perl_get_context.PERL524 ref: 656082FF
Perl_get_context.PERL524 ref: 6560831C
Perl_get_context.PERL524 ref: 65608337
Perl_get_context.PERL524 ref: 65608343
Perl_sv_2pv_flags.PERL524 ref: 65608360
Perl_get_context.PERL524 ref: 6560836A
Perl_get_context.PERL524 ref: 65608383
Perl_get_context.PERL524 ref: 6560839C
Perl_get_context.PERL524 ref: 656083BB
Perl_get_context.PERL524 ref: 656083CB
Perl_sv_pvn_force_flags.PERL524 ref: 656083E8
Perl_get_context.PERL524 ref: 656083EE
Perl_get_context.PERL524 ref: 6560841D
Perl_get_context.PERL524 ref: 6560842D
Perl_sv_grow.PERL524 ref: 65608442
Perl_get_context.PERL524 ref: 6560844C
Perl_get_context.PERL524 ref: 65608461
Perl_get_context.PERL524 ref: 65608473
Perl_get_context.PERL524(?), ref: 65608496
Perl_get_context.PERL524 ref: 656084AB
Perl_get_context.PERL524 ref: 656084C0
Perl_get_context.PERL524 ref: 656084DB
Perl_get_context.PERL524 ref: 656084E7
Perl_sv_pvn_force_flags.PERL524 ref: 65608504
Perl_get_context.PERL524 ref: 6560850A
Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 656087EC
Perl_av_len.PERL524 ref: 656087F5
Perl_get_context.PERL524 ref: 65608A80
Perl_get_context.PERL524 ref: 65608A99
Perl_get_context.PERL524 ref: 65608AA8
Perl_av_len.PERL524 ref: 65608AB1
Perl_get_context.PERL524 ref: 65608C51
Perl_get_context.PERL524 ref: 65608C63
Perl_get_context.PERL524 ref: 65608DB7
Perl_get_context.PERL524 ref: 65608DC3
Perl_mg_set.PERL524 ref: 65608DCC
Perl_get_context.PERL524 ref: 65608E90
Perl_get_context.PERL524 ref: 65608EA3
Perl_get_context.PERL524 ref: 65608EB6
strlen.MSVCRT ref: 65608ECB

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flagsPerl_sv_setuv$Perl_av_lenPerl_sv_growPerl_sv_pvn_force_flags$ErrorInformationLastPerl_mg_setPerl_sv_2pv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsVolumestrlen
String ID:
API String ID: 2985778385-0
Opcode ID: 70d8d185becdda047bb7c1b5b3640b86908880900d172cdfbc0e4180ba3e51eb
Instruction ID: b4ca56ec16f8fcb67dca4fb07620b98a82d8071ae5554a5ce3259fe8c43573fc
Opcode Fuzzy Hash: 70d8d185becdda047bb7c1b5b3640b86908880900d172cdfbc0e4180ba3e51eb
Instruction Fuzzy Hash: B92286746183409FD754DF69C588E1AFBE1FF89324F4A885DE8898B362DB74E844CB06

Function 656074F9 Relevance: 117.5, APIs: 78, Instructions: 452COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606BDE
Perl_get_context.PERL524 ref: 65606BF7
Perl_get_context.PERL524 ref: 65606C16
Perl_get_context.PERL524 ref: 65606C22
Perl_sv_2uv_flags.PERL524 ref: 65606C33
Perl_get_context.PERL524 ref: 65606C3D
Perl_get_context.PERL524 ref: 65606C56
Perl_get_context.PERL524 ref: 65606C6F
Perl_get_context.PERL524 ref: 65606C8E
Perl_get_context.PERL524 ref: 65606C9A
Perl_sv_2uv_flags.PERL524 ref: 65606CAB
Perl_get_context.PERL524 ref: 65606CB8
Perl_get_context.PERL524 ref: 65606CCA
Perl_get_context.PERL524 ref: 65606CDB
Perl_get_context.PERL524 ref: 65606CE9
Perl_get_context.PERL524 ref: 65606D00
Perl_get_context.PERL524 ref: 65606D12
Perl_get_context.PERL524 ref: 65606D24
Perl_get_context.PERL524 ref: 65606D39
Perl_get_context.PERL524 ref: 65606D54
Perl_get_context.PERL524 ref: 65606D60
Perl_sv_2uv_flags.PERL524 ref: 65606D75
Perl_get_context.PERL524 ref: 65606D7F
Perl_get_context.PERL524 ref: 65606D9C
Perl_get_context.PERL524 ref: 65606DB7
Perl_get_context.PERL524 ref: 65606DC3
Perl_sv_2pv_flags.PERL524 ref: 65606DE0
Perl_get_context.PERL524 ref: 65606DEA
Perl_get_context.PERL524 ref: 65606E03
Perl_get_context.PERL524 ref: 65606E1C
Perl_get_context.PERL524 ref: 65606E3B
Perl_get_context.PERL524 ref: 65606E4B
Perl_sv_pvn_force_flags.PERL524 ref: 65606E68
Perl_get_context.PERL524 ref: 65606E6E
Perl_get_context.PERL524 ref: 65606E9E
Perl_get_context.PERL524 ref: 65606EAE
Perl_sv_grow.PERL524 ref: 65606EC3
Perl_get_context.PERL524 ref: 65606ECD
Perl_get_context.PERL524 ref: 65606EE2
Perl_get_context.PERL524 ref: 65606EF4
Perl_get_context.PERL524(?), ref: 65606F19
Perl_get_context.PERL524 ref: 65606F2E
Perl_get_context.PERL524 ref: 65606F43
Perl_get_context.PERL524 ref: 65606F5E
Perl_get_context.PERL524 ref: 65606F6A
Perl_sv_pvn_force_flags.PERL524 ref: 65606F87
Perl_get_context.PERL524 ref: 65606F8D
Perl_get_context.PERL524 ref: 65606FB9
Perl_get_context.PERL524 ref: 65606FC5
Perl_sv_grow.PERL524 ref: 65606FDA
Perl_get_context.PERL524 ref: 65606FE4
Perl_get_context.PERL524 ref: 65606FF9
Perl_get_context.PERL524 ref: 6560700B
GetVolumeInformationW.KERNEL32(?), ref: 6560706B

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524(?), ref: 65607096
Perl_get_context.PERL524 ref: 656070B7
Perl_get_context.PERL524 ref: 656070C9
Perl_get_context.PERL524 ref: 656070ED
Perl_get_context.PERL524 ref: 656070F9
Perl_sv_setuv.PERL524 ref: 65607112
Perl_get_context.PERL524 ref: 65607118
Perl_get_context.PERL524 ref: 6560712E
Perl_get_context.PERL524 ref: 65607152
Perl_get_context.PERL524 ref: 6560715E
Perl_sv_setuv.PERL524 ref: 65607177
Perl_get_context.PERL524 ref: 6560717D
Perl_get_context.PERL524 ref: 65607193
Perl_get_context.PERL524 ref: 656071B7
Perl_get_context.PERL524 ref: 656071C3
Perl_sv_setuv.PERL524 ref: 656071DC
Perl_get_context.PERL524 ref: 656071E2
Perl_get_context.PERL524 ref: 656071F8
Perl_sv_newmortal.PERL524 ref: 656071FD
Perl_get_context.PERL524 ref: 6560721F
Perl_get_context.PERL524 ref: 65607223
Perl_sv_setsv_flags.PERL524 ref: 6560723E
Perl_get_context.PERL524 ref: 65607244
Perl_get_context.PERL524 ref: 6560724C
Perl_get_context.PERL524 ref: 65607250
Perl_get_context.PERL524 ref: 6560726C
Perl_av_len.PERL524 ref: 65607275
Perl_get_context.PERL524 ref: 65607500
Perl_get_context.PERL524 ref: 65607519
Perl_get_context.PERL524 ref: 65607528
Perl_av_len.PERL524 ref: 65607531
Perl_get_context.PERL524 ref: 656076D1
Perl_get_context.PERL524 ref: 656076E3
Perl_get_context.PERL524 ref: 65607837
Perl_get_context.PERL524 ref: 65607843
Perl_mg_set.PERL524 ref: 6560784C
Perl_get_context.PERL524 ref: 65607910
Perl_get_context.PERL524 ref: 65607923
Perl_get_context.PERL524 ref: 65607936
wcslen.MSVCRT ref: 6560794B

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flagsPerl_sv_setuv$Perl_av_lenPerl_sv_growPerl_sv_pvn_force_flags$ErrorInformationLastPerl_mg_setPerl_sv_2pv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsVolumewcslen
String ID:
API String ID: 1075458608-0
Opcode ID: 555b279cd6baa67f2ea5e48a5e0252dbacde937c1f404b82470358876f44a2c5
Instruction ID: 7cd231f5b76db9c46b5d206e121d50ec367bf4ca5551ef25bb3d47590a8175e8
Opcode Fuzzy Hash: 555b279cd6baa67f2ea5e48a5e0252dbacde937c1f404b82470358876f44a2c5
Instruction Fuzzy Hash: CD2295746183409FD754DF69C588E1AFBE1FF89324F4A885DE8898B362DB74E844CB06

Function 6560C59C Relevance: 108.4, APIs: 72, Instructions: 399COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560BBEF
Perl_get_context.PERL524 ref: 6560BC0A
Perl_get_context.PERL524 ref: 6560BC12
Perl_sv_2uv_flags.PERL524 ref: 6560BC23
Perl_get_context.PERL524 ref: 6560BC2D
Perl_get_context.PERL524 ref: 6560BC42
Perl_get_context.PERL524 ref: 6560BC53
Perl_get_context.PERL524 ref: 6560BC61
Perl_get_context.PERL524 ref: 6560BC78
Perl_get_context.PERL524 ref: 6560BC8A
Perl_get_context.PERL524 ref: 6560BC9C
Perl_get_context.PERL524 ref: 6560BCB1
Perl_get_context.PERL524 ref: 6560BCCC
Perl_get_context.PERL524 ref: 6560BCD4
Perl_sv_2uv_flags.PERL524 ref: 6560BCE5
Perl_get_context.PERL524 ref: 6560BCEF
Perl_get_context.PERL524 ref: 6560BD0C
Perl_get_context.PERL524 ref: 6560BD27
Perl_get_context.PERL524 ref: 6560BD2F
Perl_sv_2uv_flags.PERL524 ref: 6560BD40
Perl_get_context.PERL524 ref: 6560BD4A
Perl_get_context.PERL524 ref: 6560BD5F
Perl_get_context.PERL524 ref: 6560BD7A
Perl_get_context.PERL524 ref: 6560BD82
Perl_sv_2uv_flags.PERL524 ref: 6560BD93
Perl_get_context.PERL524 ref: 6560BD9D
Perl_get_context.PERL524 ref: 6560BDB6
Perl_get_context.PERL524 ref: 6560BDD5
Perl_get_context.PERL524 ref: 6560BDE1
Perl_sv_2pv_flags.PERL524 ref: 6560BDFA
Perl_get_context.PERL524 ref: 6560BE04
Perl_get_context.PERL524 ref: 6560BE19
Perl_get_context.PERL524 ref: 6560BE2E
Perl_get_context.PERL524 ref: 6560BE49
Perl_get_context.PERL524 ref: 6560BE55
Perl_sv_2uv_flags.PERL524 ref: 6560BE6A
Perl_get_context.PERL524 ref: 6560BE74
Perl_get_context.PERL524 ref: 6560BE8D
Perl_get_context.PERL524 ref: 6560BEAC
Perl_get_context.PERL524 ref: 6560BEBC
Perl_sv_2pv_flags.PERL524 ref: 6560BED9
Perl_get_context.PERL524 ref: 6560BEF7

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524 ref: 6560BF0C
Perl_get_context.PERL524 ref: 6560BF25
Perl_get_context.PERL524 ref: 6560BF3E
Perl_get_context.PERL524 ref: 6560BF5D
Perl_get_context.PERL524 ref: 6560BF6D
Perl_sv_pvn_force_flags.PERL524 ref: 6560BF8A
Perl_get_context.PERL524 ref: 6560BF90
Perl_get_context.PERL524 ref: 6560BFBF
Perl_get_context.PERL524 ref: 6560BFCF
Perl_sv_grow.PERL524 ref: 6560BFE4
Perl_get_context.PERL524 ref: 6560BFEE
Perl_get_context.PERL524 ref: 6560C003
Perl_get_context.PERL524 ref: 6560C015
DeviceIoControl.KERNEL32 ref: 6560C06C
Perl_get_context.PERL524 ref: 6560C08B
Perl_get_context.PERL524 ref: 6560C0A1
Perl_get_context.PERL524 ref: 6560C0C1
Perl_get_context.PERL524 ref: 6560C0CD
Perl_sv_setuv.PERL524 ref: 6560C0EA
Perl_get_context.PERL524 ref: 6560C0F0
Perl_get_context.PERL524 ref: 6560C102
Perl_sv_newmortal.PERL524 ref: 6560C107
Perl_get_context.PERL524 ref: 6560C12A
Perl_get_context.PERL524 ref: 6560C130
Perl_sv_setsv_flags.PERL524 ref: 6560C14B
Perl_get_context.PERL524 ref: 6560C151
Perl_get_context.PERL524 ref: 6560C159
Perl_get_context.PERL524 ref: 6560C160
Perl_get_context.PERL524 ref: 6560C173
Perl_get_context.PERL524 ref: 6560C18C
Perl_get_context.PERL524 ref: 6560C19F
Perl_av_len.PERL524 ref: 6560C1AC
Perl_get_context.PERL524 ref: 6560C1C8
Perl_get_context.PERL524 ref: 6560C5A0
Perl_get_context.PERL524 ref: 6560C5B2
Perl_get_context.PERL524 ref: 6560C620
Perl_get_context.PERL524 ref: 6560C63B
Perl_croak_nocontext.PERL524 ref: 6560C667
Perl_get_context.PERL524 ref: 6560C670
Perl_sv_setiv.PERL524 ref: 6560C686
Perl_get_context.PERL524 ref: 6560C6E4
Perl_get_context.PERL524 ref: 6560C6F7
Perl_get_context.PERL524 ref: 6560C70A

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flags$Perl_sv_2pv_flags$ControlDeviceErrorLastPerl_av_lenPerl_croak_nocontextPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setivPerl_sv_setsv_flagsPerl_sv_setuv
String ID:
API String ID: 2809682646-0
Opcode ID: b17aa635323e1bdb3d48e4423e7c648bd57a8feb3452d8f487ab984060a029bc
Instruction ID: fa0645a80d4c5251cd55ac2f670522468669b2936d7e3cbea76b0fefefddb3a9
Opcode Fuzzy Hash: b17aa635323e1bdb3d48e4423e7c648bd57a8feb3452d8f487ab984060a029bc
Instruction Fuzzy Hash: 940292746183418FD755DF69C588E19FBE1FF89324F4A889DE8898B362DB74E840CB06

Function 6560740C Relevance: 84.3, APIs: 56, Instructions: 337COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606D9C
Perl_get_context.PERL524 ref: 65606DB7
Perl_get_context.PERL524 ref: 65606DC3
Perl_sv_2pv_flags.PERL524 ref: 65606DE0
Perl_get_context.PERL524 ref: 65606DEA
Perl_get_context.PERL524 ref: 65606E03
Perl_get_context.PERL524 ref: 65606E1C
Perl_get_context.PERL524 ref: 65606E3B
Perl_get_context.PERL524 ref: 65606E4B
Perl_sv_pvn_force_flags.PERL524 ref: 65606E68
Perl_get_context.PERL524 ref: 65606E6E
Perl_get_context.PERL524 ref: 65606E9E
Perl_get_context.PERL524 ref: 65606EAE
Perl_sv_grow.PERL524 ref: 65606EC3
Perl_get_context.PERL524 ref: 65606ECD
Perl_get_context.PERL524 ref: 65606EE2
Perl_get_context.PERL524 ref: 65606EF4
Perl_get_context.PERL524(?), ref: 65606F19
Perl_get_context.PERL524 ref: 65606F2E
Perl_get_context.PERL524 ref: 65606F43
Perl_get_context.PERL524 ref: 65606F5E
Perl_get_context.PERL524 ref: 65606F6A
Perl_sv_pvn_force_flags.PERL524 ref: 65606F87
Perl_get_context.PERL524 ref: 65606F8D
Perl_get_context.PERL524 ref: 65606FB9
Perl_get_context.PERL524 ref: 65606FC5
Perl_sv_grow.PERL524 ref: 65606FDA
Perl_get_context.PERL524 ref: 65606FE4
Perl_get_context.PERL524 ref: 65606FF9
Perl_get_context.PERL524 ref: 6560700B
GetVolumeInformationW.KERNEL32(?), ref: 6560706B
Perl_get_context.PERL524(?), ref: 65607096
Perl_get_context.PERL524 ref: 656070B7
Perl_get_context.PERL524 ref: 656070C9
Perl_get_context.PERL524 ref: 656070ED
Perl_get_context.PERL524 ref: 656070F9
Perl_sv_setuv.PERL524 ref: 65607112
Perl_get_context.PERL524 ref: 65607118
Perl_get_context.PERL524 ref: 6560712E
Perl_get_context.PERL524 ref: 65607152
Perl_get_context.PERL524 ref: 6560715E
Perl_sv_setuv.PERL524 ref: 65607177
Perl_get_context.PERL524 ref: 6560717D
Perl_get_context.PERL524 ref: 65607193
Perl_get_context.PERL524 ref: 656071B7
Perl_get_context.PERL524 ref: 656071C3
Perl_sv_setuv.PERL524 ref: 656071DC
Perl_get_context.PERL524 ref: 656071E2
Perl_get_context.PERL524 ref: 656071F8
Perl_sv_newmortal.PERL524 ref: 656071FD
Perl_get_context.PERL524 ref: 6560721F
Perl_get_context.PERL524 ref: 65607223
Perl_sv_setsv_flags.PERL524 ref: 6560723E
Perl_get_context.PERL524 ref: 65607244
Perl_get_context.PERL524 ref: 6560724C
Perl_get_context.PERL524 ref: 65607250
Perl_get_context.PERL524 ref: 6560726C
Perl_av_len.PERL524 ref: 65607275
Perl_get_context.PERL524 ref: 65607410
Perl_get_context.PERL524 ref: 65607425
Perl_get_context.PERL524 ref: 65607434
Perl_av_len.PERL524 ref: 65607441
Perl_get_context.PERL524 ref: 65607837
Perl_get_context.PERL524 ref: 65607843
Perl_mg_set.PERL524 ref: 6560784C
Perl_get_context.PERL524 ref: 65607910
Perl_get_context.PERL524 ref: 65607923
Perl_get_context.PERL524 ref: 65607936
wcslen.MSVCRT ref: 6560794B

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$Perl_av_lenPerl_sv_growPerl_sv_pvn_force_flags$InformationPerl_mg_setPerl_sv_2pv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsVolumewcslen
String ID:
API String ID: 627656190-0
Opcode ID: d4a0fa8128c81f497d05dbfdb926d080d9ec216a706137c6553861ae590457d6
Instruction ID: cac58e7f09cb9c9b573eefd23838922f3303f5536c0acfa7ce1671690ebcf6b2
Opcode Fuzzy Hash: d4a0fa8128c81f497d05dbfdb926d080d9ec216a706137c6553861ae590457d6
Instruction Fuzzy Hash: 8EF171746183409FC754DF29C588E1AFBE1FF89324F49895EE8898B362DB74E844CB46

Function 6560898C Relevance: 84.3, APIs: 56, Instructions: 337stringCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560831C
Perl_get_context.PERL524 ref: 65608337
Perl_get_context.PERL524 ref: 65608343
Perl_sv_2pv_flags.PERL524 ref: 65608360
Perl_get_context.PERL524 ref: 6560836A
Perl_get_context.PERL524 ref: 65608383
Perl_get_context.PERL524 ref: 6560839C
Perl_get_context.PERL524 ref: 656083BB
Perl_get_context.PERL524 ref: 656083CB
Perl_sv_pvn_force_flags.PERL524 ref: 656083E8
Perl_get_context.PERL524 ref: 656083EE
Perl_get_context.PERL524 ref: 6560841D
Perl_get_context.PERL524 ref: 6560842D
Perl_sv_grow.PERL524 ref: 65608442
Perl_get_context.PERL524 ref: 6560844C
Perl_get_context.PERL524 ref: 65608461
Perl_get_context.PERL524 ref: 65608473
Perl_get_context.PERL524(?), ref: 65608496
Perl_get_context.PERL524 ref: 656084AB
Perl_get_context.PERL524 ref: 656084C0
Perl_get_context.PERL524 ref: 656084DB
Perl_get_context.PERL524 ref: 656084E7
Perl_sv_pvn_force_flags.PERL524 ref: 65608504
Perl_get_context.PERL524 ref: 6560850A
Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5
Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 656087EC
Perl_av_len.PERL524 ref: 656087F5
Perl_get_context.PERL524 ref: 65608990
Perl_get_context.PERL524 ref: 656089A5
Perl_get_context.PERL524 ref: 656089B4
Perl_av_len.PERL524 ref: 656089C1
Perl_get_context.PERL524 ref: 65608DB7
Perl_get_context.PERL524 ref: 65608DC3
Perl_mg_set.PERL524 ref: 65608DCC
Perl_get_context.PERL524 ref: 65608E90
Perl_get_context.PERL524 ref: 65608EA3
Perl_get_context.PERL524 ref: 65608EB6
strlen.MSVCRT ref: 65608ECB

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$Perl_av_lenPerl_sv_growPerl_sv_pvn_force_flags$InformationPerl_mg_setPerl_sv_2pv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsVolumestrlen
String ID:
API String ID: 3565431583-0
Opcode ID: f6858b9f5b8dc33595a3cd71bab4b99a37d0a9f2a91383e9618ce77718d06604
Instruction ID: dc1928d90b15efed329ef8b4e729bac0537d5a30f520d0f646c99ffee275f8c0
Opcode Fuzzy Hash: f6858b9f5b8dc33595a3cd71bab4b99a37d0a9f2a91383e9618ce77718d06604
Instruction Fuzzy Hash: 96F181746193409FC754DF29C588A1AFBE1FF89324F49895EF8898B362DB74E844CB06

Function 6560909C Relevance: 70.8, APIs: 47, Instructions: 278COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65608473
Perl_get_context.PERL524(?), ref: 65608496
Perl_get_context.PERL524 ref: 656084AB
Perl_get_context.PERL524 ref: 656084C0
Perl_get_context.PERL524 ref: 656084DB
Perl_get_context.PERL524 ref: 656084E7
Perl_sv_pvn_force_flags.PERL524 ref: 65608504
Perl_get_context.PERL524 ref: 6560850A
Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5
Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 656090A0
Perl_get_context.PERL524 ref: 656090BB
Perl_get_context.PERL524 ref: 656090C7
Perl_sv_2pv_flags.PERL524 ref: 656090E4
Perl_get_context.PERL524 ref: 656090F2
Perl_get_context.PERL524 ref: 6560910D
Perl_get_context.PERL524 ref: 65609115
Perl_sv_2pv_flags.PERL524 ref: 6560912E
Perl_get_context.PERL524 ref: 65609470
Perl_get_context.PERL524 ref: 656094E0

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$Perl_sv_2pv_flags$InformationPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsVolume
String ID:
API String ID: 1100992603-0
Opcode ID: 8ea5a4e2d3108c919abbc00e81eebdfe690175a6f8d80a55be6edbc90346660b
Instruction ID: 7f446972eeb1017b52ada085b60a8bfdfbbed24f2f31163639795d7bf85cbe45
Opcode Fuzzy Hash: 8ea5a4e2d3108c919abbc00e81eebdfe690175a6f8d80a55be6edbc90346660b
Instruction Fuzzy Hash: 50D1A5746183409FC754DF29C588A1AFBE1FF89364F49885EF9898B362DB74E844CB06

Function 65607B1C Relevance: 70.8, APIs: 47, Instructions: 277COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606EF4
Perl_get_context.PERL524(?), ref: 65606F19
Perl_get_context.PERL524 ref: 65606F2E
Perl_get_context.PERL524 ref: 65606F43
Perl_get_context.PERL524 ref: 65606F5E
Perl_get_context.PERL524 ref: 65606F6A
Perl_sv_pvn_force_flags.PERL524 ref: 65606F87
Perl_get_context.PERL524 ref: 65606F8D
Perl_get_context.PERL524 ref: 65606FB9
Perl_get_context.PERL524 ref: 65606FC5
Perl_sv_grow.PERL524 ref: 65606FDA
Perl_get_context.PERL524 ref: 65606FE4
Perl_get_context.PERL524 ref: 65606FF9
Perl_get_context.PERL524 ref: 6560700B
GetVolumeInformationW.KERNEL32(?), ref: 6560706B
Perl_get_context.PERL524(?), ref: 65607096
Perl_get_context.PERL524 ref: 656070B7
Perl_get_context.PERL524 ref: 656070C9
Perl_get_context.PERL524 ref: 656070ED
Perl_get_context.PERL524 ref: 656070F9
Perl_sv_setuv.PERL524 ref: 65607112
Perl_get_context.PERL524 ref: 65607118
Perl_get_context.PERL524 ref: 6560712E
Perl_get_context.PERL524 ref: 65607152
Perl_get_context.PERL524 ref: 6560715E
Perl_sv_setuv.PERL524 ref: 65607177
Perl_get_context.PERL524 ref: 6560717D
Perl_get_context.PERL524 ref: 65607193
Perl_get_context.PERL524 ref: 656071B7
Perl_get_context.PERL524 ref: 656071C3
Perl_sv_setuv.PERL524 ref: 656071DC
Perl_get_context.PERL524 ref: 656071E2
Perl_get_context.PERL524 ref: 656071F8
Perl_sv_newmortal.PERL524 ref: 656071FD
Perl_get_context.PERL524 ref: 6560721F
Perl_get_context.PERL524 ref: 65607223
Perl_sv_setsv_flags.PERL524 ref: 6560723E
Perl_get_context.PERL524 ref: 65607244
Perl_get_context.PERL524 ref: 6560724C
Perl_get_context.PERL524 ref: 65607250
Perl_get_context.PERL524 ref: 65607B20
Perl_get_context.PERL524 ref: 65607B3B
Perl_get_context.PERL524 ref: 65607B47
Perl_sv_2pv_flags.PERL524 ref: 65607B64
Perl_get_context.PERL524 ref: 65607B72
Perl_get_context.PERL524 ref: 65607B8D
Perl_get_context.PERL524 ref: 65607B95
Perl_sv_2pv_flags.PERL524 ref: 65607BAE
Perl_get_context.PERL524 ref: 65607EF0
Perl_get_context.PERL524 ref: 65607F60

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$Perl_sv_2pv_flags$InformationPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsVolume
String ID:
API String ID: 1100992603-0
Opcode ID: 4a1f3c029b4804c61f6f26981e1829f19dad3e91e6616c5c310f6b62afc6bd2c
Instruction ID: 7c6407742283da0e86c20869739fab2a663cab6a0f769c8eebcb43b955462404
Opcode Fuzzy Hash: 4a1f3c029b4804c61f6f26981e1829f19dad3e91e6616c5c310f6b62afc6bd2c
Instruction Fuzzy Hash: AAD193746183409FD754DF29C588A1AFBE1FF89324F49885EE8898B362DB74E840CB46

Function 65608F9C Relevance: 66.3, APIs: 44, Instructions: 276COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560841D
Perl_get_context.PERL524 ref: 6560842D
Perl_sv_grow.PERL524 ref: 65608442
Perl_get_context.PERL524 ref: 6560844C
Perl_get_context.PERL524 ref: 65608461
Perl_get_context.PERL524 ref: 65608473
Perl_get_context.PERL524(?), ref: 65608496
Perl_get_context.PERL524 ref: 656084AB
Perl_get_context.PERL524 ref: 656084C0
Perl_get_context.PERL524 ref: 656084DB
Perl_get_context.PERL524 ref: 656084E7
Perl_sv_pvn_force_flags.PERL524 ref: 65608504
Perl_get_context.PERL524 ref: 6560850A
Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5
Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 65608850
Perl_get_context.PERL524 ref: 65608869
Perl_get_context.PERL524 ref: 65608878
Perl_av_len.PERL524 ref: 65608881
Perl_get_context.PERL524 ref: 65608ED8
Perl_get_context.PERL524 ref: 65608EE4
Perl_mg_set.PERL524 ref: 65608EED
Perl_get_context.PERL524 ref: 65608FA0
Perl_get_context.PERL524 ref: 65608FCB
Perl_get_context.PERL524 ref: 65609240
Perl_get_context.PERL524 ref: 6560925B
Perl_get_context.PERL524 ref: 65609267
Perl_sv_2pv_flags.PERL524 ref: 65609284
Perl_get_context.PERL524 ref: 65609292
Perl_get_context.PERL524 ref: 656092AD
Perl_get_context.PERL524 ref: 656092B5
Perl_sv_2pv_flags.PERL524 ref: 656092CE

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$Perl_sv_2pv_flagsPerl_sv_grow$InformationPerl_av_lenPerl_mg_setPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsVolume
String ID:
API String ID: 4098193145-0
Opcode ID: 2f4c097118a1a6b07afd1b24c201248838d7231b9100fcd2cfd76a462380eb46
Instruction ID: c7c8809790da5794071795d411be59d7ec2580626f9baa7af8a84ff23582dc65
Opcode Fuzzy Hash: 2f4c097118a1a6b07afd1b24c201248838d7231b9100fcd2cfd76a462380eb46
Instruction Fuzzy Hash: 3FD191746193409FC354DF29C584A1AFBE1FF89314F4A889DF9898B362CB74E844CB06

Function 65604359 Relevance: 66.2, APIs: 44, Instructions: 239fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65603DE3
Perl_get_context.PERL524 ref: 65603DFE
Perl_get_context.PERL524 ref: 65603E06
Perl_sv_2pv_flags.PERL524 ref: 65603E1F
Perl_get_context.PERL524 ref: 65603E29
Perl_get_context.PERL524 ref: 65603E42
Perl_get_context.PERL524 ref: 65603E57
Perl_get_context.PERL524 ref: 65603E72
Perl_get_context.PERL524 ref: 65603E7E
Perl_sv_pvn_force_flags.PERL524 ref: 65603E9B
Perl_get_context.PERL524 ref: 65603EA1
Perl_get_context.PERL524 ref: 65603ECC
Perl_get_context.PERL524 ref: 65603ED8
Perl_sv_grow.PERL524 ref: 65603EED
Perl_get_context.PERL524 ref: 65603EF7
Perl_get_context.PERL524 ref: 65603F0C
Perl_get_context.PERL524 ref: 65603F1E
Perl_get_context.PERL524 ref: 65603F40
Perl_get_context.PERL524(?), ref: 65603F4D
Perl_get_context.PERL524 ref: 65603F5F
Perl_get_context.PERL524 ref: 65603F70
Perl_get_context.PERL524 ref: 65603F7E
Perl_get_context.PERL524 ref: 65603F95
Perl_get_context.PERL524 ref: 65603FA7
Perl_get_context.PERL524 ref: 65603FB9
Perl_get_context.PERL524 ref: 65603FCE
Perl_get_context.PERL524 ref: 65603FE9
Perl_get_context.PERL524 ref: 65603FF5
Perl_sv_2uv_flags.PERL524 ref: 6560400A
ReadFile.KERNEL32 ref: 6560403B
Perl_get_context.PERL524(?), ref: 6560405F
Perl_get_context.PERL524 ref: 65604071
Perl_get_context.PERL524 ref: 65604091
Perl_get_context.PERL524 ref: 65604099
Perl_sv_setuv.PERL524 ref: 656040B2
Perl_get_context.PERL524 ref: 656040B8
Perl_get_context.PERL524 ref: 656040CA
Perl_sv_newmortal.PERL524 ref: 656040CF
Perl_get_context.PERL524 ref: 656040F5
Perl_get_context.PERL524 ref: 656040F9
Perl_sv_setsv_flags.PERL524 ref: 65604114
Perl_get_context.PERL524 ref: 6560411A
Perl_get_context.PERL524 ref: 65604126
Perl_get_context.PERL524 ref: 6560412A
Perl_get_context.PERL524 ref: 65604210
Perl_av_len.PERL524 ref: 65604219
Perl_get_context.PERL524 ref: 65604360
Perl_get_context.PERL524 ref: 65604375
Perl_get_context.PERL524 ref: 65604384
Perl_av_len.PERL524 ref: 65604391

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_len$FilePerl_sv_2pv_flagsPerl_sv_2uv_flagsPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsPerl_sv_setuvRead
String ID:
API String ID: 2978864425-0
Opcode ID: 6dc255c74caaeadd979c9326594498052f385c81230552456b73f67fbd244cd1
Instruction ID: 09193193d566d3f34f2c041f0e9c4032b1c7efa63cf0c28d9641b29839a70576
Opcode Fuzzy Hash: 6dc255c74caaeadd979c9326594498052f385c81230552456b73f67fbd244cd1
Instruction Fuzzy Hash: 39B1B7746183408FD754DF69C588E19FBE1FF98324F4A889DE8898B362DB74E841CB06

Function 6560946C Relevance: 61.8, APIs: 41, Instructions: 254stringCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65608473
Perl_get_context.PERL524(?), ref: 65608496
Perl_get_context.PERL524 ref: 656084AB
Perl_get_context.PERL524 ref: 656084C0
Perl_get_context.PERL524 ref: 656084DB
Perl_get_context.PERL524 ref: 656084E7
Perl_sv_pvn_force_flags.PERL524 ref: 65608504
Perl_get_context.PERL524 ref: 6560850A
Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 656087EC
Perl_av_len.PERL524 ref: 656087F5
Perl_get_context.PERL524 ref: 65608DB7
Perl_get_context.PERL524 ref: 65608DC3
Perl_mg_set.PERL524 ref: 65608DCC
Perl_get_context.PERL524 ref: 65608E90
Perl_get_context.PERL524 ref: 65608EA3
Perl_get_context.PERL524 ref: 65608EB6
strlen.MSVCRT ref: 65608ECB
Perl_get_context.PERL524 ref: 656090F2
Perl_get_context.PERL524 ref: 6560910D
Perl_get_context.PERL524 ref: 65609115
Perl_sv_2pv_flags.PERL524 ref: 6560912E
Perl_get_context.PERL524 ref: 65609470

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$ErrorInformationLastPerl_av_lenPerl_mg_setPerl_sv_2pv_flagsPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsVolumestrlen
String ID:
API String ID: 2609583074-0
Opcode ID: ca315d76ff4a462aa3ee2c1b029d58e8d38b36965ab0d04c3a48fae0f4f819c4
Instruction ID: 7389b08fdff33164a1d34e770aab2ba273a8291a897283e76a49a421630f0ffe
Opcode Fuzzy Hash: ca315d76ff4a462aa3ee2c1b029d58e8d38b36965ab0d04c3a48fae0f4f819c4
Instruction Fuzzy Hash: 4DC192746193409FC354DF29C584A1AFBE1FF89714F46885EF9898B362DB74E844CB06

Function 65607EEC Relevance: 61.8, APIs: 41, Instructions: 254COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606EF4
Perl_get_context.PERL524(?), ref: 65606F19
Perl_get_context.PERL524 ref: 65606F2E
Perl_get_context.PERL524 ref: 65606F43
Perl_get_context.PERL524 ref: 65606F5E
Perl_get_context.PERL524 ref: 65606F6A
Perl_sv_pvn_force_flags.PERL524 ref: 65606F87
Perl_get_context.PERL524 ref: 65606F8D
Perl_get_context.PERL524 ref: 65606FB9
Perl_get_context.PERL524 ref: 65606FC5
Perl_sv_grow.PERL524 ref: 65606FDA
Perl_get_context.PERL524 ref: 65606FE4
Perl_get_context.PERL524 ref: 65606FF9
Perl_get_context.PERL524 ref: 6560700B
GetVolumeInformationW.KERNEL32(?), ref: 6560706B

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524(?), ref: 65607096
Perl_get_context.PERL524 ref: 656070B7
Perl_get_context.PERL524 ref: 656070C9
Perl_get_context.PERL524 ref: 656070ED
Perl_get_context.PERL524 ref: 656070F9
Perl_sv_setuv.PERL524 ref: 65607112
Perl_get_context.PERL524 ref: 65607118
Perl_get_context.PERL524 ref: 6560712E
Perl_get_context.PERL524 ref: 65607152
Perl_get_context.PERL524 ref: 6560715E
Perl_sv_setuv.PERL524 ref: 65607177
Perl_get_context.PERL524 ref: 6560717D
Perl_get_context.PERL524 ref: 65607193
Perl_get_context.PERL524 ref: 656071B7
Perl_get_context.PERL524 ref: 656071C3
Perl_sv_setuv.PERL524 ref: 656071DC
Perl_get_context.PERL524 ref: 656071E2
Perl_get_context.PERL524 ref: 656071F8
Perl_sv_newmortal.PERL524 ref: 656071FD
Perl_get_context.PERL524 ref: 6560721F
Perl_get_context.PERL524 ref: 65607223
Perl_sv_setsv_flags.PERL524 ref: 6560723E
Perl_get_context.PERL524 ref: 65607244
Perl_get_context.PERL524 ref: 6560724C
Perl_get_context.PERL524 ref: 65607250
Perl_get_context.PERL524 ref: 6560726C
Perl_av_len.PERL524 ref: 65607275
Perl_get_context.PERL524 ref: 65607837
Perl_get_context.PERL524 ref: 65607843
Perl_mg_set.PERL524 ref: 6560784C
Perl_get_context.PERL524 ref: 65607910
Perl_get_context.PERL524 ref: 65607923
Perl_get_context.PERL524 ref: 65607936
wcslen.MSVCRT ref: 6560794B
Perl_get_context.PERL524 ref: 65607B72
Perl_get_context.PERL524 ref: 65607B8D
Perl_get_context.PERL524 ref: 65607B95
Perl_sv_2pv_flags.PERL524 ref: 65607BAE
Perl_get_context.PERL524 ref: 65607EF0

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$ErrorInformationLastPerl_av_lenPerl_mg_setPerl_sv_2pv_flagsPerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsVolumewcslen
String ID:
API String ID: 1785101571-0
Opcode ID: d2c5eaad70255d870f579cc27334f95c5b8588825dc75cd77d8251ec5d7eba28
Instruction ID: f5e7cf5d15331a51abfe97aff2a0833c4c9fefbd351c7c1e86f2e5cba1f68bd3
Opcode Fuzzy Hash: d2c5eaad70255d870f579cc27334f95c5b8588825dc75cd77d8251ec5d7eba28
Instruction Fuzzy Hash: 91C180746183449FC754DF29C588A1AFBE1FF89324F49885EF8898B362DB74E844CB46

Function 656020EC Relevance: 61.7, APIs: 41, Instructions: 223fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65601BEA
Perl_get_context.PERL524 ref: 65601BFF
Perl_get_context.PERL524 ref: 65601C1A
Perl_get_context.PERL524 ref: 65601C22
Perl_sv_2uv_flags.PERL524 ref: 65601C33
Perl_get_context.PERL524 ref: 65601C3D
Perl_get_context.PERL524 ref: 65601C5A
Perl_get_context.PERL524 ref: 65601C75
Perl_get_context.PERL524 ref: 65601C7D
Perl_sv_2uv_flags.PERL524 ref: 65601C8E
Perl_get_context.PERL524 ref: 65601C98
Perl_get_context.PERL524 ref: 65601CAD
Perl_get_context.PERL524 ref: 65601CC8
Perl_get_context.PERL524 ref: 65601CD0
Perl_sv_2pv_flags.PERL524 ref: 65601CE9
Perl_get_context.PERL524 ref: 65601CF3
Perl_get_context.PERL524 ref: 65601D08
Perl_get_context.PERL524 ref: 65601D1D
Perl_get_context.PERL524 ref: 65601D38
Perl_get_context.PERL524 ref: 65601D44
Perl_sv_2uv_flags.PERL524 ref: 65601D59
Perl_get_context.PERL524 ref: 65601D63
Perl_get_context.PERL524 ref: 65601D7C
Perl_get_context.PERL524 ref: 65601D9B
Perl_get_context.PERL524 ref: 65601DAB
Perl_sv_2pv_flags.PERL524 ref: 65601DC8
Perl_get_context.PERL524 ref: 65601DE0
WriteFile.KERNEL32 ref: 65601E1E
Perl_get_context.PERL524 ref: 65601E35
Perl_get_context.PERL524 ref: 65601E43
Perl_get_context.PERL524 ref: 65601E66
Perl_get_context.PERL524 ref: 65601E72
Perl_sv_setuv.PERL524 ref: 65601E8F
Perl_get_context.PERL524 ref: 65601E95
Perl_get_context.PERL524 ref: 65601EA7
Perl_sv_newmortal.PERL524 ref: 65601EAC
Perl_get_context.PERL524 ref: 65601ED8
Perl_get_context.PERL524 ref: 65601EE0
Perl_sv_setsv_flags.PERL524 ref: 65601EFB
Perl_get_context.PERL524 ref: 65601F01
Perl_get_context.PERL524 ref: 65601F09
Perl_get_context.PERL524 ref: 65601F10
Perl_get_context.PERL524 ref: 656020F0
Perl_get_context.PERL524 ref: 65602105
Perl_get_context.PERL524 ref: 65602110
Perl_av_len.PERL524 ref: 65602119

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2uv_flags$Perl_sv_2pv_flags$FilePerl_av_lenPerl_sv_newmortalPerl_sv_setsv_flagsPerl_sv_setuvWrite
String ID:
API String ID: 757297665-0
Opcode ID: 1eef7bcda1b32145cec161df9729ef83401445ab840ea0d6559edb801f8fc403
Instruction ID: e52834a6ad3233dd9662c86482563bc2489fb2bf2fe5878f5482039bb560dd50
Opcode Fuzzy Hash: 1eef7bcda1b32145cec161df9729ef83401445ab840ea0d6559edb801f8fc403
Instruction Fuzzy Hash: 3AA1C5749183009FC754DF69C588A19FBE1FF88324F49899EE9998B362DB74E844CF06

Function 66E01B70 Relevance: 58.0, APIs: 21, Strings: 12, Instructions: 247COMMON

Download Yara Rule

APIs

Perl_xs_handshake.PERL524 ref: 66E01BA2
Perl_newXS_deffile.PERL524 ref: 66E01BC9
Perl_newXS_deffile.PERL524 ref: 66E01BE2
Perl_newXS_deffile.PERL524 ref: 66E01BFB
Perl_get_context.PERL524 ref: 66E01C02
Perl_get_hv.PERL524 ref: 66E01C1D
Perl_newSViv.PERL524 ref: 66E01C41

Part of subcall function 66E014C0: Perl_hv_common_key_len.PERL524 ref: 66E01508

Perl_newSVuv.PERL524 ref: 66E01C79
Perl_sv_setpvn.PERL524 ref: 66E01CFD
Perl_hv_common.PERL524 ref: 66E01D46
Perl_hv_common_key_len.PERL524 ref: 66E01D8B
Perl_newCONSTSUB.PERL524 ref: 66E01DD1
Perl_mro_method_changed_in.PERL524 ref: 66E01E17
Perl_newXS.PERL524 ref: 66E01E42
Perl_newXS.PERL524 ref: 66E01E6C
Perl_newXS.PERL524 ref: 66E01E96
Perl_newXS.PERL524 ref: 66E01EC0
Perl_newXS.PERL524 ref: 66E01EEA
Perl_croak.PERL524 ref: 66E01F44
Perl_croak.PERL524 ref: 66E01F5B

Strings

1.13, xrefs: 66E01B7B
Fcntl::S_ISCHR, xrefs: 66E01EB8
XAf, xrefs: 66E01F35
Fcntl.c, xrefs: 66E01B8B, 66E01E27, 66E01E54, 66E01E7B, 66E01EA8, 66E01ECF
Fcntl::AUTOLOAD, xrefs: 66E01BBA
Couldn't add key '%s' to %%Fcntl::, xrefs: 66E01F4C
Fcntl::S_ISDIR, xrefs: 66E01E64
Fcntl::S_ISFIFO, xrefs: 66E01EDF
@Cf, xrefs: 66E01BFD
Fcntl::S_ISBLK, xrefs: 66E01E8B
_S_IFMT, xrefs: 66E01C81
v5.24.0, xrefs: 66E01B83

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Perl_new$S_deffile$Perl_croakPerl_hv_common_key_len$Perl_get_contextPerl_get_hvPerl_hv_commonPerl_mro_method_changed_inPerl_sv_setpvnPerl_xs_handshake
String ID: 1.13$@Cf$Couldn't add key '%s' to %%Fcntl::$Fcntl.c$Fcntl::AUTOLOAD$Fcntl::S_ISBLK$Fcntl::S_ISCHR$Fcntl::S_ISDIR$Fcntl::S_ISFIFO$XAf$_S_IFMT$v5.24.0
API String ID: 799173693-2621639583
Opcode ID: ac959b0aee02722914aff80974819d646eb5b8e4855c774df32d737ed6096991
Instruction ID: ac5653a2d0fc7ec952f2498e5572bdd2cb16125181c18ebd9191456dfaa9d286
Opcode Fuzzy Hash: ac959b0aee02722914aff80974819d646eb5b8e4855c774df32d737ed6096991
Instruction Fuzzy Hash: 9EB1CDB4609701DFC700DF98C99561ABBF1BF9A744F20891EE5988B360D335E869CF82

Function 62581DC0 Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 322stringCOMMON

Download Yara Rule

APIs

Perl_sv_2pv_flags.PERL524 ref: 62581E68
_getcwd.MSVCRT ref: 62581E94
strlen.MSVCRT ref: 62581EA4
Perl_my_strlcpy.PERL524 ref: 62581EC3
Perl_sv_setpv_mg.PERL524 ref: 62582126
Perl_sv_magic.PERL524 ref: 62582176
Perl_croak_xs_usage.PERL524 ref: 62582227
Perl_getcwd_sv.PERL524 ref: 6258228D
Perl_sv_magic.PERL524 ref: 625822D2

Strings

/, xrefs: 625821B2
[PXb, xrefs: 62581E30
$PXb, xrefs: 6258232B
kPXb, xrefs: 62581FFD
/, xrefs: 62581FAE
t, xrefs: 625822BB
[PXb, xrefs: 62581FE7

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Perl_sv_magic$Perl_croak_xs_usagePerl_getcwd_svPerl_my_strlcpyPerl_sv_2pv_flagsPerl_sv_setpv_mg_getcwdstrlen
String ID: $PXb$/$/$[PXb$[PXb$kPXb$t
API String ID: 2734761060-266460195
Opcode ID: 5a8a9aa492f39a64903775e191865cacaa7d790fc2b1f9b6870bb5afca618430
Instruction ID: db736ec4329bfd2d438d56f616b02ff267eeb956ada0442cc31dee9403e396a1
Opcode Fuzzy Hash: 5a8a9aa492f39a64903775e191865cacaa7d790fc2b1f9b6870bb5afca618430
Instruction Fuzzy Hash: E3F10EB05083A0DFD720DF28C59876ABFE0EF85348F05892DE9998B351D3B9E945CB42

Function 00404689 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 179stringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT ref: 004046B5
Perl_get_context.PERL524 ref: 004046C0
strlen.MSVCRT ref: 004046CD
Perl_get_context.PERL524 ref: 004046D4
sprintf.MSVCRT ref: 0040470A
_strdup.MSVCRT ref: 0040474C
strlen.MSVCRT ref: 00404763
strlen.MSVCRT ref: 0040476D
Perl_get_context.PERL524 ref: 00404779
Perl_get_context.PERL524 ref: 00404787
sprintf.MSVCRT ref: 004047C1
_mkdir.MSVCRT ref: 004047D3
Perl_get_context.PERL524 ref: 004047D5
Perl_get_context.PERL524 ref: 004047DF
_strdup.MSVCRT ref: 00404809

Strings

PAR_TEMP, xrefs: 00404964
PAR_CLEAN, xrefs: 0040487E
PATH, xrefs: 004047F4
PAR_TMPDIR, xrefs: 0040471B

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context$_strdupstrlen$sprintf$_mkdir
String ID: PAR_CLEAN$PAR_TEMP$PAR_TMPDIR$PATH
API String ID: 1121633479-2346932033
Opcode ID: 5dfd74365551cbc19b1f7280f8e3d388cdd60a8e94bf781888ee4da47179cf68
Instruction ID: 9209e4b4e8050d70f70201896b1c0cc5f57c026a7e0123441504650ccb6f5856
Opcode Fuzzy Hash: 5dfd74365551cbc19b1f7280f8e3d388cdd60a8e94bf781888ee4da47179cf68
Instruction Fuzzy Hash: 5B7118B450A7059FC750AF79C58465ABBE4AF84304F06887EE9C4E7392EB78D841CF4A

Function 0040509C Relevance: 47.4, APIs: 23, Strings: 4, Instructions: 169stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00404763
strlen.MSVCRT ref: 0040476D
Perl_get_context.PERL524 ref: 00404779
Perl_get_context.PERL524 ref: 00404787
sprintf.MSVCRT ref: 004047C1
_mkdir.MSVCRT ref: 004047D3
Perl_get_context.PERL524 ref: 004047D5
Perl_get_context.PERL524 ref: 004047DF
_strdup.MSVCRT ref: 00404809
strlen.MSVCRT ref: 00404830
Perl_get_context.PERL524 ref: 00404849
Perl_get_context.PERL524 ref: 00404854
Perl_get_context.PERL524 ref: 00404888
Perl_get_context.PERL524 ref: 00404893
sprintf.MSVCRT ref: 004048CD
_mkdir.MSVCRT ref: 00404937
Perl_get_context.PERL524 ref: 00404940
Perl_get_context.PERL524 ref: 0040494B
Perl_get_context.PERL524 ref: 004050B5
strlen.MSVCRT ref: 004050C6
Perl_get_context.PERL524 ref: 004050CD
sprintf.MSVCRT ref: 004050F4

Part of subcall function 004038D0: Perl_get_context.PERL524 ref: 004038EB
Part of subcall function 004038D0: Perl_get_context.PERL524 ref: 004038F6
Part of subcall function 004038D0: Perl_get_context.PERL524 ref: 004038FA

_strdup.MSVCRT ref: 00405151
Perl_get_context.PERL524 ref: 00405250
Perl_get_context.PERL524 ref: 0040525B

Strings

WinDir, xrefs: 004050A0
PAR_TEMP, xrefs: 00404964
PAR_CLEAN, xrefs: 0040487E
PATH, xrefs: 004047F4

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context$strlen$sprintf$_mkdir_strdup
String ID: PAR_CLEAN$PAR_TEMP$PATH$WinDir
API String ID: 3210421595-4254955667
Opcode ID: 5a1a8f54d2abdc88ea7c279a601635024293861bfedabfcd6be791262c5d660f
Instruction ID: 212218d8b5b7ff735e2a18612fd10a440c406cbe69f479bcd4510557d6b633bf
Opcode Fuzzy Hash: 5a1a8f54d2abdc88ea7c279a601635024293861bfedabfcd6be791262c5d660f
Instruction Fuzzy Hash: 2161F9B4A0A7059FD340EF79C58451ABBE4AF88304F46887EF585E7392DB78D8418F4A

Function 65608F59 Relevance: 46.7, APIs: 31, Instructions: 199COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65608535
Perl_get_context.PERL524 ref: 65608541
Perl_sv_grow.PERL524 ref: 65608556
Perl_get_context.PERL524 ref: 65608560
Perl_get_context.PERL524 ref: 65608575
Perl_get_context.PERL524 ref: 65608587
GetVolumeInformationA.KERNEL32(?), ref: 656085E5
Perl_get_context.PERL524(?), ref: 65608610
Perl_get_context.PERL524 ref: 65608631
Perl_get_context.PERL524 ref: 65608643
Perl_get_context.PERL524 ref: 65608667
Perl_get_context.PERL524 ref: 65608673
Perl_sv_setuv.PERL524 ref: 6560868C
Perl_get_context.PERL524 ref: 65608692
Perl_get_context.PERL524 ref: 656086A8
Perl_get_context.PERL524 ref: 656086CC
Perl_get_context.PERL524 ref: 656086D8
Perl_sv_setuv.PERL524 ref: 656086F1
Perl_get_context.PERL524 ref: 656086F7
Perl_get_context.PERL524 ref: 6560870D
Perl_get_context.PERL524 ref: 65608731
Perl_get_context.PERL524 ref: 6560873D
Perl_sv_setuv.PERL524 ref: 65608756
Perl_get_context.PERL524 ref: 6560875C
Perl_get_context.PERL524 ref: 65608772
Perl_sv_newmortal.PERL524 ref: 65608777
Perl_get_context.PERL524 ref: 65608799
Perl_get_context.PERL524 ref: 656087A0
Perl_sv_setsv_flags.PERL524 ref: 656087BB
Perl_get_context.PERL524 ref: 656087C1
Perl_get_context.PERL524 ref: 656087C9
Perl_get_context.PERL524 ref: 656087D0
Perl_get_context.PERL524 ref: 65608850
Perl_get_context.PERL524 ref: 65608869
Perl_get_context.PERL524 ref: 65608878
Perl_av_len.PERL524 ref: 65608881
Perl_get_context.PERL524 ref: 65608ED8
Perl_get_context.PERL524 ref: 65608EE4
Perl_mg_set.PERL524 ref: 65608EED
Perl_get_context.PERL524 ref: 65608F60
Perl_get_context.PERL524 ref: 65608F87

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setuv$InformationPerl_av_lenPerl_mg_setPerl_sv_growPerl_sv_newmortalPerl_sv_setsv_flagsVolume
String ID:
API String ID: 2931431549-0
Opcode ID: fdb7165951e4b22c476a0d24e5cc1e936dd48f3cd929954231c5077f576470e3
Instruction ID: 2d47ced42bc0b8e5f0595c5b5b5ca710ca57465842862b6fa029b43af35339b4
Opcode Fuzzy Hash: fdb7165951e4b22c476a0d24e5cc1e936dd48f3cd929954231c5077f576470e3
Instruction Fuzzy Hash: F691A0746183409FC354DF29C584A1AFBE1FF89364F46889EF9898B362DB74E844CB46

Function 65601FD9 Relevance: 46.7, APIs: 31, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65601CAD
Perl_get_context.PERL524 ref: 65601CC8
Perl_get_context.PERL524 ref: 65601CD0
Perl_sv_2pv_flags.PERL524 ref: 65601CE9
Perl_get_context.PERL524 ref: 65601CF3
Perl_get_context.PERL524 ref: 65601D08
Perl_get_context.PERL524 ref: 65601D1D
Perl_get_context.PERL524 ref: 65601D38
Perl_get_context.PERL524 ref: 65601D44
Perl_sv_2uv_flags.PERL524 ref: 65601D59
Perl_get_context.PERL524 ref: 65601D63
Perl_get_context.PERL524 ref: 65601D7C
Perl_get_context.PERL524 ref: 65601D9B
Perl_get_context.PERL524 ref: 65601DAB
Perl_sv_2pv_flags.PERL524 ref: 65601DC8
Perl_get_context.PERL524 ref: 65601DE0
WriteFile.KERNEL32 ref: 65601E1E
Perl_get_context.PERL524 ref: 65601E35
Perl_get_context.PERL524 ref: 65601E43
Perl_get_context.PERL524 ref: 65601E66
Perl_get_context.PERL524 ref: 65601E72
Perl_sv_setuv.PERL524 ref: 65601E8F
Perl_get_context.PERL524 ref: 65601E95
Perl_get_context.PERL524 ref: 65601EA7
Perl_sv_newmortal.PERL524 ref: 65601EAC
Perl_get_context.PERL524 ref: 65601ED8
Perl_get_context.PERL524 ref: 65601EE0
Perl_sv_setsv_flags.PERL524 ref: 65601EFB
Perl_get_context.PERL524 ref: 65601F01
Perl_get_context.PERL524 ref: 65601F09
Perl_get_context.PERL524 ref: 65601F10
Perl_get_context.PERL524 ref: 65601FE0
Perl_get_context.PERL524 ref: 65601FF5
Perl_get_context.PERL524 ref: 65602000
Perl_av_len.PERL524 ref: 65602009

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2pv_flags$FilePerl_av_lenPerl_sv_2uv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsPerl_sv_setuvWrite
String ID:
API String ID: 192458190-0
Opcode ID: 3d45c2739fa69dad676a352d07412e0dead8ae5a6a1f05ab2cd9dee123de42cb
Instruction ID: 7f18078f932c4a8c41c2e2c1cc19eeb8f640cbbc4662f9f483ff8a3a7a720e84
Opcode Fuzzy Hash: 3d45c2739fa69dad676a352d07412e0dead8ae5a6a1f05ab2cd9dee123de42cb
Instruction Fuzzy Hash: 8A81D574A183408FC754DF69C588A1AFBE1FF88324F45899DE8998B362DB74E841CF06

Function 65602EC9 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65602CDE
Perl_sv_newmortal.PERL524 ref: 65602CE3
Perl_get_context.PERL524 ref: 65602CEB
Perl_sv_grow.PERL524 ref: 65602CFC
Perl_get_context.PERL524 ref: 65602D04
Perl_get_context.PERL524 ref: 65602D1F
Perl_get_context.PERL524 ref: 65602D2B
Perl_sv_2iv_flags.PERL524 ref: 65602D40
Perl_get_context.PERL524 ref: 65602D49
Perl_get_context.PERL524 ref: 65602D5E
Perl_get_context.PERL524 ref: 65602D79
Perl_get_context.PERL524 ref: 65602D81
Perl_sv_2uv_flags.PERL524 ref: 65602D92
SetFilePointer.KERNEL32 ref: 65602DAF
Perl_get_context.PERL524 ref: 65602DCB
Perl_get_context.PERL524 ref: 65602DD8
Perl_newSVpv.PERL524 ref: 65602DED
Perl_get_context.PERL524 ref: 65602DF5
Perl_sv_2mortal.PERL524 ref: 65602DFE
Perl_get_context.PERL524 ref: 65602E0A
Perl_get_context.PERL524 ref: 65602E18
Perl_get_context.PERL524 ref: 65602E2D
Perl_get_context.PERL524 ref: 65602E42
Perl_get_context.PERL524 ref: 65602E50
Perl_get_context.PERL524 ref: 65602E58
Perl_mg_set.PERL524 ref: 65602E61
Perl_get_context.PERL524 ref: 65602E67
Perl_get_context.PERL524 ref: 65602E6B
Perl_get_context.PERL524 ref: 65602ED0
Perl_get_context.PERL524 ref: 65602EE5
Perl_get_context.PERL524 ref: 65602EF0
Perl_av_len.PERL524 ref: 65602EFB

Strings

0 but true, xrefs: 65602DE2

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$FilePerl_av_lenPerl_mg_setPerl_newPerl_sv_2iv_flagsPerl_sv_2mortalPerl_sv_2uv_flagsPerl_sv_growPerl_sv_newmortalPointer
String ID: 0 but true
API String ID: 1855749473-2833040357
Opcode ID: 48b8ce32902d99e6174e149ed1d0946648831dc44150bf407a8bb2495d9f86fc
Instruction ID: 59bbb2fa0bb1bbf8f2a1f718d0d3da7b96ac46e868f2cae684ae4397422761c0
Opcode Fuzzy Hash: 48b8ce32902d99e6174e149ed1d0946648831dc44150bf407a8bb2495d9f86fc
Instruction Fuzzy Hash: 1C41B6755183018FD710DF69C988A19FBE1FF48324F5A899EE899CB362DB74E841CB06

Function 656058DC Relevance: 42.1, APIs: 28, Instructions: 149COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 656054FA
Perl_get_context.PERL524 ref: 65605515
Perl_get_context.PERL524 ref: 65605521
Perl_sv_pvn_force_flags.PERL524 ref: 6560553E
Perl_get_context.PERL524 ref: 65605544
Perl_get_context.PERL524 ref: 6560556F
Perl_get_context.PERL524 ref: 6560557B
Perl_sv_grow.PERL524 ref: 65605590
Perl_get_context.PERL524 ref: 6560559A
Perl_get_context.PERL524 ref: 656055AF
Perl_get_context.PERL524 ref: 656055C1
QueryDosDeviceA.KERNEL32 ref: 656055EC
Perl_get_context.PERL524 ref: 6560560B
Perl_get_context.PERL524 ref: 6560561A
Perl_get_context.PERL524 ref: 65605629
Perl_get_context.PERL524 ref: 65605636
Perl_get_context.PERL524 ref: 65605648
Perl_sv_newmortal.PERL524 ref: 6560564D
Perl_get_context.PERL524 ref: 65605664
Perl_sv_setuv.PERL524 ref: 65605679
Perl_get_context.PERL524 ref: 6560567F
Perl_get_context.PERL524 ref: 65605687
Perl_get_context.PERL524 ref: 6560568B
Perl_get_context.PERL524 ref: 656058E0
Perl_get_context.PERL524 ref: 656058F2
Perl_get_context.PERL524 ref: 6560590D
Perl_get_context.PERL524 ref: 65605919
Perl_sv_setpvn.PERL524 ref: 65605936

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$DevicePerl_sv_growPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setpvnPerl_sv_setuvQuery
String ID:
API String ID: 1761189121-0
Opcode ID: c2eb4686a58c00f66c3bac6f122228daad89a822d14165aafe880ebcff033760
Instruction ID: 8043769cfe80c623c08fb8ba0734bffe399180305d2e7163fd3ba43d5c7721c8
Opcode Fuzzy Hash: c2eb4686a58c00f66c3bac6f122228daad89a822d14165aafe880ebcff033760
Instruction Fuzzy Hash: C9616174A183058FC754DF69C589A19FBE0FF98324F498999E889CB362DB38D844CF46

Function 00403A80 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 118stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00403AA5
Perl_get_context.PERL524 ref: 00403AB2
Perl_get_context.PERL524 ref: 00403AC2
sprintf.MSVCRT ref: 00403AE8
_findfirst.MSVCRT ref: 00403AF8
_findnext.MSVCRT ref: 00403B26
strchr.MSVCRT ref: 00403B3F
strcpy.MSVCRT ref: 00403B53
strstr.MSVCRT ref: 00403B63
GetModuleHandleA.KERNEL32 ref: 00403B9F
_unlink.MSVCRT ref: 00403BAD
FreeLibrary.KERNEL32 ref: 00403BCB
_unlink.MSVCRT ref: 00403BD7
sprintf.MSVCRT ref: 00403BFD
_findclose.MSVCRT ref: 00403C0E
_rmdir.MSVCRT ref: 00403C1B

Strings

\.., xrefs: 00403B7C
\, xrefs: 00403B34
%s\*.*, xrefs: 00403AD3
%s\%s, xrefs: 00403BEE

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context_unlinksprintf$FreeHandleLibraryModule_findclose_findfirst_findnext_rmdirstrchrstrcpystrlenstrstr
String ID: %s\%s$%s\*.*$\$\..
API String ID: 422397729-4027892170
Opcode ID: b698e9ffe2a6aa1200622b75a55755f97f637aa8de0ca598ede6e25979f2d728
Instruction ID: d46ef46383d6a00f1c30db428f22f280d3d6edbe704a6b937ca26825c0d53b61
Opcode Fuzzy Hash: b698e9ffe2a6aa1200622b75a55755f97f637aa8de0ca598ede6e25979f2d728
Instruction Fuzzy Hash: 9F414FB15097008FD710AF35C58822ABFE4EF80355F05883EE8C9A7392DB39D948CB5A

Function 6560CA4C Relevance: 34.6, APIs: 23, Instructions: 135COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560BEF7
Perl_get_context.PERL524 ref: 6560BF0C
Perl_get_context.PERL524 ref: 6560BF25
Perl_get_context.PERL524 ref: 6560BF3E
Perl_get_context.PERL524 ref: 6560BF5D
Perl_get_context.PERL524 ref: 6560BF6D
Perl_sv_pvn_force_flags.PERL524 ref: 6560BF8A
Perl_get_context.PERL524 ref: 6560BF90
Perl_get_context.PERL524 ref: 6560BFBF
Perl_get_context.PERL524 ref: 6560BFCF
Perl_get_context.PERL524 ref: 6560C015
DeviceIoControl.KERNEL32 ref: 6560C06C
Perl_get_context.PERL524 ref: 6560C08B
Perl_get_context.PERL524 ref: 6560C0A1
Perl_get_context.PERL524 ref: 6560C0C1
Perl_get_context.PERL524 ref: 6560C0CD
Perl_sv_setuv.PERL524 ref: 6560C0EA
Perl_get_context.PERL524 ref: 6560C0F0
Perl_get_context.PERL524 ref: 6560C102
Perl_sv_newmortal.PERL524 ref: 6560C107
Perl_get_context.PERL524 ref: 6560C12A
Perl_get_context.PERL524 ref: 6560C130
Perl_sv_setsv_flags.PERL524 ref: 6560C14B
Perl_get_context.PERL524 ref: 6560C151
Perl_get_context.PERL524 ref: 6560C159
Perl_get_context.PERL524 ref: 6560C160
Perl_get_context.PERL524 ref: 6560C173
Perl_get_context.PERL524 ref: 6560C18C
Perl_get_context.PERL524 ref: 6560C19F
Perl_av_len.PERL524 ref: 6560C1AC
Perl_get_context.PERL524 ref: 6560CA50
Perl_get_context.PERL524 ref: 6560CA6B
Perl_get_context.PERL524 ref: 6560CA77
Perl_sv_2pv_flags.PERL524 ref: 6560CA94
Perl_get_context.PERL524 ref: 6560CAA2
Perl_get_context.PERL524 ref: 6560CABD
Perl_get_context.PERL524 ref: 6560CAC5
Perl_sv_2pv_flags.PERL524 ref: 6560CADE
Perl_get_context.PERL524 ref: 6560CB36
Perl_get_context.PERL524 ref: 6560CBA0

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2pv_flags$ControlDevicePerl_av_lenPerl_sv_newmortalPerl_sv_pvn_force_flagsPerl_sv_setsv_flagsPerl_sv_setuv
String ID:
API String ID: 1055767257-0
Opcode ID: e32943bd34b58c40b1a0d309359a8df33629d28790d538e6cbf81d9e8a0a73d4
Instruction ID: 16d53517afa1dea5e85ae16259a68ed5c27cd974da3dbc14f7bc900190d51878
Opcode Fuzzy Hash: e32943bd34b58c40b1a0d309359a8df33629d28790d538e6cbf81d9e8a0a73d4
Instruction Fuzzy Hash: 0951AE75A183008FD754DF29C588A1AFBE1FF88364F45886EE9898B361DB34E840CF56

Function 00403F90 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 132stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00403FC4
strchr.MSVCRT ref: 00403FDC
Perl_get_context.PERL524 ref: 00403FFE
Perl_get_context.PERL524 ref: 00404008
_strdup.MSVCRT ref: 00404038
strlen.MSVCRT ref: 0040404F
strtok.MSVCRT ref: 00404068
strcmp.MSVCRT ref: 0040409E
strlen.MSVCRT ref: 004040AE
sprintf.MSVCRT ref: 004040FC
Perl_get_context.PERL524 ref: 00404101
Perl_get_context.PERL524 ref: 0040410C
Perl_get_context.PERL524 ref: 00404112
Perl_get_context.PERL524 ref: 00404135
strtok.MSVCRT ref: 0040415D

Strings

PAR_TEMP, xrefs: 00403F91
\, xrefs: 00403FD1
PAR_PROGNAME, xrefs: 00403FE7, 0040402B, 00404179

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context$strlenstrtok$FileModuleName_strdupsprintfstrchrstrcmp
String ID: PAR_PROGNAME$PAR_TEMP$\
API String ID: 1938923920-1651481293
Opcode ID: 84ff40a4d4319d1611bf00662f3fdcdb1f891fe83b928632f36b74659a9dae15
Instruction ID: f39e0a94d16a4cf75b0700cc2db139925aca5ecd89ba05f6bbe9928c445b064b
Opcode Fuzzy Hash: 84ff40a4d4319d1611bf00662f3fdcdb1f891fe83b928632f36b74659a9dae15
Instruction Fuzzy Hash: 455160B15097118FD310AF29C94461FBBE4AF84358F06887EE9C8E7391DB7DD8458B8A

Function 6560B03C Relevance: 28.6, APIs: 19, Instructions: 104COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560AE5D
Perl_get_context.PERL524 ref: 6560AE78
Perl_get_context.PERL524 ref: 6560AE84
Perl_sv_2uv_flags.PERL524 ref: 6560AE99
GetHandleInformation.KERNEL32 ref: 6560AEAD
Perl_get_context.PERL524 ref: 6560AEC7
Perl_get_context.PERL524 ref: 6560AEE6
Perl_get_context.PERL524 ref: 6560AEEE
Perl_sv_setuv.PERL524 ref: 6560AF07
Perl_get_context.PERL524 ref: 6560AF0D
Perl_get_context.PERL524 ref: 6560AF1F
Perl_get_context.PERL524 ref: 6560AF45
Perl_get_context.PERL524 ref: 6560AF49
Perl_sv_setsv_flags.PERL524 ref: 6560AF64
Perl_get_context.PERL524 ref: 6560AF6A
Perl_get_context.PERL524 ref: 6560AF72
Perl_get_context.PERL524 ref: 6560AF76
Perl_get_context.PERL524 ref: 6560B040
Perl_get_context.PERL524 ref: 6560B052

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$HandleInformationPerl_sv_2uv_flagsPerl_sv_setsv_flagsPerl_sv_setuv
String ID:
API String ID: 1034751503-0
Opcode ID: 6be3fd17ea32fb97301ba582a88d2c56cc22da73712635c0052abf306481d7f9
Instruction ID: f1de957cd34c84625bf4794f7dc7baf17caa43f0c1fefb1790cc76f79c98592d
Opcode Fuzzy Hash: 6be3fd17ea32fb97301ba582a88d2c56cc22da73712635c0052abf306481d7f9
Instruction Fuzzy Hash: 9141A2756183048FD714DF69C588A19FBE1FF88364F45C95EE8898B322DB34E845CB46

Function 66E02150 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 185fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 66E0217B
vfprintf.MSVCRT ref: 66E02197
abort.MSVCRT ref: 66E0219C
VirtualQuery.KERNEL32 ref: 66E02251
VirtualQuery.KERNEL32 ref: 66E02289
memcpy.MSVCRT ref: 66E022AE

Strings

Address %p has no image-section, xrefs: 66E023BD
VirtualProtect failed with code 0x%x, xrefs: 66E02382
VirtualQuery failed for %d bytes at address %p, xrefs: 66E023A9, 66E023D5
Mingw-w64 runtime failure:, xrefs: 66E0216D
@, xrefs: 66E02354

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 3828011698-4164700141
Opcode ID: c283ce5802b29b119be5690005cbb2b7522d2e4826c91bf5ed50c52f8ba0ac81
Instruction ID: c39fdcadc268bfdbb8b97d66af2e3b9e80c67d8df6e8a67ba648a30560050367
Opcode Fuzzy Hash: c283ce5802b29b119be5690005cbb2b7522d2e4826c91bf5ed50c52f8ba0ac81
Instruction Fuzzy Hash: B771F8B5909311DFD700DF69C58460EFBE5FB99348F60892EE98897300E735E868CB92

Function 62582D50 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 185fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 62582D7B
vfprintf.MSVCRT ref: 62582D97
abort.MSVCRT ref: 62582D9C
VirtualQuery.KERNEL32 ref: 62582E51
VirtualQuery.KERNEL32 ref: 62582E89
memcpy.MSVCRT ref: 62582EAE

Strings

VirtualProtect failed with code 0x%x, xrefs: 62582F82
@, xrefs: 62582F54
Address %p has no image-section, xrefs: 62582FBD
Mingw-w64 runtime failure:, xrefs: 62582D6D
VirtualQuery failed for %d bytes at address %p, xrefs: 62582FA9, 62582FD5

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 3828011698-4164700141
Opcode ID: 60eaa7038fc00b4c5025295906cdcdabfd17089b026650e943d5d4565e08836c
Instruction ID: 0ef2e2b6378f5b65ce5c2d8f448ed99cc57588b9bf5344257018b47104171f07
Opcode Fuzzy Hash: 60eaa7038fc00b4c5025295906cdcdabfd17089b026650e943d5d4565e08836c
Instruction Fuzzy Hash: 987106B1909361DFD720EF29C59461ABFE0EF89344F418D1EE889C7610E3B8E844CB86

Function 65606709 Relevance: 27.1, APIs: 18, Instructions: 87fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606568
Perl_get_context.PERL524 ref: 65606583
Perl_get_context.PERL524 ref: 6560658B
Perl_sv_2pv_flags.PERL524 ref: 656065A4
Perl_get_context.PERL524 ref: 656065AC
Perl_get_context.PERL524 ref: 656065C1
Perl_get_context.PERL524 ref: 656065DC
Perl_get_context.PERL524 ref: 656065E4
Perl_sv_2pv_flags.PERL524 ref: 656065FD
MoveFileW.KERNEL32 ref: 6560660A
Perl_get_context.PERL524 ref: 65606621
Perl_sv_newmortal.PERL524 ref: 65606626
Perl_get_context.PERL524 ref: 65606645
Perl_get_context.PERL524 ref: 65606650
Perl_sv_setsv_flags.PERL524 ref: 6560666B
Perl_get_context.PERL524 ref: 65606671
Perl_get_context.PERL524 ref: 65606679
Perl_get_context.PERL524 ref: 65606680
Perl_get_context.PERL524 ref: 656066A0
Perl_av_len.PERL524 ref: 656066AD
Perl_get_context.PERL524 ref: 656066C0
Perl_get_context.PERL524 ref: 656066D5
Perl_get_context.PERL524 ref: 656066E4
Perl_av_len.PERL524 ref: 656066F1
Perl_get_context.PERL524 ref: 65606710
Perl_get_context.PERL524 ref: 65606725
Perl_get_context.PERL524 ref: 65606732
Perl_av_len.PERL524 ref: 6560673B

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_len$Perl_sv_2pv_flags$FileMovePerl_sv_newmortalPerl_sv_setsv_flags
String ID:
API String ID: 3399648039-0
Opcode ID: 8fe0e3874c15d7cb0673b6e15b02fc4d211bc2461335e4fef111d6b8610788e6
Instruction ID: 4cbba13fba4c53abd4879ce3ac8d5278803806e81e22559ada514dd5901857cb
Opcode Fuzzy Hash: 8fe0e3874c15d7cb0673b6e15b02fc4d211bc2461335e4fef111d6b8610788e6
Instruction Fuzzy Hash: 913108755183048FC710EF69C988A59FBE1FF44324F4A886AE889CB361DB74E885CF46

Function 656069A9 Relevance: 27.1, APIs: 18, Instructions: 87fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65606808
Perl_get_context.PERL524 ref: 65606823
Perl_get_context.PERL524 ref: 6560682B
Perl_sv_2pv_flags.PERL524 ref: 65606844
Perl_get_context.PERL524 ref: 6560684C
Perl_get_context.PERL524 ref: 65606861
Perl_get_context.PERL524 ref: 6560687C
Perl_get_context.PERL524 ref: 65606884
Perl_sv_2pv_flags.PERL524 ref: 6560689D
MoveFileA.KERNEL32 ref: 656068AA
Perl_get_context.PERL524 ref: 656068C1
Perl_sv_newmortal.PERL524 ref: 656068C6
Perl_get_context.PERL524 ref: 656068E5
Perl_get_context.PERL524 ref: 656068F0
Perl_sv_setsv_flags.PERL524 ref: 6560690B
Perl_get_context.PERL524 ref: 65606911
Perl_get_context.PERL524 ref: 65606919
Perl_get_context.PERL524 ref: 65606920
Perl_get_context.PERL524 ref: 65606940
Perl_av_len.PERL524 ref: 6560694D
Perl_get_context.PERL524 ref: 65606960
Perl_get_context.PERL524 ref: 65606975
Perl_get_context.PERL524 ref: 65606984
Perl_av_len.PERL524 ref: 65606991
Perl_get_context.PERL524 ref: 656069B0
Perl_get_context.PERL524 ref: 656069C5
Perl_get_context.PERL524 ref: 656069D2
Perl_av_len.PERL524 ref: 656069DB

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_len$Perl_sv_2pv_flags$FileMovePerl_sv_newmortalPerl_sv_setsv_flags
String ID:
API String ID: 3399648039-0
Opcode ID: 6cc4ab36629b01c2d277b47d455a8ea5f9e398267fd9dc56be1ad84a471c60a2
Instruction ID: 67a7c76b8e8431b3367fe08b3d37ecb437bf8343bc01dccfb705aff9b700b689
Opcode Fuzzy Hash: 6cc4ab36629b01c2d277b47d455a8ea5f9e398267fd9dc56be1ad84a471c60a2
Instruction Fuzzy Hash: 82312B715183058FC750AF69C988B49F7E1FF44324F4A886AE989CB361DB74E884CB46

Function 6560E029 Relevance: 25.6, APIs: 17, Instructions: 87fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560DEB7
Perl_get_context.PERL524 ref: 6560DED6
Perl_get_context.PERL524 ref: 6560DEE2
Perl_sv_2uv_flags.PERL524 ref: 6560DEF3
Perl_get_context.PERL524 ref: 6560DEFB
Perl_get_context.PERL524 ref: 6560DF10
Perl_get_context.PERL524 ref: 6560DF2B
Perl_get_context.PERL524 ref: 6560DF33
Perl_sv_2uv_flags.PERL524 ref: 6560DF44
CreateFileA.KERNEL32 ref: 6560DF79
Perl_get_context.PERL524 ref: 6560DF95
Perl_get_context.PERL524 ref: 6560DFA0
Perl_newSVuv.PERL524 ref: 6560DFB3
Perl_get_context.PERL524 ref: 6560DFBB
Perl_sv_2mortal.PERL524 ref: 6560DFC4
Perl_get_context.PERL524 ref: 6560DFCD
Perl_get_context.PERL524 ref: 6560DFD1
Perl_get_context.PERL524 ref: 6560DFE0
Perl_get_context.PERL524 ref: 6560DFF5
Perl_get_context.PERL524 ref: 6560E004
Perl_av_len.PERL524 ref: 6560E011
Perl_get_context.PERL524 ref: 6560E030
Perl_get_context.PERL524 ref: 6560E049
Perl_get_context.PERL524 ref: 6560E058
Perl_av_len.PERL524 ref: 6560E063

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_lenPerl_sv_2uv_flags$CreateFilePerl_newPerl_sv_2mortal
String ID:
API String ID: 1185150769-0
Opcode ID: 64a3efbe46c4b871bd7612294a5cc8f4bd3c8d0982a9901b9ed430223ff476de
Instruction ID: 46c1c04a8f95cf26320cf62453b0ce4d0c77b80cf128d918ffc6e5e4b7914e04
Opcode Fuzzy Hash: 64a3efbe46c4b871bd7612294a5cc8f4bd3c8d0982a9901b9ed430223ff476de
Instruction Fuzzy Hash: 1731B1759183119FC750EF69C588A09FBE0BF48324F4A895AE898DB361DB74E840CB42

Function 6560D9C9 Relevance: 25.6, APIs: 17, Instructions: 87fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560D857
Perl_get_context.PERL524 ref: 6560D876
Perl_get_context.PERL524 ref: 6560D882
Perl_sv_2uv_flags.PERL524 ref: 6560D893
Perl_get_context.PERL524 ref: 6560D89B
Perl_get_context.PERL524 ref: 6560D8B0
Perl_get_context.PERL524 ref: 6560D8CB
Perl_get_context.PERL524 ref: 6560D8D3
Perl_sv_2uv_flags.PERL524 ref: 6560D8E4
CreateFileW.KERNEL32 ref: 6560D919
Perl_get_context.PERL524 ref: 6560D935
Perl_get_context.PERL524 ref: 6560D940
Perl_newSVuv.PERL524 ref: 6560D953
Perl_get_context.PERL524 ref: 6560D95B
Perl_sv_2mortal.PERL524 ref: 6560D964
Perl_get_context.PERL524 ref: 6560D96D
Perl_get_context.PERL524 ref: 6560D971
Perl_get_context.PERL524 ref: 6560D980
Perl_get_context.PERL524 ref: 6560D995
Perl_get_context.PERL524 ref: 6560D9A4
Perl_av_len.PERL524 ref: 6560D9B1
Perl_get_context.PERL524 ref: 6560D9D0
Perl_get_context.PERL524 ref: 6560D9E9
Perl_get_context.PERL524 ref: 6560D9F8
Perl_av_len.PERL524 ref: 6560DA03

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_lenPerl_sv_2uv_flags$CreateFilePerl_newPerl_sv_2mortal
String ID:
API String ID: 1185150769-0
Opcode ID: 9b8e3c62f639aa1d1360cb5ea2188d352d013d782c45b42a99b16e34c193aabb
Instruction ID: f4e8e6bc94ff22f180589971aff03b3d429203fc94a01e4d780bf0853227af48
Opcode Fuzzy Hash: 9b8e3c62f639aa1d1360cb5ea2188d352d013d782c45b42a99b16e34c193aabb
Instruction Fuzzy Hash: D631B1759183019FCB50EF69C588A09FBF0BF48324F4A895EE899DB361DB74E844CB42

Function 65609BEC Relevance: 24.1, APIs: 16, Instructions: 105COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 656096ED
Perl_get_context.PERL524 ref: 656096F9
Perl_sv_grow.PERL524 ref: 6560970E
Perl_get_context.PERL524 ref: 65609718
Perl_get_context.PERL524 ref: 6560972D
Perl_get_context.PERL524 ref: 6560973F
Perl_get_context.PERL524 ref: 65609795
Perl_get_context.PERL524 ref: 656097A4
Perl_get_context.PERL524 ref: 656097B3
Perl_get_context.PERL524 ref: 656097C6
Perl_get_context.PERL524 ref: 656097D8
Perl_sv_newmortal.PERL524 ref: 656097DD
Perl_get_context.PERL524 ref: 656097F4
Perl_sv_setuv.PERL524 ref: 6560980D
Perl_get_context.PERL524 ref: 65609813
Perl_get_context.PERL524 ref: 6560981B
Perl_get_context.PERL524 ref: 65609820
Perl_get_context.PERL524 ref: 65609BF0
Perl_get_context.PERL524 ref: 65609C13

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_growPerl_sv_newmortalPerl_sv_setuv
String ID:
API String ID: 269151090-0
Opcode ID: 48c29c81f0d044c2b9cf251b6eecda7a283ea1146a3b05aa0154915f6087aca5
Instruction ID: d66df201619dfbb7fbe4d0d62b5461a51d744e2c95eb00ef26b885c896fa1923
Opcode Fuzzy Hash: 48c29c81f0d044c2b9cf251b6eecda7a283ea1146a3b05aa0154915f6087aca5
Instruction Fuzzy Hash: C841B3746183058FC754DF69C588E19F7E1FF88328F4A85A9E9898B322DB74E841CB46

Function 6560F570 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6560F59B
vfprintf.MSVCRT ref: 6560F5B7
abort.MSVCRT ref: 6560F5BC
VirtualQuery.KERNEL32 ref: 6560F671
VirtualQuery.KERNEL32 ref: 6560F6A9
memcpy.MSVCRT ref: 6560F6CE

Strings

@, xrefs: 6560F774

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: @
API String ID: 3828011698-2766056989
Opcode ID: c373560e100b7f15829d06f942f8b4a1e4c54346f5cd246e20f985203118c7eb
Instruction ID: b955b136fda608fc539703c1b190c08400e303581eb1b100d01b59cd7862ccd4
Opcode Fuzzy Hash: c373560e100b7f15829d06f942f8b4a1e4c54346f5cd246e20f985203118c7eb
Instruction Fuzzy Hash: B171F7B1A183059FDB14DF29D68562AFBF0FB89354F51892EE88987310E771E844CF86

Function 00405A60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00405A8B
vfprintf.MSVCRT ref: 00405AA7
abort.MSVCRT ref: 00405AAC
VirtualQuery.KERNEL32 ref: 00405B61
VirtualQuery.KERNEL32 ref: 00405B99
memcpy.MSVCRT ref: 00405BBE

Strings

@, xrefs: 00405C64

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: @
API String ID: 3828011698-2766056989
Opcode ID: 44066a1a0ae6bf130f2c026b7edfabb1e870481185d3cb463680f1912806d7b6
Instruction ID: ecd663981cd1441dfef46cfe03df3480c5caa6777eb2b4922adb88993fac0c3a
Opcode Fuzzy Hash: 44066a1a0ae6bf130f2c026b7edfabb1e870481185d3cb463680f1912806d7b6
Instruction Fuzzy Hash: C97114B59087019FD710EF69D58451BFBE0FB84304F55893EE889AB391E739E8448F8A

Function 6560B25C Relevance: 18.1, APIs: 12, Instructions: 58COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560B184
Perl_get_context.PERL524 ref: 6560B19F
Perl_get_context.PERL524 ref: 6560B1A7
Perl_sv_2uv_flags.PERL524 ref: 6560B1B8
GetFileType.KERNEL32 ref: 6560B1C1
Perl_get_context.PERL524 ref: 6560B1DB
Perl_sv_newmortal.PERL524 ref: 6560B1E0
Perl_get_context.PERL524 ref: 6560B1F7
Perl_sv_setuv.PERL524 ref: 6560B210
Perl_get_context.PERL524 ref: 6560B216
Perl_get_context.PERL524 ref: 6560B21E
Perl_get_context.PERL524 ref: 6560B222
Perl_get_context.PERL524 ref: 6560B23E
Perl_av_len.PERL524 ref: 6560B24B
Perl_get_context.PERL524 ref: 6560B260
Perl_get_context.PERL524 ref: 6560B275
Perl_get_context.PERL524 ref: 6560B280
Perl_av_len.PERL524 ref: 6560B289

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_len$FilePerl_sv_2uv_flagsPerl_sv_newmortalPerl_sv_setuvType
String ID:
API String ID: 4106638743-0
Opcode ID: ff52a7759ed7b3727111db192fe06f0d03bd2dabf627ea6b3efdd4b36fe00e8b
Instruction ID: ac7f3a46d1cf1fc85cec52ff3148070180c9b7d69b4bbbe05fd9d989f5227fcd
Opcode Fuzzy Hash: ff52a7759ed7b3727111db192fe06f0d03bd2dabf627ea6b3efdd4b36fe00e8b
Instruction Fuzzy Hash: 9E11F6719143008FC714AF7AC588A1DFBE1FF48324F4688AAE899C7361DB34D845CB06

Function 62581570 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 214COMMON

Download Yara Rule

APIs

Perl_sv_2pv_flags.PERL524 ref: 625815E3
Perl_newSV.PERL524 ref: 62581605
memchr.MSVCRT ref: 62581655
memcpy.MSVCRT ref: 62581677
Perl_sv_magic.PERL524 ref: 62581775
Perl_mg_get.PERL524 ref: 62581798

Strings

t, xrefs: 62581765
$PXb, xrefs: 625816E8

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Perl_mg_getPerl_newPerl_sv_2pv_flagsPerl_sv_magicmemchrmemcpy
String ID: $PXb$t
API String ID: 3120331975-4135994824
Opcode ID: 1131da13fa6869c8cb38d8df219d903025e05b32f552b3b84d4dd0d9be8af0bd
Instruction ID: a482607f9c13fdbfe2484718bb0fb77520bfdd4a3fe75060fff5f9cdce4cea05
Opcode Fuzzy Hash: 1131da13fa6869c8cb38d8df219d903025e05b32f552b3b84d4dd0d9be8af0bd
Instruction Fuzzy Hash: B781A1706083658FD7208F29C4A436AFFF1AB85358F49C96DE4E88B351D7B8D985CB42

Function 66E01A70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Perl_croak_xs_usage.PERL524 ref: 66E01AA5
Perl_newSVpvn_flags.PERL524 ref: 66E01ACF
Perl_hv_common.PERL524 ref: 66E01B1C
Perl_newSVpvf_nocontext.PERL524 ref: 66E01B3F
Perl_sv_2mortal.PERL524 ref: 66E01B4C
Perl_croak_sv.PERL524 ref: 66E01B59
Perl_newSVpvf_nocontext.PERL524 ref: 66E01B66

Strings

%-p is not a valid Fcntl macro at %s line %d, xrefs: 66E01B5F
Your vendor has not defined Fcntl macro %-p, used at %s line %d, xrefs: 66E01B38

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Perl_new$Vpvf_nocontext$Perl_croak_svPerl_croak_xs_usagePerl_hv_commonPerl_sv_2mortalVpvn_flags
String ID: %-p is not a valid Fcntl macro at %s line %d$Your vendor has not defined Fcntl macro %-p, used at %s line %d
API String ID: 1824238461-3870665602
Opcode ID: 2d12214fea142c683f9d3dfea008c26895f32fe5eef6b5e2f0fd5a3327ae8a39
Instruction ID: ae82a7cb3296c47f20597529a9ce7f9d19758f427624596284148eb60f8ea166
Opcode Fuzzy Hash: 2d12214fea142c683f9d3dfea008c26895f32fe5eef6b5e2f0fd5a3327ae8a39
Instruction Fuzzy Hash: 6431A8B4909311DFDB40DF68C59870ABBF1BB89704F10886DE9898B345E336E859CF92

Function 6560E81C Relevance: 15.1, APIs: 10, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32 ref: 6560E4AF

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524 ref: 6560E4C6
Perl_sv_newmortal.PERL524 ref: 6560E4CB
Perl_get_context.PERL524 ref: 6560E4EA
Perl_get_context.PERL524 ref: 6560E4F0
Perl_sv_setsv_flags.PERL524 ref: 6560E50B
Perl_get_context.PERL524 ref: 6560E511
Perl_get_context.PERL524 ref: 6560E519
Perl_get_context.PERL524 ref: 6560E520
Perl_get_context.PERL524 ref: 6560E540
Perl_av_len.PERL524 ref: 6560E54D
Perl_get_context.PERL524 ref: 6560E820

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$CopyErrorFileLastPerl_av_lenPerl_sv_newmortalPerl_sv_setsv_flags
String ID:
API String ID: 3763452051-0
Opcode ID: 282c502a7ee24f03f11cb6da9122e39a37c273fbc794363028c6f2dac9fe1799
Instruction ID: 66ad223ea48cc95f545795e1eb06fc421529cca4c4af634275f8750c4d505d9a
Opcode Fuzzy Hash: 282c502a7ee24f03f11cb6da9122e39a37c273fbc794363028c6f2dac9fe1799
Instruction Fuzzy Hash: 4011D7B59183058FC750EF69D984A19FBE0FF89364F058869E888D7321EB74E844CB56

Function 6560ED5C Relevance: 15.1, APIs: 10, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 6560E9EF

Part of subcall function 65601B20: GetLastError.KERNEL32 ref: 65601B27

Perl_get_context.PERL524 ref: 6560EA06
Perl_sv_newmortal.PERL524 ref: 6560EA0B
Perl_get_context.PERL524 ref: 6560EA2A
Perl_get_context.PERL524 ref: 6560EA30
Perl_sv_setsv_flags.PERL524 ref: 6560EA4B
Perl_get_context.PERL524 ref: 6560EA51
Perl_get_context.PERL524 ref: 6560EA59
Perl_get_context.PERL524 ref: 6560EA60
Perl_get_context.PERL524 ref: 6560EA80
Perl_av_len.PERL524 ref: 6560EA8D
Perl_get_context.PERL524 ref: 6560ED60

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$CopyErrorFileLastPerl_av_lenPerl_sv_newmortalPerl_sv_setsv_flags
String ID:
API String ID: 3763452051-0
Opcode ID: d71d584e323ced6096b333389ef7a4f1c8062e21f4495de1e85b4b2608aed569
Instruction ID: cc83b70e1f36c03dffc1d534b91b8d22305099e7f499c1637d25bad06c77f5a5
Opcode Fuzzy Hash: d71d584e323ced6096b333389ef7a4f1c8062e21f4495de1e85b4b2608aed569
Instruction Fuzzy Hash: 0B1119759183158FC750EF69D984A19FBE0FF98320F05886EE888C7321DB34E844CB56

Function 6560F810 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6560F924
VirtualProtect.KERNEL32 ref: 6560F951

Strings

|+ae, xrefs: 6560F8CD
|+ae, xrefs: 6560F869
|+ae, xrefs: 6560FA4F
|+ae, xrefs: 6560F8A0
|+ae, xrefs: 6560F994
|+ae, xrefs: 6560F87B

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: |+ae$|+ae$|+ae$|+ae$|+ae$|+ae
API String ID: 1027372294-3174387621
Opcode ID: 03b37c6c5c51c9eb20216d7f5eaa85923bdb3e66497309a9ce68a1c3ae1b237d
Instruction ID: a5686c20fa27e744fc0724231717f9e7cc7511adb230997189fa2722a7e9d9c8
Opcode Fuzzy Hash: 03b37c6c5c51c9eb20216d7f5eaa85923bdb3e66497309a9ce68a1c3ae1b237d
Instruction Fuzzy Hash: 6B716071E183148FDB68CF2DCA8075AF7F1BB8A314F45851AD8459B354EB34E844CB9A

Function 00404460 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 004044BB

Strings

PATH, xrefs: 00404488
LD_LIBRARY_PATH, xrefs: 00404464, 0040446C

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: strstr
String ID: LD_LIBRARY_PATH$PATH
API String ID: 1392478783-3236830189
Opcode ID: 6aea7127327b1fc0aeb775d326ebb01cd4f8f980d636dfcba1c46be2083cf398
Instruction ID: 1e111dc6e95738dc353d5a65f00534228e45d93cb0dc38526714efc85b19edb7
Opcode Fuzzy Hash: 6aea7127327b1fc0aeb775d326ebb01cd4f8f980d636dfcba1c46be2083cf398
Instruction Fuzzy Hash: 30312CB1A093409FC310AF25C58451BBBE4AF84718F058D3EFA89AB391DB78D9458F4A

Function 6560A6AC Relevance: 13.5, APIs: 9, Instructions: 47COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560A577
Perl_get_context.PERL524 ref: 6560A585
Perl_get_context.PERL524 ref: 6560A59A
Perl_get_context.PERL524 ref: 6560A5AF
Perl_get_context.PERL524 ref: 6560A5CA
Perl_get_context.PERL524 ref: 6560A5D2
Perl_sv_pvn_force_flags.PERL524 ref: 6560A5EB
Perl_get_context.PERL524 ref: 6560A5F1
Perl_get_context.PERL524 ref: 6560A618
Perl_get_context.PERL524 ref: 6560A624
Perl_sv_grow.PERL524 ref: 6560A635
Perl_get_context.PERL524 ref: 6560A63F
Perl_get_context.PERL524 ref: 6560A654
Perl_get_context.PERL524 ref: 6560A666
Perl_get_context.PERL524 ref: 6560A681
Perl_get_context.PERL524 ref: 6560A6B0
Perl_get_context.PERL524 ref: 6560A6C2
Perl_get_context.PERL524 ref: 6560A6DD
Perl_get_context.PERL524 ref: 6560A6E9
Perl_sv_2pv_flags.PERL524 ref: 6560A706
Perl_get_context.PERL524 ref: 6560A714
Perl_get_context.PERL524 ref: 6560A72F
Perl_get_context.PERL524 ref: 6560A73B
Perl_sv_2pv_flags.PERL524 ref: 6560A758
Perl_get_context.PERL524 ref: 6560AB94
Perl_get_context.PERL524 ref: 6560AC00

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2pv_flags$Perl_sv_growPerl_sv_pvn_force_flags
String ID:
API String ID: 4166808131-0
Opcode ID: 724be1799ff33e4507cae20396193c27e045fd52e6fd94835f93088c650b9b2f
Instruction ID: 6e222e5f9562d07e54dc04cb1d39b4d9446ba99a35e92be5f4f2a3c61e1e4153
Opcode Fuzzy Hash: 724be1799ff33e4507cae20396193c27e045fd52e6fd94835f93088c650b9b2f
Instruction Fuzzy Hash: 8B1192B49183008FD715DF69C488B0AFBE1FF48364F5AC859E5898B362C778D845CB46

Function 6560306C Relevance: 13.5, APIs: 9, Instructions: 36COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65602E2D
Perl_get_context.PERL524 ref: 65602E42
Perl_get_context.PERL524 ref: 65602E50
Perl_get_context.PERL524 ref: 65602E58
Perl_mg_set.PERL524 ref: 65602E61
Perl_get_context.PERL524 ref: 65602E67
Perl_get_context.PERL524 ref: 65602E6B
Perl_get_context.PERL524 ref: 65603070
Perl_get_context.PERL524 ref: 6560307B
Perl_av_len.PERL524 ref: 65603084

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_lenPerl_mg_set
String ID:
API String ID: 57357389-0
Opcode ID: 67283c95244027bd5802e4f4ee4c5d9e99077e509ed19962dc550053191636ff
Instruction ID: 6c20dcce4030bcc7a63fb9c50241bfb9eac389fb8bf6e633b60f89b634b589e8
Opcode Fuzzy Hash: 67283c95244027bd5802e4f4ee4c5d9e99077e509ed19962dc550053191636ff
Instruction Fuzzy Hash: 0F01C4719542108FC7109F6DC888958FBE0FF48334B8A899AE99DDB372CB34E841CB46

Function 62581A70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Perl_sv_2mortal.PERL524 ref: 62581AAF
Perl_croak_xs_usage.PERL524 ref: 62581AE7
Perl_stack_grow.PERL524 ref: 62581B5F
Perl_sv_newmortal.PERL524 ref: 62581B7B
Perl_do_join.PERL524 ref: 62581BA4
Perl_sv_2mortal.PERL524 ref: 62581BBE

Strings

'PXb, xrefs: 62581ADC

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Perl_sv_2mortal$Perl_croak_xs_usagePerl_do_joinPerl_stack_growPerl_sv_newmortal
String ID: 'PXb
API String ID: 2327996282-2713956611
Opcode ID: b4768ab3e207518ff6e51c652eda21d98d34441c3e1d590523f6824fc263e32b
Instruction ID: 3c51edf1f6d0abc244fc91203ee2f6d042e17e07ed0d58bab2be2b6060324c88
Opcode Fuzzy Hash: b4768ab3e207518ff6e51c652eda21d98d34441c3e1d590523f6824fc263e32b
Instruction Fuzzy Hash: F051F1789043118FCB10DF28C58455ABBF1FF8A348F09896DE9998B319E775E902CF42

Function 66E015C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

Perl_get_hv.PERL524 ref: 66E015DA
Perl_hv_common_key_len.PERL524 ref: 66E0160F
Perl_newSV_type.PERL524 ref: 66E0163B

Strings

Fcntl, xrefs: 66E01600
d@f, xrefs: 66E015CF
0, xrefs: 66E015F0

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Perl_get_hvPerl_hv_common_key_lenPerl_newV_type
String ID: 0$Fcntl$d@f
API String ID: 3924257354-3207010694
Opcode ID: c9df64013cdcfcb03fecd6dc82c17590731c0e0018e5ba5f2a61b189639a6c82
Instruction ID: c62da0ea4868d9127ab33bedd06601016443c0901a886ec3329abd73ee2e845b
Opcode Fuzzy Hash: c9df64013cdcfcb03fecd6dc82c17590731c0e0018e5ba5f2a61b189639a6c82
Instruction Fuzzy Hash: EA1134B0509711DFEB00DF24D48874ABBE0BF85748F248A5DE8888B391D3B5D899CF82

Function 00403EC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 00403ED1
Perl_newXS.PERL524 ref: 00403EF4
Perl_get_context.PERL524 ref: 00403EF6
Perl_newXS.PERL524 ref: 00403F13

Strings

Win32CORE::bootstrap, xrefs: 00403F08
DynaLoader::boot_DynaLoader, xrefs: 00403EE9
perlxsi.c, xrefs: 00403ED9, 00403EF8

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_contextPerl_new
String ID: DynaLoader::boot_DynaLoader$Win32CORE::bootstrap$perlxsi.c
API String ID: 2403529240-905768519
Opcode ID: 0a832dab51cd96d216412553b3533234cc8f5ffb0fed9d2fd3b3ffbdbaf8dacf
Instruction ID: 4bb93222e15b9a8e17c4eca4ef5b205ee84f3ec763e1f0749437cbe3f42d63c5
Opcode Fuzzy Hash: 0a832dab51cd96d216412553b3533234cc8f5ffb0fed9d2fd3b3ffbdbaf8dacf
Instruction Fuzzy Hash: 49F074B0818711DBC700EF24C58400EBFE0BA85754F85CD6EE88877351C779994C8F9A

Function 656044BC Relevance: 12.0, APIs: 8, Instructions: 44fileCOMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65603FB9
Perl_get_context.PERL524 ref: 65603FCE
Perl_get_context.PERL524 ref: 65603FE9
Perl_get_context.PERL524 ref: 65603FF5
Perl_sv_2uv_flags.PERL524 ref: 6560400A
ReadFile.KERNEL32 ref: 6560403B
Perl_get_context.PERL524(?), ref: 6560405F
Perl_get_context.PERL524 ref: 65604071
Perl_get_context.PERL524 ref: 65604091
Perl_get_context.PERL524 ref: 65604099
Perl_sv_setuv.PERL524 ref: 656040B2
Perl_get_context.PERL524 ref: 656040B8
Perl_get_context.PERL524 ref: 656040CA
Perl_sv_newmortal.PERL524 ref: 656040CF
Perl_get_context.PERL524 ref: 656040F5
Perl_get_context.PERL524 ref: 656040F9
Perl_sv_setsv_flags.PERL524 ref: 65604114
Perl_get_context.PERL524 ref: 6560411A
Perl_get_context.PERL524 ref: 65604126
Perl_get_context.PERL524 ref: 6560412A
Perl_get_context.PERL524 ref: 656042B0
Perl_get_context.PERL524 ref: 656042C5
Perl_get_context.PERL524 ref: 656042D7
Perl_get_context.PERL524 ref: 656042F2
Perl_get_context.PERL524 ref: 656044C0
Perl_get_context.PERL524 ref: 656044D5
Perl_get_context.PERL524 ref: 656044E4
Perl_av_len.PERL524 ref: 656044F1
Perl_get_context.PERL524 ref: 656045E3
Perl_get_context.PERL524 ref: 656045F5
Perl_get_context.PERL524 ref: 65604610
Perl_get_context.PERL524 ref: 6560461C
Perl_sv_2pv_flags.PERL524 ref: 65604639
Perl_get_context.PERL524 ref: 65604647
Perl_get_context.PERL524 ref: 65604662
Perl_get_context.PERL524 ref: 6560466A
Perl_sv_2pv_flags.PERL524 ref: 65604683

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_2pv_flags$FilePerl_av_lenPerl_sv_2uv_flagsPerl_sv_newmortalPerl_sv_setsv_flagsPerl_sv_setuvRead
String ID:
API String ID: 1472282663-0
Opcode ID: c92e38579062162d91d55a4768de0a6d57e3cdf9320796c6fde9895843b7d42b
Instruction ID: 845b94e6a7dfa05222a944c85102fa8b6514deb5050f147a4b81ea210dbc57ab
Opcode Fuzzy Hash: c92e38579062162d91d55a4768de0a6d57e3cdf9320796c6fde9895843b7d42b
Instruction Fuzzy Hash: A511D0786142418FD725CF69C5C8E09F7E1FF19324B9A8589E899CB372CB70E841CA06

Function 656041FC Relevance: 12.0, APIs: 8, Instructions: 42COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 656040F5
Perl_get_context.PERL524 ref: 656040F9
Perl_sv_setsv_flags.PERL524 ref: 65604114
Perl_get_context.PERL524 ref: 6560411A
Perl_get_context.PERL524 ref: 65604126
Perl_get_context.PERL524 ref: 6560412A
Perl_get_context.PERL524 ref: 65604210
Perl_av_len.PERL524 ref: 65604219

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_lenPerl_sv_setsv_flags
String ID:
API String ID: 4146423049-0
Opcode ID: 8bb7c5077786eee92e3553b9bd32bd4a77bd6f14bcbcbcc53d2205d0dfd3d893
Instruction ID: 9e769045ef3ae5bf68de9f4a9bcd5e8196f05e3f061bf91f1f53ae3112de1f0a
Opcode Fuzzy Hash: 8bb7c5077786eee92e3553b9bd32bd4a77bd6f14bcbcbcc53d2205d0dfd3d893
Instruction Fuzzy Hash: BC015A718083009FC720AF2AC985619FBF0FF95365F45896DE8D997660D7B8E894CB42

Function 6560AF89 Relevance: 12.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 6560AF45
Perl_get_context.PERL524 ref: 6560AF49
Perl_sv_setsv_flags.PERL524 ref: 6560AF64
Perl_get_context.PERL524 ref: 6560AF6A
Perl_get_context.PERL524 ref: 6560AF72
Perl_get_context.PERL524 ref: 6560AF76
Perl_get_context.PERL524 ref: 6560AF99
Perl_av_len.PERL524 ref: 6560AFA2

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_av_lenPerl_sv_setsv_flags
String ID:
API String ID: 4146423049-0
Opcode ID: d9a9aa62ae0f9248c52d37aec270a1838be014b5b601b1f531b26867384ce60d
Instruction ID: 174cfdc4acb6d83275704a76f4fd9ca27c02c27ab6e9c941a5a41609e4e70a4e
Opcode Fuzzy Hash: d9a9aa62ae0f9248c52d37aec270a1838be014b5b601b1f531b26867384ce60d
Instruction Fuzzy Hash: 240116B19487058FC710AF7AC98464AFBE0FF44764F44892DE899C7351DB38E845CB46

Function 66E023F0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 66E02504
VirtualProtect.KERNEL32 ref: 66E02531

Strings

Mf, xrefs: 66E02545
Unknown pseudo relocation protocol version %d., xrefs: 66E02689
Unknown pseudo relocation bit size %d., xrefs: 66E025A7
VirtualQuery failed for %d bytes at address %p, xrefs: 66E023A9, 66E023D5, 66E02675

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$ VirtualQuery failed for %d bytes at address %p$Mf
API String ID: 1027372294-3480217154
Opcode ID: 402f7e13d189e6a612646951ff90f6a0d6c02da553cb34c254b839168cc9b1cf
Instruction ID: b78cd2c04cec4c9eb2ec2b3f06d8c497e5cbc7daa336e16be32809c2375ce12f
Opcode Fuzzy Hash: 402f7e13d189e6a612646951ff90f6a0d6c02da553cb34c254b839168cc9b1cf
Instruction Fuzzy Hash: EB71D0B1E15210CFDB00DF68C98074DBBF6BBA9308F25852ED9449B358E731D869CB92

Function 65601040 Relevance: 10.6, APIs: 7, Instructions: 129sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,656013A1), ref: 65601077
_amsg_exit.MSVCRT ref: 656010B4
Sleep.KERNEL32(?,?,?,?,?,?,?,656013A1), ref: 656010F0
free.MSVCRT ref: 656011BE
_initterm.MSVCRT ref: 6560121A
_amsg_exit.MSVCRT ref: 6560122B
_initterm.MSVCRT ref: 65601244

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Sleep_amsg_exit_initterm$free
String ID:
API String ID: 2063039674-0
Opcode ID: 5141f436583d2e12de636d199c0d024e666525ed77e9995010a59af56c38e43d
Instruction ID: ff61472b20b00c8c8207336fa519e55a2eb0ad49a3f9744b8555e346049ed70e
Opcode Fuzzy Hash: 5141f436583d2e12de636d199c0d024e666525ed77e9995010a59af56c38e43d
Instruction Fuzzy Hash: F84164707183858BDB24DF6DCA8576ABBF1BB45308F01852DD8868B648DF75D484CB87

Function 66E01040 Relevance: 10.6, APIs: 7, Instructions: 129sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,66E013A1), ref: 66E01077
_amsg_exit.MSVCRT ref: 66E010B4
Sleep.KERNEL32(?,?,?,?,?,?,?,66E013A1), ref: 66E010F0
free.MSVCRT ref: 66E011BE
_initterm.MSVCRT ref: 66E0121A
_amsg_exit.MSVCRT ref: 66E0122B
_initterm.MSVCRT ref: 66E01244

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Sleep_amsg_exit_initterm$free
String ID:
API String ID: 2063039674-0
Opcode ID: f6b5a77020fb5fa77d09920953ce60ba4270427bfeae2f1dd7132c8d58eab9c3
Instruction ID: 6cf7a28c109904a6979951bad3210e16afb9a2f762dca9a7c94d0d6ce87a453d
Opcode Fuzzy Hash: f6b5a77020fb5fa77d09920953ce60ba4270427bfeae2f1dd7132c8d58eab9c3
Instruction Fuzzy Hash: C94144709093508FEB009FE4CA8974A7BE6AB9534CF61852CD6848F349E776D478CB92

Function 62581040 Relevance: 10.6, APIs: 7, Instructions: 129sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,625813A1), ref: 62581077
_amsg_exit.MSVCRT ref: 625810B4
Sleep.KERNEL32(?,?,?,?,?,?,?,625813A1), ref: 625810F0
free.MSVCRT ref: 625811BE
_initterm.MSVCRT ref: 6258121A
_amsg_exit.MSVCRT ref: 6258122B
_initterm.MSVCRT ref: 62581244

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Sleep_amsg_exit_initterm$free
String ID:
API String ID: 2063039674-0
Opcode ID: 4c24d46beca65e902060f4ed19b4da74ae7555b15a412ed4951afb525f2fce3b
Instruction ID: b47a6808e423f552344b90c8eee4ed65bda0fb70728ef73e31e175d4089cd6b9
Opcode Fuzzy Hash: 4c24d46beca65e902060f4ed19b4da74ae7555b15a412ed4951afb525f2fce3b
Instruction Fuzzy Hash: B04143B0658371CFEB30AF24C9A576A7BE0AB42304F11992DD8A587244E7FDD944CB42

Function 62581CFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Perl_safesysmalloc.PERL524 ref: 62581C5E
_getdcwd.MSVCRT ref: 62581C79
Perl_sv_setpv_mg.PERL524 ref: 62581C92
Perl_safesysfree.PERL524 ref: 62581CA9
Perl_sv_magic.PERL524 ref: 62581CEC
Perl_sv_setsv_flags.PERL524 ref: 62581DAF

Strings

t, xrefs: 62581CD5

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Perl_safesysfreePerl_safesysmallocPerl_sv_magicPerl_sv_setpv_mgPerl_sv_setsv_flags_getdcwd
String ID: t
API String ID: 1588621233-2238339752
Opcode ID: df5ac44901111f87c5ff24a8d5259d7a202ae4b016b0481dd6a59200f93dc4bf
Instruction ID: 37a8951cdb9f404c77cb76a84f3124582c771f103958f6b50981acc1f758f59f
Opcode Fuzzy Hash: df5ac44901111f87c5ff24a8d5259d7a202ae4b016b0481dd6a59200f93dc4bf
Instruction Fuzzy Hash: 283183B19047208FD720CF24C49475ABBE1FF85354F06C95DDAA99B3A4C7BC9985CB42

Function 656046BC Relevance: 10.5, APIs: 7, Instructions: 32COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524(?), ref: 6560405F
Perl_get_context.PERL524 ref: 65604071
Perl_get_context.PERL524 ref: 65604091
Perl_get_context.PERL524 ref: 65604099
Perl_sv_setuv.PERL524 ref: 656040B2
Perl_get_context.PERL524 ref: 656040B8
Perl_get_context.PERL524 ref: 656040CA
Perl_sv_newmortal.PERL524 ref: 656040CF
Perl_get_context.PERL524 ref: 656040F5
Perl_get_context.PERL524 ref: 656040F9
Perl_sv_setsv_flags.PERL524 ref: 65604114
Perl_get_context.PERL524 ref: 6560411A
Perl_get_context.PERL524 ref: 65604126
Perl_get_context.PERL524 ref: 6560412A
Perl_get_context.PERL524 ref: 656046D0
Perl_get_context.PERL524 ref: 656046DF
Perl_get_context.PERL524 ref: 656046EE
Perl_get_context.PERL524 ref: 656046FF
Perl_get_context.PERL524 ref: 65604711
Perl_get_context.PERL524 ref: 65604719
Perl_mg_set.PERL524 ref: 65604722

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_mg_setPerl_sv_newmortalPerl_sv_setsv_flagsPerl_sv_setuv
String ID:
API String ID: 2500670585-0
Opcode ID: 3715ab1120949b2d9660b4bc3702021ed7e89fb42950b8599570d674aaec6ab8
Instruction ID: 4e37ad4aedc023ce2016a324a7c7eeb0238b6fb0b1b37c32bb2854a5b49e7680
Opcode Fuzzy Hash: 3715ab1120949b2d9660b4bc3702021ed7e89fb42950b8599570d674aaec6ab8
Instruction Fuzzy Hash: 070192746182518FC320DF29C488E15FBE1FF49321B4A8499E9999B772CB74F841CA06

Function 00405800 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 0040582F
signal.MSVCRT ref: 004058A1
signal.MSVCRT ref: 0040595F

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: caed4a7ed47a9d59eccda5eb380dc4072c9a75cf96e9ef7adbac1ee2576c8503
Instruction ID: 9674abbf139b6af965cbafdf36e056b5f6ce1708016435fc95262aa3fbb9168a
Opcode Fuzzy Hash: caed4a7ed47a9d59eccda5eb380dc4072c9a75cf96e9ef7adbac1ee2576c8503
Instruction Fuzzy Hash: 97315CB24096018AE7207B69844431F76D0EB45338F168A2FE895AB3D0C77DCCE49F5A

Function 004038D0 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 004038EB
Perl_get_context.PERL524 ref: 004038F6
Perl_get_context.PERL524 ref: 004038FA
Perl_get_context.PERL524 ref: 00403931
Perl_get_context.PERL524 ref: 00403946
Perl_get_context.PERL524 ref: 00403950

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context
String ID:
API String ID: 2493893717-0
Opcode ID: 558844b2ee92bdbc6ff27d560901586fa2c697686cac1a4172a84cf7ad509bb1
Instruction ID: d62a3fc038a507f0b2339531f72a8814309929142b481529019d1fa7748d06ea
Opcode Fuzzy Hash: 558844b2ee92bdbc6ff27d560901586fa2c697686cac1a4172a84cf7ad509bb1
Instruction Fuzzy Hash: 31112EB18053118FC7009F2AC884629FBE0BF88750F4948BAEC8CE7362D778DD458B56

Function 66E021B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 66E02251
VirtualQuery.KERNEL32 ref: 66E02289
memcpy.MSVCRT ref: 66E022AE

Strings

Address %p has no image-section, xrefs: 66E023BD
VirtualQuery failed for %d bytes at address %p, xrefs: 66E023A9, 66E023D5

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: QueryVirtual$memcpy
String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2264504374-157664173
Opcode ID: f3c35ebd58d9e7e3726f6d420a80755b191efcef9754271ef5d2b06be67fd230
Instruction ID: 0ebb6999cdeea213e447c71b8bbd2a72719054d11cf9c2059ac6e03fcf7631e9
Opcode Fuzzy Hash: f3c35ebd58d9e7e3726f6d420a80755b191efcef9754271ef5d2b06be67fd230
Instruction Fuzzy Hash: 0C317271908311DFD710DF69D98460AFBE5FBA9348F61892DE98887300E731E868CBD2

Function 66E014C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Perl_hv_common_key_len.PERL524 ref: 66E01508
Perl_newCONSTSUB.PERL524 ref: 66E01560
Perl_sv_upgrade.PERL524 ref: 66E01593
Perl_croak.PERL524 ref: 66E015AE

Strings

@@f, xrefs: 66E015A3

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Perl_croakPerl_hv_common_key_lenPerl_newPerl_sv_upgrade
String ID: @@f
API String ID: 1601255882-1405947741
Opcode ID: 67c9ea76565f2741c404884c448c0669113b0a87185b670740b6f3a272fdb2ab
Instruction ID: 81fb641aea262e39c4b2784c9c6dac9bb6dc67497a6b5380999b82c1c64f41fe
Opcode Fuzzy Hash: 67c9ea76565f2741c404884c448c0669113b0a87185b670740b6f3a272fdb2ab
Instruction Fuzzy Hash: F021C0B49087019FD704DF59C09435AFBF0BF89748F20891EE5AA9B351D375E899CB82

Function 6560FB60 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6560FBB7
GetCurrentProcessId.KERNEL32 ref: 6560FBCC
GetCurrentThreadId.KERNEL32 ref: 6560FBD4
GetTickCount.KERNEL32 ref: 6560FBDC
QueryPerformanceCounter.KERNEL32 ref: 6560FBEB

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 46c6739adad345085687c48229e9d2e805431219ae26029718a8db60431a8043
Instruction ID: cbf37886d8da839dea53d8df4e6eaa33dedaae0e70cbbe568d7c21b61bd676cb
Opcode Fuzzy Hash: 46c6739adad345085687c48229e9d2e805431219ae26029718a8db60431a8043
Instruction Fuzzy Hash: 011108B58183088FC720EF69C14915AFBF0BB89244F44092EEA9497300EF75DA14CF83

Function 66E02740 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 66E02797
GetCurrentProcessId.KERNEL32 ref: 66E027AC
GetCurrentThreadId.KERNEL32 ref: 66E027B4
GetTickCount.KERNEL32 ref: 66E027BC
QueryPerformanceCounter.KERNEL32 ref: 66E027CB

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 94f051ba4e5a3d035a9e7cb986d066134b389dd8f412201609ffc5025db9a3a9
Instruction ID: 01bf5f0209e945fb60775db43fa88a3d686ecfba5c49985fc28088acb7482408
Opcode Fuzzy Hash: 94f051ba4e5a3d035a9e7cb986d066134b389dd8f412201609ffc5025db9a3a9
Instruction Fuzzy Hash: 6F11E2B48093148FCB10EF69C14811BBBF1BB89344F44092DEA9497351EB75EA68DF82

Function 00406420 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00406477
GetCurrentProcessId.KERNEL32 ref: 0040648C
GetCurrentThreadId.KERNEL32 ref: 00406494
GetTickCount.KERNEL32 ref: 0040649C
QueryPerformanceCounter.KERNEL32 ref: 004064AB

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 16e4bc3c0d936b64378c934a0ec02caef02eb21866957bd623e2448d99e71d0b
Instruction ID: d18d131edfcbf413a2c5bc677b23e1cf198a1d2de86f6ad41a8f1fe64656619c
Opcode Fuzzy Hash: 16e4bc3c0d936b64378c934a0ec02caef02eb21866957bd623e2448d99e71d0b
Instruction Fuzzy Hash: 8B11FCB98083048FC310EF69D64811BBBF0BB8C354F45093DEA85A7310EA75EA59CF4A

Function 62583340 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 62583397
GetCurrentProcessId.KERNEL32 ref: 625833AC
GetCurrentThreadId.KERNEL32 ref: 625833B4
GetTickCount.KERNEL32 ref: 625833BC
QueryPerformanceCounter.KERNEL32 ref: 625833CB

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 04c550e825b65561834f0aee457227bbadbd3a927ed09ee192e19b54c2bcc0f9
Instruction ID: 68738854c35c2936c60924dddc82fe2f19abd5a6c93f076ea9d1ce9ee728e970
Opcode Fuzzy Hash: 04c550e825b65561834f0aee457227bbadbd3a927ed09ee192e19b54c2bcc0f9
Instruction Fuzzy Hash: 60110BB4448318CFC720AF68C54811ABBF0FB8A284F451D2DE98597310EB79DA54DB83

Function 6560290C Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 65602875
Perl_get_context.PERL524 ref: 65602881
Perl_get_context.PERL524 ref: 65602885
Perl_get_context.PERL524 ref: 65602910
Perl_sv_setiv.PERL524 ref: 6560292D

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_sv_setiv
String ID:
API String ID: 1837914730-0
Opcode ID: 29383951ffeffbee27df9b69106adba693ecdf7f3e5ef6f94de8855873fefbb4
Instruction ID: 09fc04918008aab0719b9ee51df8a5c7d8dd59a2268f1aa9c418302a82efaf75
Opcode Fuzzy Hash: 29383951ffeffbee27df9b69106adba693ecdf7f3e5ef6f94de8855873fefbb4
Instruction Fuzzy Hash: 19F0A5B65083009FC7549F69D884559FBE0FF88324F45885EE88997310CB39E845CB46

Function 625814C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Perl_newSV.PERL524 ref: 625814ED
Perl_newSVpvn.PERL524 ref: 6258152B
Perl_newSVpvn.PERL524 ref: 62581542

Strings

%PXb, xrefs: 6258153A

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Perl_new$Vpvn
String ID: %PXb
API String ID: 553657591-197818760
Opcode ID: 32a8395f6f47c1e8a94f38577b6c749df4b2c42d5edeeb336be08bde5fff870a
Instruction ID: 3be0b7c61ea9bd8c273ff6fa0095928dab66cc05fb484a1ce58ffadd661dc9fd
Opcode Fuzzy Hash: 32a8395f6f47c1e8a94f38577b6c749df4b2c42d5edeeb336be08bde5fff870a
Instruction Fuzzy Hash: D7117AB8908715CFC710DF19C18061AFBE0FF89708F56899DE9989B311D774A985CF92

Function 65601460 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 65601476
GetProcAddress.KERNEL32 ref: 65601493

Strings

_Jv_RegisterClasses, xrefs: 65601488
libgcj-12.dll, xrefs: 6560146F

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-12.dll
API String ID: 1646373207-3860506660
Opcode ID: 049f030d33d3fd050a612febf1f0d508ef0180ace30d5349def9aff0dacb0b5d
Instruction ID: e99f170277218a12db0d3ff73d83a3679696d402fe9d9a29f1e8706765638670
Opcode Fuzzy Hash: 049f030d33d3fd050a612febf1f0d508ef0180ace30d5349def9aff0dacb0b5d
Instruction Fuzzy Hash: B9E01271A1830547EB207F7E8A4633A7AF9BB92245F414639CC4297654EE34C545CB53

Function 66E01460 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 66E01476
GetProcAddress.KERNEL32 ref: 66E01493

Strings

libgcj-12.dll, xrefs: 66E0146F
_Jv_RegisterClasses, xrefs: 66E01488

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-12.dll
API String ID: 1646373207-3860506660
Opcode ID: ef06d0e7e43d8ed0ce4f50b5578110d64a49352f700e0b39b8ab6d614afc2192
Instruction ID: 840ccd8d9a34ef3ec7a68895ec1c4342982464f03dc0fe9ac76ce7f2c20789b0
Opcode Fuzzy Hash: ef06d0e7e43d8ed0ce4f50b5578110d64a49352f700e0b39b8ab6d614afc2192
Instruction Fuzzy Hash: DAE01270A0921197DB007FF8994671A7AF6ABD1348F61842CD8419A349FA31D529C793

Function 00401500 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401516
GetProcAddress.KERNEL32 ref: 00401533

Strings

_Jv_RegisterClasses, xrefs: 00401528
libgcj-12.dll, xrefs: 0040150F

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-12.dll
API String ID: 1646373207-3860506660
Opcode ID: 3995104ba614c98a7b0baebbd38b19a09a5b5a770a8beebacd88e12034d7db80
Instruction ID: 837ee5a3f25b3e1e4d579a1192cf2ac1d7655173a07351e5d11e166c9c8434f1
Opcode Fuzzy Hash: 3995104ba614c98a7b0baebbd38b19a09a5b5a770a8beebacd88e12034d7db80
Instruction Fuzzy Hash: 01E01275A0560157D7103B789E0931B7AF5AB80344F45857DD8C2BB394EB78D409875B

Function 00403F21 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

Perl_get_context.PERL524 ref: 00403F3A

Part of subcall function 00403EC0: Perl_get_context.PERL524 ref: 00403ED1
Part of subcall function 00403EC0: Perl_newXS.PERL524 ref: 00403EF4
Part of subcall function 00403EC0: Perl_get_context.PERL524 ref: 00403EF6
Part of subcall function 00403EC0: Perl_newXS.PERL524 ref: 00403F13

Perl_get_context.PERL524 ref: 00403F44
Perl_newXS_flags.PERL524 ref: 00403F71

Strings

Internals::PAR::BOOT, xrefs: 00403F66

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: Perl_get_context$Perl_new$S_flags
String ID: Internals::PAR::BOOT
API String ID: 1625537881-3495449961
Opcode ID: 25e270ccdc36d1aa3d22416f914c54072748812ef0404261ec6e7153412966cf
Instruction ID: 1c178923636b9464f69d36efd8755a4b49a37591f5ebfb44855e55c174eb5744
Opcode Fuzzy Hash: 25e270ccdc36d1aa3d22416f914c54072748812ef0404261ec6e7153412966cf
Instruction Fuzzy Hash: 98E0E5B0419705CBC300AFA2DA8812ABEE4BB44305F45883EE8C466280CB79858C8F8A

Function 62581850 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

Perl_sv_2mortal.PERL524 ref: 625818B2
Perl_sv_newmortal.PERL524 ref: 62581914
Perl_sv_2mortal.PERL524 ref: 6258192F
Perl_do_join.PERL524 ref: 62581965

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Perl_sv_2mortal$Perl_do_joinPerl_sv_newmortal
String ID:
API String ID: 1508132022-0
Opcode ID: 81e7c402f93d2159586e601a4fa37c7dd4444d1114dfa6464a6632a3741f430e
Instruction ID: acb899cc1cd30f0a2a0e672f9c942072a3941d6095ef7f7e1493986f70364708
Opcode Fuzzy Hash: 81e7c402f93d2159586e601a4fa37c7dd4444d1114dfa6464a6632a3741f430e
Instruction Fuzzy Hash: AA51DDB49083109FCB54DF28C480A1AFBF1FB89314F059A6DE8A99B315D7B8E901CF42

Function 66E01920 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Perl_sv_2uv_flags.PERL524 ref: 66E019A1
Perl_sv_newmortal.PERL524 ref: 66E01A27
Perl_stack_grow.PERL524 ref: 66E01A62

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: Perl_stack_growPerl_sv_2uv_flagsPerl_sv_newmortal
String ID:
API String ID: 4187863317-0
Opcode ID: 9ac099f22d5bdb52072c3b61c510f0dc44226695504cea3b4173fb449ef051e1
Instruction ID: 5841792c67bc126396c694da7e7d5895a9bb72ff71cb033a70f52a6a232a76ba
Opcode Fuzzy Hash: 9ac099f22d5bdb52072c3b61c510f0dc44226695504cea3b4173fb449ef051e1
Instruction Fuzzy Hash: 8B4135B05083059FD710DF68C58475ABBF1FF84308F58896EE9898B322D775E859CB82

Function 6560F390 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6560F3B9
__dllonexit.MSVCRT ref: 6560F3F3
_unlock.MSVCRT ref: 6560F423
_onexit.MSVCRT ref: 6560F433

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: a4b62b66f8193d91ce12a66d0f64e75cb836e6f86026347f79a8fa242944c04e
Instruction ID: 1a72bdbfec1fc1992f86557342e5cc2796778abaa79fa54aba51134ce4535231
Opcode Fuzzy Hash: a4b62b66f8193d91ce12a66d0f64e75cb836e6f86026347f79a8fa242944c04e
Instruction Fuzzy Hash: 401198B0A183068FCB50EF79C4C552EBBE0AB59214F40492EE895CB351EB34D488CB8A

Function 66E01F70 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 66E01F99
__dllonexit.MSVCRT ref: 66E01FD3
_unlock.MSVCRT ref: 66E02003
_onexit.MSVCRT ref: 66E02013

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 5b673bf0b5f3891c013fdf47b1eebbe44e45ce84c1532258bfc1f9a4951ea249
Instruction ID: fc16102f71b2d48a39dcecc8d41cd98f534f181e9e18ebadf72a8f8e3a83a490
Opcode Fuzzy Hash: 5b673bf0b5f3891c013fdf47b1eebbe44e45ce84c1532258bfc1f9a4951ea249
Instruction Fuzzy Hash: 141196B49093018FCB00EF74C8C451EBFE5BF99254F614D2EE6D487351E77594A88B92

Function 00405720 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 00405749
__dllonexit.MSVCRT ref: 00405783
_unlock.MSVCRT ref: 004057B3
_onexit.MSVCRT ref: 004057C3

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: f3f8a5f8d7b7fc7a33851794c82b39cae4f57ec0dccd84fc4573e868dff5e40d
Instruction ID: 8ae2fbc05a717cfbcacb51e1034c81dba430ac07e0faece6e8646752c0b65a17
Opcode Fuzzy Hash: f3f8a5f8d7b7fc7a33851794c82b39cae4f57ec0dccd84fc4573e868dff5e40d
Instruction Fuzzy Hash: 5611A4B4909700DBC700EFB9D88551EBBE0FB48318F414D3EE894A7391E63885989F96

Function 62582B70 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 62582B99
__dllonexit.MSVCRT ref: 62582BD3
_unlock.MSVCRT ref: 62582C03
_onexit.MSVCRT ref: 62582C13

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: cdb239039f02d4dfd3cc948df1c5d903c3b25a2ddba110b71a2a5f449dce0736
Instruction ID: 738361da8e2ea863c093948094bf6fff74426385dee9b630a41b2881d41b49d1
Opcode Fuzzy Hash: cdb239039f02d4dfd3cc948df1c5d903c3b25a2ddba110b71a2a5f449dce0736
Instruction Fuzzy Hash: 2E11B9B4A197119FCB10EF74C89451EBFE0AF85316F015D2EE8D4C7300E77888858B52

Function 62582FF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 62583104
VirtualProtect.KERNEL32 ref: 62583131

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 62582FA9, 62582FD5, 62583275

Memory Dump Source

Source File: 0000000F.00000002.3060323071.0000000062581000.00000020.00000001.01000000.00000014.sdmp, Offset: 62580000, based on PE: true

Associated: 0000000F.00000002.3060289396.0000000062580000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060357859.0000000062585000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060415459.0000000062588000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.3060526182.000000006258B000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_62580000_exiftool.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: VirtualQuery failed for %d bytes at address %p
API String ID: 1027372294-2206166143
Opcode ID: 9dbf24d2cad9f7e0548895f089a39b6c3aaf6b0a30e297f65cacdbf52a278fd3
Instruction ID: a24e24d9927aad3b8930d68b45f6e140b1d1a98ebf43accd0a738f1eb51b7c54
Opcode Fuzzy Hash: 9dbf24d2cad9f7e0548895f089a39b6c3aaf6b0a30e297f65cacdbf52a278fd3
Instruction Fuzzy Hash: CE718171A05230DFDB30DF28C9A07A97BF5AF86304F168519D8559B354E7FCD8048B92

Function 66E02DDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 66E02E67
LoadLibraryW.KERNEL32 ref: 66E02E87

Strings

msvcrt.dll, xrefs: 66E02E80

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: msvcrt.dll
API String ID: 4133054770-370904613
Opcode ID: fbc53c62911ef0e26d95c6a2eda82685f9593ef903f7c3e38fe74529acd47b88
Instruction ID: 7816353761109362f2c775c313128d7f19a23250ad44852addc01cab2fa647df
Opcode Fuzzy Hash: fbc53c62911ef0e26d95c6a2eda82685f9593ef903f7c3e38fe74529acd47b88
Instruction Fuzzy Hash: 95113870C481794EEB021F34C99D3523BEB5B2234AFA4806AC5944B397D33E997DDB42

Function 6560FDC0 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6560FDDF
free.MSVCRT ref: 6560FE2F
LeaveCriticalSection.KERNEL32 ref: 6560FE3B

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 923cc567d384c90e9df912d3f83a0fb868d3a22751e6220f02b190cb945efed6
Instruction ID: 3f72142c05d61ed4a79d3f48cb3cf10d90058658e3358d01d96bb27b65542f1e
Opcode Fuzzy Hash: 923cc567d384c90e9df912d3f83a0fb868d3a22751e6220f02b190cb945efed6
Instruction Fuzzy Hash: E9012DB1718242CFDB14EF6DD58652AF7F1BB42300B54566DE846CB601EE309894DB8B

Function 66E029A0 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 66E029BF
free.MSVCRT ref: 66E02A0F
LeaveCriticalSection.KERNEL32 ref: 66E02A1B

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: cce8043d78882454185bf69b2cfc922a2eb32c500c396cbfb265b5e0234d64bb
Instruction ID: c7ae2752a1a8fdf7bf0d251ab1518ed4a0c77e3d4a69ed367205a14d29a12630
Opcode Fuzzy Hash: cce8043d78882454185bf69b2cfc922a2eb32c500c396cbfb265b5e0234d64bb
Instruction Fuzzy Hash: F70156B1A04202CFDB04AFA8C98941D77F2BB65304B75456DD5448B309E731D8B8CB83

Function 00406680 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040669F
free.MSVCRT ref: 004066EF
LeaveCriticalSection.KERNEL32 ref: 004066FB

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 2f85f89c717937a2a92506cd46c58605416f24a494bba087bda66e509a0dab7c
Instruction ID: f7729bd7bdd91c77a11e3f5da8bcd6f0acd20ca145f4ee67d748b83ca5bfc628
Opcode Fuzzy Hash: 2f85f89c717937a2a92506cd46c58605416f24a494bba087bda66e509a0dab7c
Instruction Fuzzy Hash: 120179B5A041018FC714FFB8DAC442A77E1BB50300B55897ED44AE7351E73AE86CDB4A

Function 6560FCC0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6560FCCE
TlsGetValue.KERNEL32 ref: 6560FCF5
GetLastError.KERNEL32 ref: 6560FCFC
LeaveCriticalSection.KERNEL32 ref: 6560FD1C

Memory Dump Source

Source File: 0000000F.00000002.3061643668.0000000065601000.00000020.00000001.01000000.00000020.sdmp, Offset: 65600000, based on PE: true

Associated: 0000000F.00000002.3061600473.0000000065600000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061736803.0000000065612000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061841925.0000000065614000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061877534.0000000065615000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 0000000F.00000002.3061931138.0000000065618000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65600000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 08f7eee72a0587fefbf86fec488827ac940ce272b0e2f566b8ec04b710fa1e6e
Instruction ID: 6b4e0cb78266010555c976ec710ca66968e39316bc94ab9ebca71e286a33618c
Opcode Fuzzy Hash: 08f7eee72a0587fefbf86fec488827ac940ce272b0e2f566b8ec04b710fa1e6e
Instruction Fuzzy Hash: 85F0A4726043058FCB20BFADD58AA2AFBB4BA51300B05056DDD458B205EB30E409CBA7

Function 66E028A0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 66E028AE
TlsGetValue.KERNEL32 ref: 66E028D5
GetLastError.KERNEL32 ref: 66E028DC
LeaveCriticalSection.KERNEL32 ref: 66E028FC

Memory Dump Source

Source File: 0000000F.00000002.3062324544.0000000066E01000.00000020.00000001.01000000.00000013.sdmp, Offset: 66E00000, based on PE: true

Associated: 0000000F.00000002.3062289485.0000000066E00000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062360894.0000000066E04000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062398230.0000000066E06000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062452101.0000000066E07000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.3062486500.0000000066E0A000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_66e00000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 9135c8d328b04de1ea59f8b07475247a3c7e6aae53ab07fc814da54d26affc7e
Instruction ID: c4cede838093367333f582e94f7e57a6931798885fa80d114e10a51045af3626
Opcode Fuzzy Hash: 9135c8d328b04de1ea59f8b07475247a3c7e6aae53ab07fc814da54d26affc7e
Instruction Fuzzy Hash: 1BF0A4B59013258FCF007FA8C98951A7BB4AB56314B02042CDE849B308D631B86CCBB3

Function 00406580 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040658E
TlsGetValue.KERNEL32 ref: 004065B5
GetLastError.KERNEL32 ref: 004065BC
LeaveCriticalSection.KERNEL32 ref: 004065DC

Memory Dump Source

Source File: 0000000F.00000002.3055111467.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.3055076942.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055150221.0000000000408000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055188083.000000000040F000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055250866.0000000000412000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.3055287368.0000000000415000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_exiftool.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 3da1134e6aea1b77bcecfc355bed06130d44daaa1426ed471659c86139580766
Instruction ID: 8ac07fedd5371156854e8d27893d5ef6856d5ef0fee36ee71da931a0560e36e7
Opcode Fuzzy Hash: 3da1134e6aea1b77bcecfc355bed06130d44daaa1426ed471659c86139580766
Instruction Fuzzy Hash: 7DF0F4B59003019FC720BFB8EEC440B7BA4EA00310B060179DD89A7359E734F81CCBAA

Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-KONM9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\8b4e2b00.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\bc3918b8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\IO\IO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\MD5\MD5.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Digest\SHA\SHA.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\ielib32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\Piece\Piece.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\mro\mro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-HJO89.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-OMIVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Socket\Socket.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Cwd\Cwd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Bzip2\Bzip2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e8ce9e63.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\DelZip190.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\tools\is-V94I6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\0b174c5f.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\9e2b3cdd.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\e5acedbf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-5LPT9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\30e95417.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\FindFile\FindFile.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Time\HiRes\HiRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\API\API.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\54f7af00.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\GMP\GMP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\a09139d7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Win32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\File\Glob\Glob.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-1BDNO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\tools\consoleStartHelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-B0F3I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\6b9bcbc1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\MIME\Base64\Base64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32\Console\Console.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\List\Util\Util.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\72279688.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Win32API\File\File.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-LEN5V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Math\BigInt\FastCalc\FastCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Fcntl\Fcntl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\re\re.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\GeoSetter\is-P21BL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\7f720997.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\25bbf886.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Encode\Encode.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\POSIX\POSIX.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\exiftool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\par-616c666f6e73\cache-exiftool-10.96\inc\lib\auto\Compress\Raw\Zlib\Zlib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OLKP3.tmp\geosetter_setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BDALQ.tmp\_isetup\_setup64.tmp	Jump to dropped file

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report geosetter_setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\GeoSetter\DelZip190.dll (copy)

C:\Program Files (x86)\GeoSetter\GeoSetter.exe (copy)

C:\Program Files (x86)\GeoSetter\GeoSetterShellExt.dll (copy)

C:\Program Files (x86)\GeoSetter\GeoSetterShellExt64.dll (copy)

C:\Program Files (x86)\GeoSetter\cameras.txt (copy)

C:\Program Files (x86)\GeoSetter\dcrawlib.dll (copy)

C:\Program Files (x86)\GeoSetter\help\GeoSetter-DE.chm (copy)

C:\Program Files (x86)\GeoSetter\help\GeoSetter-EN.chm (copy)

C:\Program Files (x86)\GeoSetter\help\is-0NEIU.tmp

C:\Program Files (x86)\GeoSetter\help\is-UIS00.tmp

C:\Program Files (x86)\GeoSetter\ielib32.dll (copy)

C:\Program Files (x86)\GeoSetter\is-07QKO.tmp

C:\Program Files (x86)\GeoSetter\is-1BDNO.tmp

Windows Analysis Report
geosetter_setup.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre