Edit tour

Windows Analysis Report
pythoninzoo.exe

Overview

General Information

Sample name:	pythoninzoo.exe
Analysis ID:	1429036
MD5:	3a272e96b2a6682a76021561514d1906
SHA1:	69674411cab38710263415b8d710780f3752bded
SHA256:	934cb0e1c647de2ecfac8f33ec578c133e7a8e7b7e83ff476e082aa92d789894
Tags:	exe
Infos:

Detection

Score:	30
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Contains functionality to infect the boot sector

Found pyInstaller with non standard icon

Hides threads from debuggers

Modifies the context of a thread in another process (thread injection)

Uses the Telegram API (likely for C&C communication)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64

pythoninzoo.exe (PID: 6956 cmdline: "C:\Users\user\Desktop\pythoninzoo.exe" MD5: 3A272E96B2A6682A76021561514D1906)

conhost.exe (PID: 6984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pythoninzoo.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\pythoninzoo.exe" MD5: 3A272E96B2A6682A76021561514D1906)

cmd.exe (PID: 6624 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

datura.exe (PID: 352 cmdline: C:\Users\user\AppData\Roaming\datura.exe MD5: D56367A6C7C36AAE95B97492F6C52CFD)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A380F0 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,

3_2_70A380F0

Source: C:\Users\user\AppData\Roaming\datura.exe

Window detected: You can also use the /accepteula command-line switch to accept the EULA.&Agree&Decline&PrintSYSINTERNALS SOFTWARE LICENSE TERMSThese license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Sysinternals.com which includes the media on which you received it if any. The terms also apply to any SysinternalsupdatessupplementsInternet-based services and support servicesfor this software unless other terms accompany those items. If so those terms apply.BY USING THE SOFTWARE YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM DO NOT USE THE SOFTWARE.If you comply with these license terms you have the rights below.1.INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices.2.Scope of License. The software is licensed not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation you may use the software only as expressly permitted in this agreement. In doing so you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may notwork around any technical limitations in the binary versions of the software;reverse engineer decompile or disassemble the binary versions of the software except and only to the extent that applicable law expressly permits despite this limitation;make more copies of the software than specified in this agreement or allowed by applicable law despite this limitation;publish the software for others to copy;rent lease or lend the software;transfer the software or this agreement to any third party; oruse the software for commercial software hosting services.3.SENSITIVE INFORMATION. Please be aware that similar to other debug tools that capture "process state" information files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames passwords paths to files accessed and paths to registry accessed). By using this software you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.. DOCUMENTATION. Any person that has valid access to your computer or internal network may copy and use the documentation for your internal reference purposes.6.Export Restrictions. The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations end users and end use. For additional information see www.microsoft.com/exporting <<http://www.microsoft.com/exporting>>.7.SUPPORT SERVICES. Because this software is "as is "

Source: pythoninzoo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\s\x64\Release\ZoomIt64.pdbH source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, datura.exe, 00000005.00000000.1883024767.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp, datura.exe, 00000005.00000002.3013590578.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1939983079.00007FFDFB06C000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: pythoninzoo.exe, 00000003.00000002.1944446085.00007FFE0CFB9000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: pythoninzoo.exe, 00000003.00000002.1946971554.00007FFE11EBB000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: ucrtbase.pdb source: pythoninzoo.exe, 00000003.00000002.1942403291.00007FFE007E1000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: pythoninzoo.exe, 00000003.00000002.1944446085.00007FFE0CFB9000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\x64\Release\ZoomIt64.pdb source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, datura.exe, 00000005.00000000.1883024767.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp, datura.exe, 00000005.00000002.3013590578.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: pythoninzoo.exe, 00000003.00000002.1941208396.00007FFDFB636000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: pythoninzoo.exe, 00000003.00000002.1940708059.00007FFDFB2D0000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: ~/.pdbrc source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: placed in the .pdbrc file): source: pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935301022.000001DFC9B90000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926769002.000001DFC8718000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930618672.000001DFC871A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928214617.000001DFC871A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927371506.000001DFC871A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928309183.000001DFC935D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb.Pdb source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: pythoninzoo.exe, 00000003.00000002.1944675720.00007FFE0CFD8000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: -c are executed after commands from .pdbrc files. source: pythoninzoo.exe, 00000003.00000003.1925906376.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919850680.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924041290.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924171198.000001DFC90D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: If a file ".pdbrc" exists in your home directory or in the current source: pythoninzoo.exe, 00000003.00000003.1927371506.000001DFC86F2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928214617.000001DFC8717000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: pythoninzoo.exe, 00000003.00000002.1940708059.00007FFDFB352000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: pythoninzoo.exe, 00000003.00000002.1941208396.00007FFDFB636000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: pythoninzoo.exe, 00000003.00000002.1948140537.00007FFE13263000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: pythoninzoo.exe, 00000003.00000002.1940708059.00007FFDFB2D0000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: Initial commands are read from .pdbrc files in your home directory source: pythoninzoo.exe, 00000003.00000003.1925906376.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919850680.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924041290.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924171198.000001DFC90D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: pythoninzoo.exe, 00000003.00000002.1949346591.00007FFE1A461000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: pythoninzoo.exe, 00000003.00000002.1948775674.00007FFE13310000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: pythoninzoo.exe, 00000003.00000002.1945800720.00007FFE101D6000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: .pdbrc source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: pythoninzoo.exe, 00000003.00000002.1947571271.00007FFE130C2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: pythoninzoo.exe, 00000003.00000002.1941583552.00007FFDFB9AF000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pythoninzoo.exe, 00000003.00000002.1945630544.00007FFE0EB52000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: pythoninzoo.exe, 00000003.00000002.1947846047.00007FFE13203000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: pythoninzoo.exe, 00000003.00000002.1946971554.00007FFE11EBB000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: pythoninzoo.exe, 00000003.00000002.1948475852.00007FFE1327D000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: pythoninzoo.exe, 00000003.00000002.1942403291.00007FFE007E1000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: pythoninzoo.exe, 00000003.00000002.1946732609.00007FFE11518000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: pythoninzoo.exe, 00000003.00000002.1929716969.000001DFC7E90000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: The standard debugger class (pdb.Pdb) is an example. source: pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921089848.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1880054148.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933995857.000001DFC934B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: pythoninzoo.exe, 00000003.00000002.1945048742.00007FFE0E16D000.00000002.00000001.01000000.00000014.sdmp

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E7E20 FindFirstFileExW,FindClose,		0_2_00007FF7AA3E7E20
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF2CE40 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		5_2_00007FF6DCF2CE40

Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI69562\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 4x nop then push rbp		3_2_70A2BD40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 4x nop then push rbp		3_2_70A2BD40

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json?fields=proxy,hosting HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: pythoninzoo.exe, 00000000.00000003.1753271709.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753856959.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753504722.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753009682.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935574417.000001DFC9BB3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918926912.000001DFC9BD1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925012511.000001DFC9BD3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925463465.000001DFC93A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926540406.000001DFC871F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899977584.000001DFC93A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: pythoninzoo.exe, 00000003.00000003.1924642808.000001DFC8A11000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919411917.000001DFC89CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931330864.000001DFC8A12000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920163901.000001DFC89E6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920124971.000001DFC89E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: pythoninzoo.exe, 00000003.00000002.1930268012.000001DFC86B2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900811070.000001DFC9E6C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902716179.000001DFC9E5D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: pythoninzoo.exe, 00000003.00000003.1927512906.000001DFC90C0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918407600.000001DFC90B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: pythoninzoo.exe, 00000003.00000003.1919210390.000001DFC9283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900811070.000001DFC9E6C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902716179.000001DFC9E5D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931367434.000001DFC8A39000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899824490.000001DFC8A2A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926800506.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920896614.000001DFC8A39000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933879358.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: pythoninzoo.exe, 00000003.00000003.1923705756.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919620119.000001DFC90E6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926800506.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933879358.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: pythoninzoo.exe, 00000003.00000003.1927512906.000001DFC90C0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918407600.000001DFC90B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: pythoninzoo.exe, 00000000.00000003.1753271709.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918926912.000001DFC9BD1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925012511.000001DFC9BD3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926540406.000001DFC871F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: pythoninzoo.exe, 00000003.00000003.1899824490.000001DFC8A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/p
Source: pythoninzoo.exe, 00000000.00000003.1753009682.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925463465.000001DFC93A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899977584.000001DFC93A3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: pythoninzoo.exe, 00000000.00000003.1753504722.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935574417.000001DFC9BB3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926540406.000001DFC871F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: pythoninzoo.exe, 00000000.00000003.1753703727.0000018E4F4A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753190200.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1752944055.0000018E4F4A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753395247.0000018E4F4A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753129605.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1934830733.000001DFC9820000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926672458.000001DFC9231000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923543891.000001DFC91F4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927371506.000001DFC8723000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926630166.000001DFC91F8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: pythoninzoo.exe, 00000003.00000002.1934730381.000001DFC96F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925845532.000001DFC9333000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933958105.000001DFC933D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927613831.000001DFC933A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: pythoninzoo.exe, 00000003.00000002.1931870910.000001DFC8C90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://github.com/ActiveState/appdirs
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: pythoninzoo.exe, 00000000.00000003.1856572026.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924007974.000001DFC913B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: pythoninzoo.exe, 00000003.00000003.1918699200.000001DFC9031000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923823116.000001DFC903E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: pythoninzoo.exe, 00000003.00000002.1931185481.000001DFC89C5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932705062.000001DFC90B1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918511685.000001DFC90A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918478827.000001DFC908A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921001293.000001DFC89B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json?fields=proxy
Source: pythoninzoo.exe, 00000003.00000002.1931972206.000001DFC8DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.est
Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930867439.000001DFC8870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924007974.000001DFC913B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931417171.000001DFC8A7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: pythoninzoo.exe, 00000003.00000002.1931417171.000001DFC8A7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/oW
Source: pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921089848.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tip.tcl.tk/48)
Source: pythoninzoo.exe, 00000000.00000003.1753785034.0000018E4F4A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933117684.000001DFC919F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924737883.000001DFC9198000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925096729.000001DFC9199000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921089848.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928341451.000001DFC919E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9B24000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1936573675.000001DFCA350000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: pythoninzoo.exe, 00000000.00000003.1753597140.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925845532.000001DFC9333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: pythoninzoo.exe, 00000003.00000003.1902033058.000001DFC9E2B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: pythoninzoo.exe, 00000003.00000002.1930268012.000001DFC86B2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930268012.000001DFC86B2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930297941.000001DFC86B6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920265031.000001DFC86B5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918032438.000001DFC9E5B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902884582.000001DFC9E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: pythoninzoo.exe, 00000000.00000003.1753856959.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: pythoninzoo.exe, 00000003.00000003.1917888008.000001DFC923B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918782905.000001DFC9294000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933714517.000001DFC9295000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925561488.000001DFC9295000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900991400.000001DFC9E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: pythoninzoo.exe, 00000003.00000002.1932705062.000001DFC90B1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918511685.000001DFC90A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918478827.000001DFC908A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: pythoninzoo.exe, 00000003.00000002.1931564827.000001DFC8AE1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1922408350.000001DFC8ADA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC911B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: pythoninzoo.exe, 00000003.00000002.1931564827.000001DFC8AE1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1922408350.000001DFC8ADA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cpsT
Source: pythoninzoo.exe, 00000000.00000003.1753597140.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925845532.000001DFC9333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91B0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921187056.000001DFC91C6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926836010.000001DFC91CD000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918564995.000001DFC91B7000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925205894.000001DFC91C6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918647157.000001DFC91C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: pythoninzoo.exe, 00000003.00000002.1936573675.000001DFCA3B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6817203487:AAGfQMFh4-TS-WgVyG93ZurdbvwMY8HRyjI/
Source: pythoninzoo.exe, 00000003.00000002.1936573675.000001DFCA3B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6817203487:AAGfQMFh4-TS-WgVyG93ZurdbvwMY8HRyjI/0~
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1937230172.000001DFCAE18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6817203487:AAGfQMFh4-TS-WgVyG93ZurdbvwMY8HRyjI/sendPhoto
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1937230172.000001DFCAE18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6817203487:AAGfQMFh4-TS-WgVyG93ZurdbvwMY8HRyjI/sendPhotoPIn
Source: pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917888008.000001DFC923B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927037781.000001DFC9288000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919210390.000001DFC9283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932179748.000001DFC8FB0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931151486.000001DFC89A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923662576.000001DFC89A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/re.html
Source: pythoninzoo.exe, 00000003.00000002.1930764288.000001DFC8750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: pythoninzoo.exe, 00000003.00000003.1924773257.000001DFC9195000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925096729.000001DFC9196000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc2.0.dr	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861765801.000001DFC7D94000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: pythoninzoo.exe, 00000003.00000002.1931972206.000001DFC8DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: pythoninzoo.exe, 00000003.00000002.1931972206.000001DFC8DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packagingI69562pQ
Source: pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: pythoninzoo.exe, 00000003.00000002.1934730381.000001DFC96F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: pythoninzoo.exe, 00000003.00000002.1929885448.000001DFC8210000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861765801.000001DFC7D94000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861765801.000001DFC7D94000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: pythoninzoo.exe, 00000003.00000003.1918699200.000001DFC9031000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932305763.000001DFC9031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920X
Source: pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919985976.000001DFC8667000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923617347.000001DFC8731000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930222162.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: pythoninzoo.exe, 00000003.00000003.1926994327.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921944461.000001DFC91AF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919985976.000001DFC8667000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930222162.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: pythoninzoo.exe, 00000003.00000002.1933027166.000001DFC9163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: pythoninzoo.exe, 00000003.00000003.1924737883.000001DFC9198000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: pythoninzoo.exe, 00000003.00000003.1923617347.000001DFC8731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: pythoninzoo.exe, 00000003.00000002.1934730381.000001DFC96F0000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC91B8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924869561.000001DFC91B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: pythoninzoo.exe, 00000003.00000003.1879959611.000001DFC8A49000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919805600.000001DFC8B0B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920293887.000001DFC8B1D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881758437.000001DFC8AD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931718442.000001DFC8B30000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926578613.000001DFC8B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: pythoninzoo.exe, 00000003.00000003.1920505105.000001DFC9085000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924171198.000001DFC90D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91B0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918564995.000001DFC91B7000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918647157.000001DFC91C3000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr	String found in binary or memory: https://mahler:8092/site-updates.py
Source: pythoninzoo.exe, 00000003.00000002.1936573675.000001DFCA350000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mouseinfo.readthedocs.io
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: pythoninzoo.exe, 00000003.00000002.1941583552.00007FFDFB9AF000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: pythoninzoo.exe, 00000003.00000002.1934830733.000001DFC9820000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1879959611.000001DFC8A49000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919805600.000001DFC8B0B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920293887.000001DFC8B1D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881758437.000001DFC8AD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931718442.000001DFC8B30000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926578613.000001DFC8B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: pythoninzoo.exe, 00000003.00000002.1934830733.000001DFC9820000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioP?
Source: pythoninzoo.exe, 00000003.00000003.1924297982.000001DFC8999000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: pythoninzoo.exe, 00000003.00000002.1936690289.000001DFCA5C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/a/20982715/185510
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931151486.000001DFC89A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923662576.000001DFC89A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: pythoninzoo.exe, 00000003.00000003.1923705756.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919620119.000001DFC90E6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: pythoninzoo.exe, 00000000.00000003.1753009682.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925463465.000001DFC93A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899977584.000001DFC93A3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: pythoninzoo.exe, 00000000.00000003.1753856959.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: pythoninzoo.exe, 00000003.00000003.1924773257.000001DFC9195000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925096729.000001DFC9196000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923617347.000001DFC8731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyp
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings0yS
Source: pythoninzoo.exe, 00000000.00000003.1856572026.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918926912.000001DFC9BD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: pythoninzoo.exe, 00000003.00000003.1926961733.000001DFC9BCE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935689526.000001DFC9BCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.archive.org/web/20240227115053/https://exiv2.org/tags.html)
Source: pythoninzoo.exe, 00000003.00000002.1929373500.000001DFC6456000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927744277.000001DFC644F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: pythoninzoo.exe, 00000000.00000003.1850420095.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: pythoninzoo.exe, 00000003.00000002.1940963084.00007FFDFB3C9000.00000002.00000001.01000000.00000016.sdmp, pythoninzoo.exe, 00000003.00000002.1941287026.00007FFDFB66B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: pythoninzoo.exe, 00000003.00000003.1879959611.000001DFC8A49000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919805600.000001DFC8B0B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920293887.000001DFC8B1D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881758437.000001DFC8AD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931718442.000001DFC8B30000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926578613.000001DFC8B2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91B0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918564995.000001DFC91B7000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918647157.000001DFC91C3000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr	String found in binary or memory: https://www.python.org/
Source: pythoninzoo.exe, 00000003.00000002.1930867439.000001DFC8870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: pythoninzoo.exe, 00000003.00000002.1929885448.000001DFC8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, datura.exe, datura.exe, 00000005.00000000.1883101790.00007FF6DCF9A000.00000002.00000001.01000000.00000031.sdmp, datura.exe, 00000005.00000002.3012228835.000001CE25913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.com
Source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.com0
Source: datura.exe, 00000005.00000002.3012228835.000001CE25913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.comz
Source: pythoninzoo.exe, 00000000.00000003.1752577288.0000018E4F4A5000.00000004.00000020.00020000.00000000.sdmp, _EKSBlowfish.pyc.0.dr	String found in binary or memory: https://www.usenix.org/legacy/events/usenix99/provos/provos_html/node4.html
Source: pythoninzoo.exe, 00000003.00000003.1902033058.000001DFC9E2B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902716179.000001DFC9E5D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: pythoninzoo.exe, 00000003.00000003.1926994327.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921944461.000001DFC91AF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919985976.000001DFC8667000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930222162.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_00007FFDFAC376E0 SendMessageW,ClientToScreen,WindowFromPoint,OpenClipboard,GetClipboardOwner,CloseClipboard,

3_2_00007FFDFAC376E0

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC62AD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_00007FFDFAC62AD0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC18C00 GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,	3_2_00007FFDFAC18C00
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF9AF0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,GlobalFree,CloseClipboard,GlobalUnlock,SetClipboardData,CloseClipboard,	5_2_00007FF6DCEF9AF0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF174A6 _invalid_parameter_noinfo_noreturn,SwitchToThread,SwitchToThread,SwitchToThread,GetCursorPos,MonitorFromPoint,SwitchToThread,SwitchToThread,SendMessageW,SHGetKnownFolderItem,GetLastError,CoTaskMemFree,SetLastError,_invalid_parameter_noinfo_noreturn,CoTaskMemFree,SwitchToThread,_invalid_parameter_noinfo_noreturn,SwitchToThread,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CoTaskMemFree,SwitchToThread,SwitchToThread,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,GlobalFree,SendMessageW,SwitchToThread,_invalid_parameter_noinfo_noreturn,	5_2_00007FF6DCF174A6
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF1A3F2 SwitchToThread,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,GlobalFree,SendMessageW,_invalid_parameter_noinfo_noreturn,	5_2_00007FF6DCF1A3F2

Source: C:\Users\user\AppData\Roaming\datura.exe

Code function: 5_2_00007FF6DCEF7C90 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,

5_2_00007FF6DCEF7C90

Source: C:\Users\user\AppData\Roaming\datura.exe

Code function: 5_2_00007FF6DCF0D910 BeginPaint,SetStretchBltMode,StretchBlt,EndPaint,GetSysColorBrush,FillRect,GetObjectW,SetStretchBltMode,StretchBlt,BitBlt,DrawTextW,SelectObject,DrawTextW,SelectObject,DrawTextW,SelectObject,DrawTextW,SelectObject,BitBlt,EndPaint,PostMessageW,PostQuitMessage,GetStockObject,GetObjectW,CreateCompatibleDC,GetDeviceCaps,MulDiv,DeleteDC,SendMessageW,RegisterHotKey,MessageBoxW,RegisterHotKey,MessageBoxW,RegisterHotKey,RegisterHotKey,RegisterHotKey,RegisterHotKey,RegisterHotKey,RegisterHotKey,RegisterHotKey,RegisterHotKey,RegisterHotKey,MessageBoxW,SendMessageW,GetCurrentThread,SetThreadPriority,RegisterWindowMessageW,KillTimer,KillTimer,SetCursorPos,GetCursorPos,SetCursorPos,SendMessageW,SetCursorPos,SetWindowPos,DeleteObject,DeleteDC,SendMessageW,SetForegroundWindow,ClipCursor,SystemParametersInfoW,DeleteObject,DeleteDC,DeleteDC,DeleteDC,DeleteDC,DeleteObject,DeleteObject,DeleteObject,DeleteObject,SetFocus,ShowWindow,InvalidateRect,InvalidateRect,PlaySoundW,SendMessageW,SendMessageW,CreateDCW,GetCursorPos,SendMessageW,PostMessageW,DeleteObject,DeleteDC,GdipAlloc,GdipCreateBitmapFromFile,GdipCreateHBITMAPFromBitmap,SendMessageW,GetLastError,CreateCompatibleDC,SelectObject,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateSolidBrush,FillRect,AlphaBlend,SelectObject,DeleteDC,DeleteObject,ReleaseDC,CreateCompatibleDC,SelectObject,CreateFontIndirectW,CreateFontIndirectW,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateBitmap,SelectObject,SetTextColor,SetBkMode,SelectObject,SendMessageW,SetTimer,BringWindowToTop,SetForegroundWindow,SetActiveWindow,SetWindowPos,PostMessageW,DialogBoxParamW,Shell_NotifyIconW,DestroyWindow,DestroyWindow,GetCursorPos,SetCursorPos,DestroyWindow,GetClipCursor,ClipCursor,GetSaveFileNameW,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SetStretchBltMode,StretchBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,GetLastError,GdipDisposeImage,DeleteDC,SetCursorPos,ClipCursor,GetCursorPos,DestroyWindow,SetCursorPos,DestroyWindow,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SetStretchBltMode,StretchBlt,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,DeleteDC,SendMessageW,GetAsyncKeyState,GetAsyncKeyState,DeleteObject,CreateFontIndirectW,SelectObject,BitBlt,DrawTextW,BitBlt,DrawTextW,BitBlt,InvalidateRect,SendMessageW,SetROP2,CreatePen,SelectObject,SelectObject,DeleteObject,SetRect,SetRect,SetRect,SetROP2,GdipCreateFromHDC,GdipSetSmoothingMode,GdipCreatePen1,GdipSetPenLineCap197819,GdipBitmapUnlockBits,InvalidateRect,CreateDIBSection,CreateCompatibleDC,SelectObject,BitBlt,CreateDIBSection,GetLastError,CreateCompatibleDC,SelectObject,BitBlt,BitBlt,DeleteObject,DeleteDC,SelectObject,DeleteObject,DeleteDC,InvalidateRect,GdipDrawLineI,GdipDeletePen,GdipDeleteGraphics,InvalidateRect,InvalidateRect,BitBlt,BitBlt,DrawTextW,DrawTextW,DrawTextW,InvalidateRect,PostMessageW,Sleep,SetForegroundWindow,GetCursorPos,CreatePopupMenu,Ins

5_2_00007FF6DCF0D910

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_00007FFDFAC27B00 ClientToScreen,GetSystemMetrics,GetAsyncKeyState,GetAsyncKeyState,TrackPopupMenu,GetCursorPos,WindowFromPoint,

3_2_00007FFDFAC27B00

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC2BB70 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		3_2_00007FFDFAC2BB70
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF17320 GetKeyState,GetKeyState,GetKeyState,SetMessageExtraInfo,SendMessageW,		5_2_00007FF6DCF17320

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A97091: DeviceIoControl,

3_2_70A97091

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E68E0	0_2_00007FF7AA3E68E0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EA29E	0_2_00007FF7AA3EA29E
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E7F80	0_2_00007FF7AA3E7F80
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EA34F	0_2_00007FF7AA3EA34F
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EDFB0	0_2_00007FF7AA3EDFB0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EA3C3	0_2_00007FF7AA3EA3C3
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EA3D2	0_2_00007FF7AA3EA3D2
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3ECC70	0_2_00007FF7AA3ECC70
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E90C0	0_2_00007FF7AA3E90C0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E8520	0_2_00007FF7AA3E8520
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3F45BB	0_2_00007FF7AA3F45BB
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EC650	0_2_00007FF7AA3EC650
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3EA305	0_2_00007FF7AA3EA305
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A0E6F0	3_2_70A0E6F0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A0A7B0	3_2_70A0A7B0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6FFB0	3_2_70A6FFB0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A0F7C0	3_2_70A0F7C0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3A0A0	3_2_70A3A0A0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3D800	3_2_70A3D800
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3E860	3_2_70A3E860
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A77190	3_2_70A77190
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A27110	3_2_70A27110
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3B110	3_2_70A3B110
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A7D910	3_2_70A7D910
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A23940	3_2_70A23940
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A5E140	3_2_70A5E140
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A43950	3_2_70A43950
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6E150	3_2_70A6E150
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A35AF0	3_2_70A35AF0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A0F220	3_2_70A0F220
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A38270	3_2_70A38270
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A36250	3_2_70A36250
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A013E0	3_2_70A013E0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6C330	3_2_70A6C330
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3D310	3_2_70A3D310
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A22360	3_2_70A22360
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A57370	3_2_70A57370
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6BB70	3_2_70A6BB70
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3EC80	3_2_70A3EC80
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A34C20	3_2_70A34C20
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6CC15	3_2_70A6CC15
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A24DA0	3_2_70A24DA0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A265B0	3_2_70A265B0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A965E0	3_2_70A965E0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A7DDF0	3_2_70A7DDF0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A38DC0	3_2_70A38DC0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6EDC0	3_2_70A6EDC0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A7E510	3_2_70A7E510
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A31570	3_2_70A31570
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A22540	3_2_70A22540
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A2BD40	3_2_70A2BD40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A41D40	3_2_70A41D40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3B550	3_2_70A3B550
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A436D0	3_2_70A436D0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A07E20	3_2_70A07E20
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A31E30	3_2_70A31E30
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A6D630	3_2_70A6D630
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A29E70	3_2_70A29E70
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A18E40	3_2_70A18E40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A56FE2	3_2_70A56FE2
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A3CF20	3_2_70A3CF20
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A36F00	3_2_70A36F00
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A40700	3_2_70A40700
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A26F70	3_2_70A26F70
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC25B20	3_2_00007FFDFAC25B20
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAD0BA60	3_2_00007FFDFAD0BA60
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACCDC40	3_2_00007FFDFACCDC40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACBDBF0	3_2_00007FFDFACBDBF0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC8BBE0	3_2_00007FFDFAC8BBE0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACB9BB0	3_2_00007FFDFACB9BB0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC95BB0	3_2_00007FFDFAC95BB0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC91BD0	3_2_00007FFDFAC91BD0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC9B880	3_2_00007FFDFAC9B880
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC1D9A0	3_2_00007FFDFAC1D9A0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC379C0	3_2_00007FFDFAC379C0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC9FEE0	3_2_00007FFDFAC9FEE0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC53EB0	3_2_00007FFDFAC53EB0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACFDED0	3_2_00007FFDFACFDED0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC93E60	3_2_00007FFDFAC93E60
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC75E90	3_2_00007FFDFAC75E90
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC59E80	3_2_00007FFDFAC59E80
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC8BD30	3_2_00007FFDFAC8BD30
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC13D20	3_2_00007FFDFAC13D20
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC85D50	3_2_00007FFDFAC85D50
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF7D10	3_2_00007FFDFACF7D10
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC1DD00	3_2_00007FFDFAC1DD00
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC97CA0	3_2_00007FFDFAC97CA0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC89C60	3_2_00007FFDFAC89C60
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACCFE10	3_2_00007FFDFACCFE10
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACFBDD0	3_2_00007FFDFACFBDD0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACEF300	3_2_00007FFDFACEF300
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF9427	3_2_00007FFDFACF9427
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACA1420	3_2_00007FFDFACA1420
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF941E	3_2_00007FFDFACF941E
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF9417	3_2_00007FFDFACF9417
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF940B	3_2_00007FFDFACF940B
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF9404	3_2_00007FFDFACF9404
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACC53D0	3_2_00007FFDFACC53D0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC25380	3_2_00007FFDFAC25380
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACF70F0	3_2_00007FFDFACF70F0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC110E0	3_2_00007FFDFAC110E0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC910E0	3_2_00007FFDFAC910E0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACE91F0	3_2_00007FFDFACE91F0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACE71B0	3_2_00007FFDFACE71B0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC31180	3_2_00007FFDFAC31180
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC6B720	3_2_00007FFDFAC6B720
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACCD6F0	3_2_00007FFDFACCD6F0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC3D6D0	3_2_00007FFDFAC3D6D0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACE36D0	3_2_00007FFDFACE36D0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACD14C0	3_2_00007FFDFACD14C0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC81480	3_2_00007FFDFAC81480
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACD7600	3_2_00007FFDFACD7600
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACC0B40	3_2_00007FFDFACC0B40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACCCB40	3_2_00007FFDFACCCB40
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACC4A60	3_2_00007FFDFACC4A60
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC1AC50	3_2_00007FFDFAC1AC50
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC22C00	3_2_00007FFDFAC22C00
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACBEB80	3_2_00007FFDFACBEB80
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACD48F0	3_2_00007FFDFACD48F0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFACD68E0	3_2_00007FFDFACD68E0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC328B0	3_2_00007FFDFAC328B0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAC768A0	3_2_00007FFDFAC768A0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF08E30	5_2_00007FF6DCF08E30
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF14A00	5_2_00007FF6DCF14A00
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF1AD20	5_2_00007FF6DCF1AD20
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0D910	5_2_00007FF6DCF0D910
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF232C0	5_2_00007FF6DCF232C0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF2CE40	5_2_00007FF6DCF2CE40
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF35EE4	5_2_00007FF6DCF35EE4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF36EE8	5_2_00007FF6DCF36EE8
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF06D70	5_2_00007FF6DCF06D70
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF44D3C	5_2_00007FF6DCF44D3C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF3ED40	5_2_00007FF6DCF3ED40
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF45D7C	5_2_00007FF6DCF45D7C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF8EE0	5_2_00007FF6DCEF8EE0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF3CE0C	5_2_00007FF6DCF3CE0C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF4B04C	5_2_00007FF6DCF4B04C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF00FF0	5_2_00007FF6DCF00FF0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF360E8	5_2_00007FF6DCF360E8
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF8120	5_2_00007FF6DCEF8120
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF60B0	5_2_00007FF6DCEF60B0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF57FC4	5_2_00007FF6DCF57FC4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF39010	5_2_00007FF6DCF39010
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0BA90	5_2_00007FF6DCF0BA90
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF35AD4	5_2_00007FF6DCF35AD4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF12AF9	5_2_00007FF6DCF12AF9
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0CB00	5_2_00007FF6DCF0CB00
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEE1C00	5_2_00007FF6DCEE1C00
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF4A9CC	5_2_00007FF6DCF4A9CC
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF13A09	5_2_00007FF6DCF13A09
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF43A2C	5_2_00007FF6DCF43A2C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF11C37	5_2_00007FF6DCF11C37
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF9BD0	5_2_00007FF6DCEF9BD0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF35CD8	5_2_00007FF6DCF35CD8
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0AB50	5_2_00007FF6DCF0AB50
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF23BC0	5_2_00007FF6DCF23BC0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF38C0C	5_2_00007FF6DCF38C0C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF07C40	5_2_00007FF6DCF07C40
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF11652	5_2_00007FF6DCF11652
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0A660	5_2_00007FF6DCF0A660
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEEE5D0	5_2_00007FF6DCEEE5D0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF356C4	5_2_00007FF6DCF356C4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF2550	5_2_00007FF6DCEF2550
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF47724	5_2_00007FF6DCF47724
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF4A538	5_2_00007FF6DCF4A538
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF485F4	5_2_00007FF6DCF485F4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF5561C	5_2_00007FF6DCF5561C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0B620	5_2_00007FF6DCF0B620
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEE1C00	5_2_00007FF6DCEE1C00
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF017E0	5_2_00007FF6DCF017E0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEE57B0	5_2_00007FF6DCEE57B0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF358C8	5_2_00007FF6DCF358C8
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEEA790	5_2_00007FF6DCEEA790
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF3C900	5_2_00007FF6DCF3C900
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF507B0	5_2_00007FF6DCF507B0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF387D4	5_2_00007FF6DCF387D4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF0880	5_2_00007FF6DCEF0880
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF37280	5_2_00007FF6DCF37280
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF7140	5_2_00007FF6DCEF7140
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF0A1D0	5_2_00007FF6DCF0A1D0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEE1270	5_2_00007FF6DCEE1270
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF174A6	5_2_00007FF6DCF174A6
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF394D4	5_2_00007FF6DCF394D4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEF0390	5_2_00007FF6DCEF0390
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF58510	5_2_00007FF6DCF58510
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF13531	5_2_00007FF6DCF13531
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF1237D	5_2_00007FF6DCF1237D
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCEEF4C0	5_2_00007FF6DCEEF4C0

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: String function: 70A04230 appears 238 times
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: String function: 70A2D400 appears 325 times
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: String function: 70A96CA0 appears 192 times
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: String function: 70A96730 appears 31 times
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: String function: 00007FF7AA3E21D0 appears 44 times
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: String function: 00007FF6DCEEC280 appears 35 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe	Binary or memory string: OriginalFilename vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: OriginalFilenametk86.dllP vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1945957294.00007FFE101DE000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZoomIt.exeH vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1945195776.00007FFE0E185000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1942101406.00007FFDFBAB8000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1939873128.00007FFDFAF48000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: OriginalFilenametcl86.dllP vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1946867809.00007FFE11522000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1945700282.00007FFE0EB5D000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1940963084.00007FFDFB3C9000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1947077028.00007FFE11EC4000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1944576768.00007FFE0CFCA000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1940229043.00007FFDFB071000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZoomIt.exeH vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZoomIt.exeH vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1944742287.00007FFE0CFDE000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilename_tkinter.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1941287026.00007FFDFB66B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenamelibsslH vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1942480145.00007FFE0081C000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1948290407.00007FFE13266000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1948567256.00007FFE13282000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZoomIt.exeH vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1948862224.00007FFE1331D000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1949493285.00007FFE1A467000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1947663483.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1947992490.00007FFE13206000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs pythoninzoo.exe
Source: pythoninzoo.exe, 00000003.00000002.1929716969.000001DFC7E90000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs pythoninzoo.exe

Source: classification engine

Classification label: sus30.troj.evad.winEXE@8/1027@2/2

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 0_2_00007FF7AA3E7760 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7AA3E7760

Source: C:\Users\user\AppData\Roaming\datura.exe

Code function: 5_2_00007FF6DCEECC80 CoCreateInstance,

5_2_00007FF6DCEECC80

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_00007FFDFAC17D20 GetModuleHandleW,FindResourceW,LoadResource,LockResource,memcpy,

3_2_00007FFDFAC17D20

Source: C:\Users\user\Desktop\pythoninzoo.exe

File created: C:\Users\user\AppData\Roaming\datura.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_03

Source: C:\Users\user\Desktop\pythoninzoo.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI69562

Jump to behavior

Source: pythoninzoo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\datura.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pythoninzoo.exe	String found in binary or memory: -startline must be less than or equal to -endline
Source: pythoninzoo.exe	String found in binary or memory: -help

Source: C:\Users\user\Desktop\pythoninzoo.exe

File read: C:\Users\user\Desktop\pythoninzoo.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pythoninzoo.exe "C:\Users\user\Desktop\pythoninzoo.exe"
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Users\user\Desktop\pythoninzoo.exe "C:\Users\user\Desktop\pythoninzoo.exe"
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Users\user\AppData\Roaming\datura.exe C:\Users\user\AppData\Roaming\datura.exe
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Users\user\Desktop\pythoninzoo.exe "C:\Users\user\Desktop\pythoninzoo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Users\user\AppData\Roaming\datura.exe C:\Users\user\AppData\Roaming\datura.exe	Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: tcl86t.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: tk86t.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: windows.devices.enumeration.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: ddores.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Section loaded: defaultdevicemanager.dll	Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: C:\Users\user\AppData\Roaming\datura.exe

Window found: window name: RICHEDIT

Jump to behavior

Source: C:\Users\user\AppData\Roaming\datura.exe	Automated click: Agree
Source: C:\Users\user\AppData\Roaming\datura.exe	Automated click: OK

Source: C:\Users\user\AppData\Roaming\datura.exe

File opened: C:\Windows\SYSTEM32\Riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\datura.exe

Window detected: Number of UI elements: 17

Source: pythoninzoo.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: pythoninzoo.exe

Static file information: File size 19067264 > 1048576

Source: pythoninzoo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pythoninzoo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pythoninzoo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pythoninzoo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pythoninzoo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pythoninzoo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pythoninzoo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: pythoninzoo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\s\x64\Release\ZoomIt64.pdbH source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, datura.exe, 00000005.00000000.1883024767.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp, datura.exe, 00000005.00000002.3013590578.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: pythoninzoo.exe, 00000000.00000003.1855380552.0000018E4F4D8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1939983079.00007FFDFB06C000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: pythoninzoo.exe, 00000003.00000002.1944446085.00007FFE0CFB9000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: pythoninzoo.exe, 00000003.00000002.1946971554.00007FFE11EBB000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: ucrtbase.pdb source: pythoninzoo.exe, 00000003.00000002.1942403291.00007FFE007E1000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: pythoninzoo.exe, 00000003.00000002.1944446085.00007FFE0CFB9000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\x64\Release\ZoomIt64.pdb source: pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, datura.exe, 00000005.00000000.1883024767.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp, datura.exe, 00000005.00000002.3013590578.00007FF6DCF61000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: pythoninzoo.exe, 00000003.00000002.1941208396.00007FFDFB636000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: pythoninzoo.exe, 00000003.00000002.1940708059.00007FFDFB2D0000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: ~/.pdbrc source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: placed in the .pdbrc file): source: pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935301022.000001DFC9B90000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926769002.000001DFC8718000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930618672.000001DFC871A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928214617.000001DFC871A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927371506.000001DFC871A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928309183.000001DFC935D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb.Pdb source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: pythoninzoo.exe, 00000003.00000002.1944675720.00007FFE0CFD8000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: -c are executed after commands from .pdbrc files. source: pythoninzoo.exe, 00000003.00000003.1925906376.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919850680.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924041290.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924171198.000001DFC90D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: If a file ".pdbrc" exists in your home directory or in the current source: pythoninzoo.exe, 00000003.00000003.1927371506.000001DFC86F2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928214617.000001DFC8717000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: pythoninzoo.exe, 00000003.00000002.1940708059.00007FFDFB352000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: pythoninzoo.exe, 00000003.00000002.1941208396.00007FFDFB636000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: pythoninzoo.exe, 00000003.00000002.1948140537.00007FFE13263000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: pythoninzoo.exe, 00000003.00000002.1940708059.00007FFDFB2D0000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: Initial commands are read from .pdbrc files in your home directory source: pythoninzoo.exe, 00000003.00000003.1925906376.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919850680.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90D4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924041290.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924171198.000001DFC90D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: pythoninzoo.exe, 00000003.00000002.1949346591.00007FFE1A461000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: pythoninzoo.exe, 00000003.00000002.1948775674.00007FFE13310000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: pythoninzoo.exe, 00000003.00000002.1945800720.00007FFE101D6000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: .pdbrc source: pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: pythoninzoo.exe, 00000003.00000002.1947571271.00007FFE130C2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: pythoninzoo.exe, 00000003.00000002.1941583552.00007FFDFB9AF000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pythoninzoo.exe, 00000003.00000002.1945630544.00007FFE0EB52000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: pythoninzoo.exe, 00000003.00000002.1947846047.00007FFE13203000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: pythoninzoo.exe, 00000003.00000002.1946971554.00007FFE11EBB000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: pythoninzoo.exe, 00000003.00000002.1948475852.00007FFE1327D000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: pythoninzoo.exe, 00000003.00000002.1942403291.00007FFE007E1000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: pythoninzoo.exe, 00000003.00000002.1946732609.00007FFE11518000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: pythoninzoo.exe, 00000003.00000002.1929716969.000001DFC7E90000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: The standard debugger class (pdb.Pdb) is an example. source: pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921089848.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1880054148.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933995857.000001DFC934B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: pythoninzoo.exe, 00000003.00000002.1945048742.00007FFE0E16D000.00000002.00000001.01000000.00000014.sdmp

Source: pythoninzoo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pythoninzoo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pythoninzoo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pythoninzoo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pythoninzoo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: api-ms-win-core-handle-l1-1-0.dll.0.dr

Static PE information: 0xEE6248C8 [Tue Sep 25 13:36:08 2096 UTC]

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext,

3_2_70A70C90

Source: pythoninzoo.exe	Static PE information: section name: .buildid
Source: datura.exe.3.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D4AEE push 6FFDC5D5h; iretd	3_2_00007FFDFA9D4AF4
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D7425 push 60F5C5F1h; iretd	3_2_00007FFDFA9D742D
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D7983 push 6FFDC5CAh; ret	3_2_00007FFDFA9D7989
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D79CF push 6FFDC5C3h; iretd	3_2_00007FFDFA9D79D5
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D76D3 push 6FFDC5D5h; iretd	3_2_00007FFDFA9D76D9
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D4FEA push 6FFDC5C3h; iretd	3_2_00007FFDFA9D4FF0
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D4F9E push 6FFDC5CAh; ret	3_2_00007FFDFA9D4FA4
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFA9D4640 push 60F5C5F1h; iretd	3_2_00007FFDFA9D4648

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		3_2_70A22B90
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		3_2_70A227E0

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\pythoninzoo.exe

Process created: "C:\Users\user\Desktop\pythoninzoo.exe"

Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Roaming\datura.exe	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		3_2_70A22B90
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		3_2_70A227E0

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 0_2_00007FF7AA3E4480 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7AA3E4480

Source: C:\Users\user\AppData\Roaming\datura.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\datura.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\pythoninzoo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\pythoninzoo.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-10522

Source: C:\Users\user\Desktop\pythoninzoo.exe

API coverage: 2.3 %

Source: C:\Users\user\Desktop\pythoninzoo.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E7E20 FindFirstFileExW,FindClose,		0_2_00007FF7AA3E7E20
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF2CE40 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		5_2_00007FF6DCF2CE40

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A06A70 GetSystemInfo,VirtualAlloc,VirtualAlloc,

3_2_70A06A70

Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI69562\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	File opened: C:\Users\user\	Jump to behavior

Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Videoku
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-gap
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvcp
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Video
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D0Jw
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_exit__
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931151486.000001DFC89A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923662576.000001DFC89A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice0

Source: C:\Users\user\Desktop\pythoninzoo.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\pythoninzoo.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A70C60 IsDebuggerPresent,IsDebuggerPresent,

3_2_70A70C60

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext,

3_2_70A70C90

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A22A90 GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,HeapFree,GetNetworkParams,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

3_2_70A22A90

Source: C:\Users\user\Desktop\pythoninzoo.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 0_2_00007FF7AA3E1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,wcslen,malloc,memcpy,_cexit,exit,	0_2_00007FF7AA3E1160
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_70A95380 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_70A95380
Source: C:\Users\user\Desktop\pythoninzoo.exe	Code function: 3_2_00007FFDFAD0F7C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDFAD0F7C0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF2E580 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF6DCF2E580
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: 5_2_00007FF6DCF34178 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF6DCF34178

HIPS / PFW / Operating System Protection Evasion

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\pythoninzoo.exe	Thread register set: target process: 6984	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Thread register set: target process: 6984	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Thread register set: target process: 6984	Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Users\user\Desktop\pythoninzoo.exe "C:\Users\user\Desktop\pythoninzoo.exe"			Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"			Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_00007FFDFA9D1000 cpuid

3_2_00007FFDFA9D1000

Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: EnumSystemLocalesW,	5_2_00007FF6DCF4BDE4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00007FF6DCF54FD0
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: EnumSystemLocalesW,	5_2_00007FF6DCF54AC8
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: GetLocaleInfoEx,FormatMessageA,	5_2_00007FF6DCF2CC60
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: EnumSystemLocalesW,	5_2_00007FF6DCF54B98
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00007FF6DCF5476C
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00007FF6DCF551B4
Source: C:\Users\user\AppData\Roaming\datura.exe	Code function: GetLocaleInfoW,	5_2_00007FF6DCF4C1D0

Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\Desktop\pythoninzoo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\_endian.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\_endian.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\_endian.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\shutil.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\shutil.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\shutil.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\fnmatch.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\fnmatch.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\fnmatch.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\bz2.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\bz2.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_compression.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_compression.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_compression.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\lzma.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\lzma.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\lzma.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\subprocess.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\subprocess.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\subprocess.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\signal.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\signal.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\signal.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\threading.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\threading.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\threading.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\contextlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\contextlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\contextlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\1337 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\inspect.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\inspect.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\inspect.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ast.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ast.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\ast.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\dis.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\dis.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\dis.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\opcode.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\opcode.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\opcode.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\machinery.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\machinery.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\machinery.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tokenize.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tokenize.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tokenize.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\token.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\token.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\token.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pathlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pathlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pathlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\parse.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\parse.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\parse.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkgutil.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkgutil.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_abc.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_abc.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_abc.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_pyi_rth_utils\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_pyi_rth_utils\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_pyi_rth_utils\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\context.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\context.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\context.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\process.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\process.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\process.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\reduction.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\reduction.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\reduction.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pickle.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pickle.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pickle.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_compat_pickle.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_compat_pickle.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_compat_pickle.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\socket.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\socket.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\socket.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\selectors.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\selectors.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\selectors.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\spawn.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\spawn.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\spawn.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\runpy.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\runpy.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\runpy.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\util.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\popen_spawn_win32.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\popen_spawn_win32.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\multiprocessing\popen_spawn_win32.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\zipfile.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\zipfile.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\zipfile.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\platform.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\platform.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\plistlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\plistlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\plistlib.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\datetime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\datetime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\datetime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\expat.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\expat.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\expat.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\parser.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\parser.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\parser.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\feedparser.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\feedparser.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\feedparser.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\errors.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\errors.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\errors.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\_policybase.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\_policybase.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\_policybase.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\header.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\header.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\header.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\quoprimime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\quoprimime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\quoprimime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\string.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\string.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\string.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\base64mime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\base64mime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\base64mime.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base64.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base64.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base64.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\charset.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\charset.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\charset.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\encoders.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\encoders.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\encoders.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\quopri.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\quopri.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\quopri.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\utils.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\utils.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\utils.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\random.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\random.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\random.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\bisect.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\bisect.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\bisect.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\_parseaddr.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\_parseaddr.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\email\_parseaddr.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\calendar.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\calendar.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\calendar.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tempfile.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tempfile.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\tempfile.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\textwrap.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\textwrap.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\textwrap.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\text\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\text\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\text\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\resources.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\resources.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\resources.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_common.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_common.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_common.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\typing.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\typing.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\typing.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\abc.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\abc.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\abc.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_adapters.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_adapters.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_adapters.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\functools.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\functools.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\functools.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\extern VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\__init__.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\more.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\more.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\more.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\queue.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\queue.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\queue.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\recipes.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\more_itertools\recipes.pyc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pythoninzoo.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pkg_resources\_vendor\jaraco\context.pyc VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A952A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_70A952A0

Source: C:\Users\user\Desktop\pythoninzoo.exe

Code function: 3_2_70A70CFC GetVersion,GetCurrentThread,

3_2_70A70CFC

Source: C:\Users\user\Desktop\pythoninzoo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Bootkit	111 Process Injection	1 Masquerading	21 Input Capture	1 System Time Discovery	Remote Services	1 Screen Capture	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	21 Input Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	3 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bootkit	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	36 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pythoninzoo.exe	3%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd	4%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd	4%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pyd	4%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pyd	4%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pyd	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pyd	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pyd	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pyd	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pyd	4%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pyd	5%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pyd	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pyd	3%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://crl.dhimyotis.com/certignarootca.crl	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
https://foss.heptapod.net/pypy/pypy/-/issues/3539	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl	0%	URL Reputation	safe
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
api.telegram.org	149.154.167.220	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json?fields=proxy,hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/asweigart/pyperclip/issues/55	pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9B00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf	pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot6817203487:AAGfQMFh4-TS-WgVyG93ZurdbvwMY8HRyjI/sendPhoto	pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1937230172.000001DFCAE18000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/giampaolo/psutil/issues/875.	pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://web.archive.org/web/20240227115053/https://exiv2.org/tags.html)	pythoninzoo.exe, 00000003.00000003.1926961733.000001DFC9BCE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935689526.000001DFC9BCF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/unittest.html	pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925845532.000001DFC9333000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933958105.000001DFC933D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927613831.000001DFC933A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	pythoninzoo.exe, 00000003.00000002.1941583552.00007FFDFB9AF000.00000002.00000001.01000000.00000006.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861765801.000001DFC7D94000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl.	pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	pythoninzoo.exe, 00000003.00000003.1923705756.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919620119.000001DFC90E6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	pythoninzoo.exe, 00000003.00000002.1931972206.000001DFC8DA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc3610	pythoninzoo.exe, 00000000.00000003.1753009682.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925463465.000001DFC93A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899977584.000001DFC93A3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900811070.000001DFC9E6C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902716179.000001DFC9E5D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	pythoninzoo.exe, 00000003.00000002.1934730381.000001DFC96F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c	pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/pprint.html	pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	pythoninzoo.exe, 00000003.00000002.1929885448.000001DFC8210000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/get	pythoninzoo.exe, 00000003.00000002.1934730381.000001DFC96F0000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC91B8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924869561.000001DFC91B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyp	pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-pillow/Pillow/	pythoninzoo.exe, 00000003.00000002.1934730381.000001DFC96F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access	pythoninzoo.exe, 00000003.00000003.1924297982.000001DFC8999000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902716179.000001DFC9E5D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861765801.000001DFC7D94000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	pythoninzoo.exe, 00000003.00000002.1931972206.000001DFC8DA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	pythoninzoo.exe, 00000003.00000003.1923617347.000001DFC8731000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.sysinternals.com	pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, datura.exe, datura.exe, 00000005.00000000.1883101790.00007FF6DCF9A000.00000002.00000001.01000000.00000031.sdmp, datura.exe, 00000005.00000002.3012228835.000001CE25913000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	pythoninzoo.exe, 00000003.00000003.1902033058.000001DFC9E2B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	pythoninzoo.exe, 00000003.00000002.1931185481.000001DFC89C5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932705062.000001DFC90B1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918511685.000001DFC90A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918478827.000001DFC908A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921001293.000001DFC89B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	pythoninzoo.exe, 00000003.00000003.1861713904.000001DFC7D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1929334774.000001DFC643A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928272200.000001DFC6438000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1861765801.000001DFC7D94000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927837806.000001DFC641A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/re.html	pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932179748.000001DFC8FB0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931151486.000001DFC89A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923662576.000001DFC89A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/a/20982715/185510	pythoninzoo.exe, 00000003.00000002.1936690289.000001DFCA5C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://github.com/ActiveState/appdirs	pythoninzoo.exe, 00000003.00000002.1931870910.000001DFC8C90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wiki.debian.org/XDGBaseDirectorySpecification#state	pythoninzoo.exe, 00000003.00000002.1929373500.000001DFC6456000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927744277.000001DFC644F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	pythoninzoo.exe, 00000003.00000003.1923705756.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919620119.000001DFC90E6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC90CF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC90E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wwwsearch.sf.net/):	pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91B0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921187056.000001DFC91C6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926836010.000001DFC91CD000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918564995.000001DFC91B7000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925205894.000001DFC91C6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918647157.000001DFC91C3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	pythoninzoo.exe, 00000003.00000002.1930268012.000001DFC86B2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	pythoninzoo.exe, 00000003.00000003.1927512906.000001DFC90C0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918407600.000001DFC90B6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/	pythoninzoo.exe, 00000003.00000003.1900948362.000001DFC9E58000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930297941.000001DFC86B6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920265031.000001DFC86B5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918032438.000001DFC9E5B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1902884582.000001DFC9E5B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	pythoninzoo.exe, 00000003.00000003.1926994327.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921944461.000001DFC91AF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919985976.000001DFC8667000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930222162.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	false		high
https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module	pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917888008.000001DFC923B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1927037781.000001DFC9288000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919210390.000001DFC9283000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930268012.000001DFC86B2000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919778837.000001DFC86B1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/pypa/packagingI69562pQ	pythoninzoo.exe, 00000003.00000002.1931972206.000001DFC8DA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	pythoninzoo.exe, 00000003.00000003.1919473764.000001DFC6417000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/info/rfc7253	pythoninzoo.exe, 00000000.00000003.1753597140.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925845532.000001DFC9333000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.sysinternals.comz	datura.exe, 00000005.00000002.3012228835.000001CE25913000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf	pythoninzoo.exe, 00000000.00000003.1753009682.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925463465.000001DFC93A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899977584.000001DFC93A3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	pythoninzoo.exe, 00000003.00000003.1918699200.000001DFC9031000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932305763.000001DFC9031000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/oW	pythoninzoo.exe, 00000003.00000002.1931417171.000001DFC8A7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	pythoninzoo.exe, 00000000.00000003.1856572026.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924007974.000001DFC913B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.est	pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mahler:8092/site-updates.py	pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91B0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918564995.000001DFC91B7000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918647157.000001DFC91C3000.00000004.00000020.00020000.00000000.sdmp, request.pyc1.0.dr	false		low
http://crl.securetrust.com/SGCA.crl	pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.../back.jpeg	pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	false		low
http://tools.ietf.org/html/rfc5869	pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	pythoninzoo.exe, 00000003.00000002.1929885448.000001DFC8210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	pythoninzoo.exe, 00000000.00000003.1753271709.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753856959.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753504722.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000000.00000003.1753009682.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1935574417.000001DFC9BB3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918926912.000001DFC9BD1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925012511.000001DFC9BD3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925463465.000001DFC93A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926540406.000001DFC871F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925329556.000001DFC9343000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899977584.000001DFC93A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadisglobal.com/cpsT	pythoninzoo.exe, 00000003.00000002.1931564827.000001DFC8AE1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1922408350.000001DFC8ADA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/post	pythoninzoo.exe, 00000003.00000003.1879959611.000001DFC8A49000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919805600.000001DFC8B0B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920293887.000001DFC8B1D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881758437.000001DFC8AD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931718442.000001DFC8B30000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926578613.000001DFC8B2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9B00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ip-api.com/json?fields=proxy	pythoninzoo.exe, 00000003.00000002.1936837828.000001DFCA750000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN	pythoninzoo.exe, 00000000.00000003.1856572026.0000018E4F4D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Ousret/charset_normalizer	pythoninzoo.exe, 00000003.00000003.1924773257.000001DFC9195000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925096729.000001DFC9196000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, __init__.pyc2.0.dr	false		high
http://www.firmaprofesional.com/cps0	pythoninzoo.exe, 00000003.00000003.1917888008.000001DFC923B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900848122.000001DFC9E46000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918782905.000001DFC9294000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933714517.000001DFC9295000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925561488.000001DFC9295000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900991400.000001DFC9E52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mouseinfo.readthedocs.io	pythoninzoo.exe, 00000003.00000002.1936573675.000001DFCA350000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/re.html#re.sub	pythoninzoo.exe, 00000003.00000002.1930764288.000001DFC8750000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	pythoninzoo.exe, 00000003.00000002.1934630601.000001DFC95D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931367434.000001DFC8A39000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1899824490.000001DFC8A2A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926800506.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920896614.000001DFC8A39000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933879358.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://csrc.nist.gov/p	pythoninzoo.exe, 00000003.00000003.1899824490.000001DFC8A2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	pythoninzoo.exe, 00000003.00000003.1926994327.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921944461.000001DFC91AF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919574071.000001DFC8656000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919985976.000001DFC8667000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1930222162.000001DFC8675000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	pythoninzoo.exe, 00000003.00000003.1924442878.000001DFC931F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926800506.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933879358.000001DFC9320000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tip.tcl.tk/48)	pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921089848.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular	pythoninzoo.exe, 00000003.00000003.1917963819.000001DFC8987000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919745731.000001DFC8FD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1932223978.000001DFC8FDA000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931151486.000001DFC89A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1923662576.000001DFC89A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919681750.000001DFC89A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	pythoninzoo.exe, 00000003.00000002.1932705062.000001DFC90B1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918511685.000001DFC90A8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918478827.000001DFC908A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918085251.000001DFC9070000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	pythoninzoo.exe, 00000003.00000003.1924737883.000001DFC9198000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	pythoninzoo.exe, 00000003.00000002.1932846690.000001DFC911B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyparsing/pyparsing/wiki	pythoninzoo.exe, 00000003.00000003.1920340222.000001DFC8674000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	pythoninzoo.exe, 00000003.00000003.1902033058.000001DFC9E2B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900685277.000001DFC9E29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.sysinternals.com0	pythoninzoo.exe, 00000003.00000003.1881406882.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881595222.000001DFC9D98000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882432563.000001DFC9BE8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf	pythoninzoo.exe, 00000000.00000003.1753271709.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919516611.000001DFC86BF000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920026971.000001DFC86F0000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919879661.000001DFC86E3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918926912.000001DFC9BD1000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925012511.000001DFC9BD3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926540406.000001DFC871F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881675461.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc5297	pythoninzoo.exe, 00000003.00000002.1935058788.000001DFC9B24000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1936573675.000001DFCA350000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings0yS	pythoninzoo.exe, 00000003.00000002.1934524160.000001DFC94B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc4880	pythoninzoo.exe, 00000000.00000003.1753785034.0000018E4F4A5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1882178786.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919240428.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933387801.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933117684.000001DFC919F000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924737883.000001DFC9198000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1925096729.000001DFC9199000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920535535.000001DFC914D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1921089848.000001DFC921C000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1928341451.000001DFC919E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	pythoninzoo.exe, 00000003.00000002.1934830733.000001DFC9820000.00000004.00001000.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1879959611.000001DFC8A49000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919805600.000001DFC8B0B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920293887.000001DFC8B1D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881758437.000001DFC8AD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931718442.000001DFC8B30000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926578613.000001DFC8B2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	pythoninzoo.exe, 00000003.00000003.1899748219.000001DFC9CAB000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1924007974.000001DFC913B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1918894360.000001DFC9BC4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931417171.000001DFC8A7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf	pythoninzoo.exe, 00000000.00000003.1753856959.0000018E4F4A4000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900201560.000001DFC91D3000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1933308628.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1903080407.000001DFC91E5000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881857087.000001DFC91E8000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1900460349.000001DFC91DE000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926703714.000001DFC9BB1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	pythoninzoo.exe, 00000003.00000002.1931767871.000001DFC8B70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	pythoninzoo.exe, 00000003.00000003.1917614836.000001DFC911A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.python.org	pythoninzoo.exe, 00000003.00000003.1879959611.000001DFC8A49000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1919805600.000001DFC8B0B000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1920293887.000001DFC8B1D000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1881758437.000001DFC8AD9000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000002.1931718442.000001DFC8B30000.00000004.00000020.00020000.00000000.sdmp, pythoninzoo.exe, 00000003.00000003.1926578613.000001DFC8B2C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429036
Start date and time:	2024-04-20 09:00:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pythoninzoo.exe
Detection:	SUS
Classification:	sus30.troj.evad.winEXE@8/1027@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 54 Number of non-executed functions: 175
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.126.28.20, 40.126.28.23, 40.126.28.11, 40.126.28.18, 40.126.7.35, 40.126.28.22, 40.126.28.14, 40.126.7.32, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.SuspectCrc.28876.20318.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	xnNcI6OenKJs.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	charesworh.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FAR.N_2430-240009934.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FAR.N#U00b02430-24000993.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
149.154.167.220	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	DHL.exe	Get hash	malicious	AgentTesla	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	ShippingOrder_ GSHS2400052.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	192.229.211.108
	https://prayas.co/assets/nagateliteqfuk.exe	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bj8lt4fm8evwyl.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://28.104-168-101-28.cprapid.com/Pay-PaI/	Get hash	malicious	PayPal Phisher	Browse	192.229.211.108
	https://jainpokliultachor.pages.dev/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://sharma-sanjana2108.github.io/Microsoft/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://pusha1qsn.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://19apmacc8.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://eshoradebitcoin.com/3.dat	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.229.211.108
	https://kajdbhfkjahsdifhi.z19.web.core.windows.net/Er0Win8helpline76/index.html	Get hash	malicious	Unknown	Browse	192.229.211.108
ip-api.com	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.SuspectCrc.28876.20318.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	xnNcI6OenKJs.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	charesworh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N_2430-240009934.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N#U00b02430-24000993.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
bg.microsoft.map.fastly.net	fP4kybhBWi.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	ShippingOrder_ GSHS2400052.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.232.210.172
	https://bj8lt4fm8evwyl.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://28.104-168-101-28.cprapid.com/Pay-PaI/	Get hash	malicious	PayPal Phisher	Browse	199.232.214.172
	https://sharma-sanjana2108.github.io/Microsoft/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://pusha1qsn.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://support1-4ec.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://support-bxv.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
	https://k19gdtyrshgcjghldjk.z13.web.core.windows.net/Win/index.html?phone=null	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://19apmic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
api.telegram.org	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	DHL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	149.154.167.220
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	s.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	New Soft Update.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
TUT-ASUS	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.SuspectCrc.28876.20318.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	xnNcI6OenKJs.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	charesworh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N_2430-240009934.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N#U00b02430-24000993.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse
	cs2aimwallhack.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.1756.25811.exe	Get hash	malicious	XWorm	Browse
	00-OneDrive.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	00-OneDrive.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	s.exe	Get hash	malicious	Unknown	Browse
	cs2aimwallhack.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.1756.25811.exe	Get hash	malicious	XWorm	Browse
	00-OneDrive.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	00-OneDrive.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	0K6pKPTUmF.exe	Get hash	malicious	Unknown	Browse
	mnmg.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI69562\1337

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1369088
Entropy (8bit):	7.999899436132394
Encrypted:	true
SSDEEP:	24576:PKSCR5S3+OIVbA3DUFDpM1vdeHyzTMHho1RdkX9NmBqUUoIyux8iFG4S:CSCy3+OSA3qDpKdlMaRaFUUgumiFS
MD5:	4D3DC8146F643073D09361E7532F60AF
SHA1:	0C704200AC955786466D2DBF0238F4DDC6C7552B
SHA-256:	C7337A67C39238C332D655598B768A15B339248E0191E8670EAD80D3AC993842
SHA-512:	376405653C90A495EDF88E6420B4498962AF061550833E2D02492565449C35F8B54FD943F4B37979BCDF4932ED23DA5CB8835BBCD2748D7409B7FD6C459ED1E2
Malicious:	false
Reputation:	low
Preview:	.D...U{Q". .U..$.......M.39..g.....)7..^...^.....7..hD,..ZJ.K.M.6.64....!......L.5.k......c...@.Pg=J...7..]...b.&.J..z.;....!.zZ.-.4.....N9..Z`v..j.>KM`.g......."...w.Q..hU.....R9...OK.........`....[3_.8..B..V.G.`..-..L..B.`.3+..Y......L6..`...A!&1.<.....]G...0C3s.......x..Uw9...I.[.1..<o....n......YJe.kv5.........>H...8.\|BV........a..........P....GE.(.!..d.z+I.hxd6.C.$.f.X..jG.;n&N....J.y.w...@..e.IE......L..-.> .'.6....nUJ.Zgq.......L.F.`..XLUl...z.Z..f_g..0..G..#.[VR.9...V4Fk7.IsK..^.=nJWR.....L.j.....O....(=.V.(L...x+..>.....;...4.....KuC:.U?..98B.....O....b.J.n......7.....=.. J...d.e._.G.I.[FbB..xMC..~:...x.....z?.Hz..E^.t.6U..378..n....l).......t..?..[........=m$s.8..T........zFH".+"......^..3!.u...M37.v".@..0.R.._..}U...[.q..9.9...C.x{-....f4...)F.5Op....T.....!..Y.^.7....k..5.......m.(..P...L.l..M.B9.c.\|..A.8...l...Ls.a....%.a...w"....[.........$[....`..h}m...u{?....u...i.<.Zx.0.9..2..O.......)'-..........`Wh......B]q..^...K

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\AES.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6997
Entropy (8bit):	5.345044583593846
Encrypted:	false
SSDEEP:	96:meGQHbITsol5m6xVIGae/EXqmHuToft7TAUZmniQjzVHdQU+:me7Hbk5nn9EXXHKItPdZ9Qj1+
MD5:	8F023C07A7D867EAD8ADA9A08F10AE5F
SHA1:	BBAF1465BB454565A0CE3D2B10C93FA96751E579
SHA-256:	CE87768E9CA26EBA36E4B90501BDF129F4365EF69D25A482327F33D18A33ABCC
SHA-512:	2E8DCEF77A7BECF6FE2328555D81158C5E74A2C64ABE5EFE4E4C4274B82DFF04CC4FDED90C4D26F25166C05B1558F08755D19C1BF2D89FD8D057358BDA66B612
Malicious:	false
Reputation:	low
Preview:	o....................................@........d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e...Z.z.d.Z.e.....rQe.d.e...d.d.....Z.W.n...e.y[......Y.n.w.d.d...Z.d.d...Z.d.d...Z d.Z!d.Z"d.S.)......N...._create_cipher....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptr...._cpu_features....get_random_bytes............................................................. int AES_start_operation(const uint8_t key[],. size_t key_len,. void *pResult);. int AES_encrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_decrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_stop_operation(void state);.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.703513333396807
Encrypted:	false
SSDEEP:	96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
MD5:	6176101B7C377A32C01AE3EDB7FD4DE6
SHA1:	5F1CB443F9D677F313BEC07C5241AEAB57502F5E
SHA-256:	EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
SHA-512:	3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Joe Sandbox View:	Filename: purchaseorder4.exe, Detection: malicious, Browse Filename: s.exe, Detection: malicious, Browse Filename: s.exe, Detection: malicious, Browse Filename: cs2aimwallhack.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.1756.25811.exe, Detection: malicious, Browse Filename: 00-OneDrive.exe, Detection: malicious, Browse Filename: 00-OneDrive.exe, Detection: malicious, Browse Filename: 0K6pKPTUmF.exe, Detection: malicious, Browse Filename: mnmg.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_EKSBlowfish.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3415
Entropy (8bit):	5.100916189652965
Encrypted:	false
SSDEEP:	96:RPqqXvaWWWasAfy0iV1MeDMqQPt7moVHk3L:RKsQyV3+V7mQkL
MD5:	DE7F0E2D47EBDB85B240BBDC02A829A0
SHA1:	7185E7D78823F98EEB1405FAA2761E15FC8967F4
SHA-256:	91A5C0511E68D42233BF9057448BD5C75F55ABBBDE56CE8373B8F96E667D401C
SHA-512:	7FAF9D382DADD27EF630D155E27755E416DA9C1C13A1586C133C1927E71D7290A7853A02BE4116CD465A34C6695A078856822A0D5AE6AC160D83428DF79E0D4B
Malicious:	false
Reputation:	low
Preview:	o....................................@....d...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.d.d...Z.d.S.)......N...._create_cipher....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptr..c_uint..Crypto.Cipher._raw_eksblowfish.a.... int EKSBlowfish_start_operation(const uint8_t key[],. size_t key_len,. const uint8_t salt[16],. size_t salt_len,. unsigned cost,. unsigned invert,. void *pResult);. int EKSBlowfish_encrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int EKSBlowfish_decrypt(const void state,. const uint8_t

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968452734961967
Encrypted:	false
SSDEEP:	96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5:	371776A7E26BAEB3F75C93A8364C9AE0
SHA1:	BF60B2177171BA1C6B4351E6178529D4B082BDA9
SHA-256:	15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
SHA-512:	C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Joe Sandbox View:	Filename: purchaseorder4.exe, Detection: malicious, Browse Filename: s.exe, Detection: malicious, Browse Filename: s.exe, Detection: malicious, Browse Filename: TiKj3IVDj4.exe, Detection: malicious, Browse Filename: TiKj3IVDj4.exe, Detection: malicious, Browse Filename: cs2aimwallhack.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.1756.25811.exe, Detection: malicious, Browse Filename: 00-OneDrive.exe, Detection: malicious, Browse Filename: 00-OneDrive.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.354814715963753
Encrypted:	false
SSDEEP:	48:gqzLMJbLqGll6W8RRlGWsm/B4YdLTLtLcLGLU0LIL+wL3L2LD:NzCbLqyl6W8RtsgB9ZV
MD5:	6213E1BEC9CA22437B6141CDE75612FB
SHA1:	9E8D033687C005EAB14E00ACEF222C3F9F3E619C
SHA-256:	C00B200ECC5C4A8AC490A9679093A2F0F6375232D5F1CB9DCE5C07526A9FF64F
SHA-512:	6E53030FA5147FDE4AD1CD57E1028AF9EF67F427DF57F0B8D5F5F45E93D42EDB14921E87787F3EA5DA18A41FAD1267FBFBAFB13547D602C7AE04AF9C16E69C25
Malicious:	false
Reputation:	low
Preview:	o....................................@.......d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.e.e.e.e.e.d...Z.e.e.e.e.d...Z.d.d...Z.d.S.)......N...._create_ecb_cipher...._create_cbc_cipher...._create_cfb_cipher...._create_ofb_cipher...._create_ctr_cipher...._create_openpgp_cipher...._create_ccm_cipher...._create_eax_cipher...._create_siv_cipher...._create_gcm_cipher...._create_ocb_cipher...........................................................c....................O........\|.\|.d.<.t.t...}.\|...d.d...r.\|...t.....\|.\|.v.r.t.d.....\|.r^\|.d.v.r2t.\|...d.k.r+t.d.....\|.d...\|.d.<.n,\|.d.v.rGt.\|...d.k.r@t.d.....\|.d...\|.d.<.n.\|.d.k.rVt.\|...d.k.rUt.d.....n.\|.d.k.r^t.d.....\|.\|...\|.f.i.\|.....S.).N..key..add_aes_modesF..Mode not supported..r"...r ...r#...r$...r%...r..... Too many arguments for this moder......nonce..r....r....r....r......IVr.....%IV is not meaningful for the ECB mode....dict.._modes..pop..up

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061461040216793
Encrypted:	false
SSDEEP:	192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
MD5:	CB5238E2D4149636377F9A1E2AF6DC57
SHA1:	038253BABC9E652BA4A20116886209E2BCCF35AC
SHA-256:	A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
SHA-512:	B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_cbc.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7421
Entropy (8bit):	5.15072787208901
Encrypted:	false
SSDEEP:	96:+6kvCQ9XIH/EgsA4nx3ZT8Sq5esIDGnt834mGvWcsQHxxwm8W8HvGBt83425pYPk:9JHlt4x3ZA8smGtU4smMGnU4nPJVBS
MD5:	8015D41A00B93DDAA49F6E69C783B6DD
SHA1:	DCDB51BD2419ADF4EC62F2C395DA6EDB681A2AD4
SHA-256:	349FA3A890537B42C99AB7E7246717B750A4B7BE2EAF26B1174FE324FF42CDF4
SHA-512:	B0A388C18AB767C994912811157DF139A4A4804FD404F4855BAD54E2F3991BE4DE271CD9EB319912A9CD8E5D0183B45B5B316BEDF69057D648500942CF3E030E
Malicious:	false
Preview:	o....................................@....p...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)..'.Ciphertext Block Chaining (CBC) mode....CbcMode........._copy_bytes....load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer....get_random_bytes..Crypto.Cipher._raw_cbc..... int CBC_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int CBC_encrypt(void cbcState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CBC_decrypt(void cbcState,. const uint8_t in,. uint8_t *out,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ccm.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17887
Entropy (8bit):	5.312375068076043
Encrypted:	false
SSDEEP:	384:uMq/qgUM3XuMkL1I4ndhuUy8WbAlg7foqZ:uMgXO6vMG7AA
MD5:	BDDB5EB5AC0FC7DFF36CC6FF91F0A7F8
SHA1:	C3D04A73492435763909A79DBC7DB3C2407EBFC5
SHA-256:	4AD38EC2C7F9E217A7FF4E279B81163327087506E199EE60A5767775BD78AA8D
SHA-512:	68C002C1F185EB7F36D319D608E90B718AD5C576ACD824BE8FC6DCD2AA0B5465710D9FEB72A0EA54C5F1E4C0BF98F1C478C44E30C57C2D9E58BC80DEAC4BFCF1
Malicious:	false
Preview:	o....................................@.......d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.e.d.d.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)..".Counter with CBC-MAC (CCM) mode....CcmMode.....N....unhexlify....byte_string..bord.._copy_bytes....is_writeable_buffer....strxor....long_to_bytes....BLAKE2s....get_random_bytesc....................K........t.d.d.\|...S.).N..Enum......type....enumsr....r......Crypto\Cipher\_mode_ccm.py..enum3..........r..................NOT_STARTED..PROCESSING_AUTH_DATA..PROCESSING_PLAINTEXTc....................@.......e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d!d.d...Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d!d.d...Z.d!d.d...Z.d.S.)"r.........Counter with CBC-MAC (CCM)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and i

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_cfb.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7743
Entropy (8bit):	5.11039762048274
Encrypted:	false
SSDEEP:	96:S6kvf/G8HDxSpuPnxEZw88sCIgGGt834mGPMsQHxnRu8H+G0t834U5ppmaPXQOxZ:o3xSuxEZNCJGkU44u5GaU4z6Df6S
MD5:	BE1D61D7E48D9C4098892DA8D7BBEB07
SHA1:	3E44CCF3FFEB2AD05E67F8968B1BF643E20AAFBA
SHA-256:	6CCE5B77328EB6863BB39906C05DE0C6D615F6C3E8EECC8CC1D6FCFC0672DF5B
SHA-512:	3CE1136FD2818A4E96A7701B22090A52E59D7038D34D413517ACD1DEBDE147D6CCB36CD2CD898466944500127CA56FC16FF46F4D7AB6227A1D43AE738649EBBD
Malicious:	false
Preview:	o....................................@....p...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)....Counter Feedback (CFB) mode....CfbMode........._copy_bytes....load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer....get_random_bytes..Crypto.Cipher._raw_cfb. .... int CFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. size_t segment_len, / In bytes /. void pResult);. int CFB_encrypt(void cfbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CFB_decrypt(void *cfbState,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ctr.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	10941
Entropy (8bit):	5.108036943312038
Encrypted:	false
SSDEEP:	192:a7GD6BkH7cxiM16T5qyw8ssmGrPU4x0OGrNU4tWwSk8jIGiP:aamBGSWqn80MTx0OyTt7SkGIxP
MD5:	A32CE74407356C1E16BA01A032270B56
SHA1:	7C7BD1BE02B716123E20EF5AE6CB0993C8A28FDE
SHA-256:	1547CD492017C0C31BD2D49B72CC44CA7468035981AAFCB1290DBECE2E90469E
SHA-512:	E27F4BCC3A36F81786A90D79195620A9DF14A2932E2482424256429B9727B8B85CDF07A0975E0F4BD0D1DEF93AD1C353A4B932B91E03D468B1AC2EF63CF07ED0
Malicious:	false
Preview:	o....................................@.......d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)....Counter (CTR) mode....CtrMode.....N....load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer....get_random_bytes...._copy_bytes..is_native_int....long_to_bytes..Crypto.Cipher._raw_ctr..... int CTR_start_operation(void cipher,. uint8_t initialCounterBlock[],. size_t initialCounterBlock_len,. size_t prefix_len,. unsigned counter_len,. unsigned littleEndian,. void pResult);. int CTR_encrypt(void ctrState,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_eax.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12227
Entropy (8bit):	5.177467571945058
Encrypted:	false
SSDEEP:	192:asVUwXqNRkQfnM4lQrU4tXsDwU4F3xL/AAWDB77pkeSdp3xWmn7:fUwXq/FM4+TCwTFhL/AAeJ7pC/0U7
MD5:	6A279669F4FE0DE1E61EE2050D277290
SHA1:	1BCD97C7D67CA418D3AE67DAF21C95EE07B67EB4
SHA-256:	91864B8CEE2166B271484F150F3D4A4D204A1AE6D7396C6DD8FA9A8C3D7481B9
SHA-512:	D2E050C94278AC7A5CA7EAA9A87E7281D9A442E1CCFCDA6313CD28E7AAA43DF94B7130B9CB926F566CB0283E5E125EB9809EDA7B5629BEA9FC45E0F7723F57A5
Malicious:	false
Preview:	o....................................@.......d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.)....EAX mode....EaxMode.....N....unhexlify....byte_string..bord.._copy_bytes....is_buffer....strxor....long_to_bytes..bytes_to_long....CMAC..BLAKE2s....get_random_bytesc....................@....h...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r.........EAX mode... This is an Authenticated Encryption with Associated Data. (`AEAD`_) mode. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed,. and it will still be subject to authentication... The decryption step tells the receiver if the message comes. from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message -. including the header - has been modified

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ecb.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5770
Entropy (8bit):	5.099021153677223
Encrypted:	false
SSDEEP:	96:2Fv6kvV9AtXEHPhfKx7lFtTeaqBP6sQLRgcg98HM3qc5pbPf5LCBhV2:2H9pHPhM7vdekFg9t1fS32
MD5:	4C3834FA5C1FF93BE6FC828DA4F730B5
SHA1:	62F44EE112338434B875DCC5EFBE22EABEB9FE7E
SHA-256:	A784DCC3E47A77F341536D95192417A18066D971B67826C8840B1236F87F4104
SHA-512:	D0000CB81B8CA410B17719E1274269805F5FD28C7631889A6BA9F6B73D5A93998119E81637A59D28DE331FB36372CEBA97FFC829C31FDA56669501AB6E1FE12E
Malicious:	false
Preview:	o....................................@....X...d.Z.d.g.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)..".Electronic Code Book (ECB) mode....EcbMode.........load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer..Crypto.Cipher._raw_ecb.k.... int ECB_start_operation(void cipher,. void pResult);. int ECB_encrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_decrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_stop_operation(void state);. c....................@....,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_gcm.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17022
Entropy (8bit):	5.374668163913141
Encrypted:	false
SSDEEP:	384:FOlWBJ2CqblGPM4dKaTi6TVJkOT7kGth/7G:F3DD6x9oT7kwhC
MD5:	2986BB5069F8CE284E0DEB0F197E4EF7
SHA1:	0A78547C42910C15042DD89EAE4F59A293E7CFD2
SHA-256:	BA04D48082FD44EA898DB8A93B6404CCF0B99706D72D9EEF5628BF507C4ABC05
SHA-512:	2E55E155BFA54E7D612076E96994CE2BB2DCD6697307BA999F79A353BED0FC31A8D6E366EDADDACD8658F10D95F2F6F42E4AD06B96B9A956EBBE2B9503FF91A6
Malicious:	false
Preview:	o....................................@........d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.e...Z.G.d.d...d.e...Z d.d...Z!e!d.d.d...Z"G.d.d...d.e...Z#d.d...Z$d.S.)....Galois/Counter Mode (GCM)....GcmMode.........unhexlify....bord.._copy_bytes....is_buffer....long_to_bytes..bytes_to_long....BLAKE2s....get_random_bytes....load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr...._cpu_features.`.... int ghash_%imp%(uint8_t y_out[16],. const uint8_t block_data[],. size_t len,. const uint8_t y_in[16],. const void exp_key);. int ghash_expand_%imp%(const uint8_t h[16],. void ghash_tables);. int ghash_destroy_%imp%(void ghash_tables);.c.........................l...d.d.l.m.}...d.}.\|.d.\|...}.z.....f.d

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ocb.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	14606
Entropy (8bit):	5.26669494186505
Encrypted:	false
SSDEEP:	384:EqHGdeveMSrMGR4ibeWride44/IqXxHRfKj:EsGdevGMWZKiigt/DBlKj
MD5:	61C1C25D7F84F7639DD05BF69AACC519
SHA1:	CF71BAD5673300D9012B1473169B81A94D77EA3C
SHA-256:	AA8E0FF830364C1ADAEC6C47AFBCB10FB32FF0587BC9A7B0D82564744AB5E3C0
SHA-512:	0D51DEAD734289904650971BCA400176394CFE52C8022EC9BAC63C736CB91DB8B33473A048F6DAC2EA643C13B65CDB08398B922EE9E33373B5C1D56E959A81D1
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)..h....Offset Codebook (OCB) mode...OCB is Authenticated Encryption with Associated Data (AEAD) cipher mode.designed by Prof. Phillip Rogaway and specified in `RFC7253`_...The algorithm provides both authenticity and privacy, it is very efficient,.it uses only one key and it can be used in online mode (so that encryption.or decryption can start before the end of the message is available)...This module implements the third and last variant of OCB (OCB3) and it only.works in combination with a 128-bit block symmetric cipher, like AES...OCB is patented in US but `free licenses`_ exist for software implementations.meant for non-military purposes...Example:. >>> from Crypto.Cipher import AES. >>> from Crypto.Random import get_random_bytes. >>>. >>> key = get_ran

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ofb.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7312
Entropy (8bit):	5.086145812010216
Encrypted:	false
SSDEEP:	96:m6kv9jQvHHE12nxINX8Sb5esIUGGt834mGPMsQHxvRZ8HaGLt834+5pdp/uXQKpr:yyHEAxIj8s9GkU4oZlGJU46mpkS
MD5:	17F79A74F15E2D91E4FDB5DCD2114088
SHA1:	D4912311B0EC654809A6EE39D5B9285C14C81E5A
SHA-256:	E12D356D5D0E6463B729ED2BCBC1EF723234FA1B1D96906CC547854E69A39D27
SHA-512:	2E67C8ED541955E327129647EE5A419A9D33F1AB638A3463823F1EEE0CEC0BF66BF73586B9EBBD6AF811F5EA669FFD2F587C14C4AF5AC8924C712496929DB513
Malicious:	false
Preview:	o....................................@....p...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)....Output Feedback (CFB) mode....OfbMode........._copy_bytes....load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer....get_random_bytes..Crypto.Cipher._raw_ofb...... int OFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int OFB_encrypt(void ofbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int OFB_decrypt(void *ofbState,. const uint8

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_openpgp.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4768
Entropy (8bit):	5.237101711263968
Encrypted:	false
SSDEEP:	96:o78N+A+QXHdi2Kt834mGPUPt834UThW2nxBXns8I:oK+A+QHdYU441U4Ud9x3I
MD5:	A32E794BDAE5EF0513DE22CC2ED4281A
SHA1:	8A7879DA8DC338330DF5BCC3F9D20C22B5A1F452
SHA-256:	61C9A657E68115BE24C821E1315A61DA1EA0F33919B3D3236B2FC3D16F7B7018
SHA-512:	CA4073CB4CEF34593963239B9B94620AA572B0D4498944BB84D55F5E572CDA97E165DD54E734561365AF1D09DE573DA06B5A9FF53D11A11C313EADBB61ED4E5A
Malicious:	false
Preview:	o....................................@....>...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.)....OpenPGP mode....OpenPgpMode........._copy_bytes....get_random_bytesc....................@....(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r.....z...OpenPGP mode... This mode is a variant of CFB, and it is only used in PGP and. OpenPGP_ applications. If in doubt, use another mode... An Initialization Vector (IV) is required... Unlike CFB, the encrypted IV (not the IV itself) is. transmitted to the receiver... The IV is a random data block. For legacy reasons, two of its bytes are. duplicated to act as a checksum for the correctness of the key, which is now. known to be insecure and is ignored. The encrypted IV is therefore 2 bytes. longer than the clean IV... .. _OpenPGP: http://tools.ietf.org/html/rfc4880.. :undocumented: __init__. c....................C........\|.j.\|._.d.\|._.\|.j.\|.\|.j.f.d.\|.j...\|.j.d...d...\|.....}.t.d.d.\|...}.t.\|...\|.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_siv.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11769
Entropy (8bit):	5.260286697343964
Encrypted:	false
SSDEEP:	192:YV7qjzBGjN4DWLNByrEAfsGd0GdkTkYuZ6h697qH+4aoN5B8xQrB3Q:o7q45TNByrEEf5tZAS7kha6t1g
MD5:	9FA54D6BD88EF255BE29A74966C7A487
SHA1:	CFC9AE0CB426B5DEC8D03F06BAFAB9BE1F98BD28
SHA-256:	ED8F0962044EF83CF3E2990BB1D513F34F05FAFC52451E42CBE7A6BA5A62073F
SHA-512:	72CE5C1E701F5CD20D14EDFA17AC8047CE5DDFFA7587B50A0C82E1191FE800DE9CDD8F2D40233CB3BD3FC7E7012D5BB1F25F2EF2ABAC1E5748BD7C5F5C88423D
Malicious:	false
Preview:	o....................................@.......d.Z.d.g.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.)..-.Synthetic Initialization Vector (SIV) mode....SivMode.........hexlify..unhexlify....bord.._copy_bytes....is_buffer....long_to_bytes..bytes_to_long...._S2V....BLAKE2s....get_random_bytesc....................@....l...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r........Synthetic Initialization Vector (SIV)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and it will. still be subject to authentication. The decryption step tells the receiver. if the message comes from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message - including

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.236167046748013
Encrypted:	false
SSDEEP:	192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
MD5:	D9E7218460AEE693BEA07DA7C2B40177
SHA1:	9264D749748D8C98D35B27BEFE6247DA23FF103D
SHA-256:	38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
SHA-512:	DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.558176937399355
Encrypted:	false
SSDEEP:	384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
MD5:	F751792DF10CDEED391D361E82DAF596
SHA1:	3440738AF3C88A4255506B55A673398838B4CEAC
SHA-256:	9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
SHA-512:	6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.285191078037458
Encrypted:	false
SSDEEP:	192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
MD5:	BBEA5FFAE18BF0B5679D5C5BCD762D5A
SHA1:	D7C2721795113370377A1C60E5CEF393473F0CC5
SHA-256:	1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
SHA-512:	0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505471888568532
Encrypted:	false
SSDEEP:	192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
MD5:	D2175300E065347D13211F5BF7581602
SHA1:	3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
SHA-256:	94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
SHA-512:	6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.06124024160806
Encrypted:	false
SSDEEP:	384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
MD5:	45616B10ABE82D5BB18B9C3AB446E113
SHA1:	91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
SHA-256:	F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
SHA-512:	ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475467273446457
Encrypted:	false
SSDEEP:	384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
MD5:	CF3C2F35C37AA066FA06113839C8A857
SHA1:	39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
SHA-256:	1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
SHA-512:	1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838534302892255
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5:	20708935FDD89B3EDDEEA27D4D0EA52A
SHA1:	85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
SHA-256:	11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
SHA-512:	F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.9047185025862925
Encrypted:	false
SSDEEP:	192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5:	43BBE5D04460BD5847000804234321A6
SHA1:	3CAE8C4982BBD73AF26EB8C6413671425828DBB7
SHA-256:	FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
SHA-512:	DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300163691206422
Encrypted:	false
SSDEEP:	192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5:	C6B20332B4814799E643BADFFD8DF2CD
SHA1:	E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
SHA-256:	61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
SHA-512:	D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.260220483695234
Encrypted:	false
SSDEEP:	384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
MD5:	0B538205388FDD99A043EE3AFAA074E4
SHA1:	E0DD9306F1DBE78F7F45A94834783E7E886EB70F
SHA-256:	C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
SHA-512:	2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.276870967324261
Encrypted:	false
SSDEEP:	384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
MD5:	6C3E976AB9F47825A5BD9F73E8DBA74E
SHA1:	4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
SHA-256:	238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
SHA-512:	B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.578113904149635
Encrypted:	false
SSDEEP:	96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	FEE13D4FB947835DBB62ACA7EAFF44EF
SHA1:	7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
SHA-256:	3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
SHA-512:	DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.143719741413071
Encrypted:	false
SSDEEP:	384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
MD5:	76F88D89643B0E622263AF676A65A8B4
SHA1:	93A365060E98890E06D5C2D61EFBAD12F5D02E06
SHA-256:	605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
SHA-512:	979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.353267174592179
Encrypted:	false
SSDEEP:	384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
MD5:	D48BFFA1AF800F6969CFB356D3F75AA6
SHA1:	2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
SHA-256:	4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
SHA-512:	30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741247880746506
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5:	4D9182783EF19411EBD9F1F864A2EF2F
SHA1:	DDC9F878B88E7B51B5F68A3F99A0857E362B0361
SHA-256:	C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
SHA-512:	8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 5%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\BLAKE2s.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7249
Entropy (8bit):	5.262396349456586
Encrypted:	false
SSDEEP:	96:avykv8y2Ed5ck4BQ+jnH0yvvCRbJZXR2MWilFKLcfTQ2k1hITnSHWdlUOgF/t:DycQ+v3CRbRVPkOM29SAUOg9t
MD5:	B11FDF4DB8FEB62D62194881D44EF57B
SHA1:	C830974750B77BDC033B105DE20096AF64093FC5
SHA-256:	C48BA7AA12903C5EED58A664F6704B9F5FAE5E3D1C9713E3009F5B993729A38E
SHA-512:	DDDB8F6D5A1B0EF418304268E0BC8F0D05CAB222AA8D179DE71B31421ED1C5FC4F229546AB463EA1737761A906B817BDFA07498084099637D7803E8C22761FE6
Malicious:	false
Preview:	o....................................@....r...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)..........unhexlify....bord..tobytes....get_random_bytes....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._BLAKE2s..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\CMAC.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7879
Entropy (8bit):	5.397067718458641
Encrypted:	false
SSDEEP:	96:/qZM8mNQrFZr+W85oo/rRdR3AdbwGJTeIg7QOshdaXHhC8PQXOz2MEX0bFibw5BG:p8U/dR3A2Q1U3hLb/pQ4BKsPdgj
MD5:	1CF23EFCE40C62DD3E1D7D1A85E77471
SHA1:	51968D700B2791AB3C1BFFB5236D92F0CE5CD716
SHA-256:	CB02444665EEA5E87C08FBDA9C87B22FC5C0A91519F90EB59EABDF3C8685210C
SHA-512:	1EBA8471C0A14AF95C5297AB28DF6342A2D1D1386834CAB15DBA64B85B1D6CAE95790A263868C474FB636FDFCDE866F1351486BE11DDC1747B06E6ED9B9C6B48
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)..........unhexlify....BLAKE2s....strxor....long_to_bytes..bytes_to_long....bord..tobytes.._copy_bytes....get_random_bytesNc....................C....,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.......r....r......len....bsZ.xor_lsb..num..r......Crypto\Hash\CMAC.py.._shift_bytes$............r....c....................@....T...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMAC..A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C....D...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i.\|.j.....\|._.\|.j...\|...}.t.\|.d.....d.@.r\t.\|.\|.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\HMAC.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6306
Entropy (8bit):	5.5086318952512965
Encrypted:	false
SSDEEP:	96:iqnqbPUNnb5qsjQ8UGLe571bGAQMIdO3RC+A2MMaPQX+FKHQD8EhXC0iiuc:Xhzex1ydLN7lA48E5
MD5:	9AF3474B04A08AC9CA1C2F7DBA9182FC
SHA1:	20BD3760680ECFE11580571B77D3B94AEF844F73
SHA-256:	B3E2F39E74BB90FB1D72898520C0F09705E2891FEF998B73F5964D0CCD42F4FB
SHA-512:	CA0F474649CA0A62E88D0A98BAD001C04E71AF1F9DE04F78C0E86CBA75927B53B07F6053189FB911DB1DB8C683F36A0592D09109EF893389F194C838A64322B4
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)..........bord..tobytes....unhexlify....BLAKE2s....strxor....get_random_bytes..new..HMAC..1.2.840.113549.2.7..1.2.840.113549.2.8..1.2.840.113549.2.9..1.2.840.113549.2.10..1.2.840.113549.2.11..1.2.840.113549.2.12..1.2.840.113549.2.13..2.16.840.1.101.3.4.2.13..2.16.840.1.101.3.4.2.14..2.16.840.1.101.3.4.2.15..2.16.840.1.101.3.4.2.16..z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C........i.\|.].\.}.}.\|.\|...q.S.)........0..k..vr....r......Crypto\Hash\HMAC.py..<dictcomp>:..........r#...c....................@....R...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\MD5.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5363
Entropy (8bit):	5.193700272607251
Encrypted:	false
SSDEEP:	96:2bykvyVoaG0Ed5c6D1HN8uiM7WmZXDHOs680FY1GOz2zolpXxPMSCW:2uyDr8kHHAnFYIr85IW
MD5:	3678E05437414438D27856D760F0E73C
SHA1:	8C74622C0BEF1C42C3C9DC7F3D73AB441163E14A
SHA-256:	40A0C8F0BE8735CE475E495AFEEE5A17CF14F206DAC7251CE83E888D01ECDF3F
SHA-512:	D441D49AD8F5902F99CE292730C185FED7C79D3C712636A089AC35727056F1C99D08179B17E64E770BDD143AF633F7FCC0885B0E981F93878E915953FDB0CAEA
Malicious:	false
Preview:	o....................................@....d...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)..............load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._MD5..... #define MD5_DIGEST_SIZE 16.. int MD5_init(void shaState);. int MD5_destroy(void shaState);. int MD5_update(void hs,. const uint8_t buf,. size_t len);. int MD5_digest(const void shaState,. uint8_t digest[MD5_DIGEST_SIZE]);. int MD5_copy(const void src, void dst);.. int MD5_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA1.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5386
Entropy (8bit):	5.202170486930233
Encrypted:	false
SSDEEP:	96:Ktykvm51RUT7NCaGuEd5S/ur1Hj8uMM728U8ZX13Os6LVUGO8z9lpXBPMpC1:Kc51RC7Nr/urh8sr/3ALVZthZp1
MD5:	1ED850C5D39873BA721097267FAD635B
SHA1:	EE7A16B216270CBDEFDF50FE3F76BF8F2BFA9D83
SHA-256:	5349AC00BEC239E5496177F342E929A8EA186B3CA90151CF36D6A7FA593EA223
SHA-512:	979BE54B297C37511BE319887D82973A2C539B9E8A358D0473728D16EAA83AC04325FF47C458E2439F7FAE10D72A2A5D9A287D043BC3633DAE24B76907759FC6
Malicious:	false
Preview:	o....................................@....h...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..............load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._SHA1..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA224.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5563
Entropy (8bit):	5.16725705256416
Encrypted:	false
SSDEEP:	96:6kykvlyUR7T4a3KGKEd5GF0x1Hqk8uR2kgeZXHZOs6ybW3MDgz1lPMfwo:6AyURf4amF0xB8Fk/ZAyCcMzDo
MD5:	6C1C294A8D1EC4900B6E34B629DC0661
SHA1:	F434E0EEEC92E97D5F9A14B26DC1C7C79727D9D9
SHA-256:	DA83374AD44A6B9E6CAEC663B53116BCFB899D57E20227362E14950777F3C09A
SHA-512:	102B9ABA61CB318991494E9B83A19800125E184C769AE452E093D9CC71D5143B2391A1648E83EF360CC0E81898671169E26C65DA8B7919448581E7881BD81B85
Malicious:	false
Preview:	o....................................@....l...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._SHA224...... int SHA224_init(void *shaState);. int SHA224_destroy(void shaState);. int SHA224_update(void hs,. const uint8_t buf,. size_t len);. int SHA224_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA224_copy(const void src, void dst);.. int SHA224_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA256.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5559
Entropy (8bit):	5.18582033793313
Encrypted:	false
SSDEEP:	96:6kykv4XXR6TJDkKGAEd505c1HqI8k207ZXFzOs6TiWyMsgzG7PMOwr:6hXXR8JDP5cV8z0PzATT9XgKr
MD5:	E2B99DA01A328C226E8FACC2FB1F3F3D
SHA1:	66376908E744BE3D3E8E8BE9861F15FA105E034D
SHA-256:	C21069976C0901921AF7E68BEB8436FDEC0C1F816CA00B17F2F14C5227E67808
SHA-512:	91B0D4D3B64707129ABAF0D112E8423D7321C434C03AEB9E1CB14D8F36C1E4CB065AA457631E5EC365A1DE4CE71F1BE5C6D68AC7E2BB7FD50F2EE5F60A9DA375
Malicious:	false
Preview:	o....................................@....l...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._SHA256...... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA384.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5559
Entropy (8bit):	5.183018062950269
Encrypted:	false
SSDEEP:	96:6kykvI7bRmTlPYKGMEd5r5A1HqI8Y2ILZXFfOs632WaMsgzZsyPMfwi:6h7bRAlPs5Ad8/IrfA3/FXCyDi
MD5:	BA0BDE4012DD81B650D08DB2C5893337
SHA1:	79DBD32933777C3878CA79DC3DE8FD7DCF21A702
SHA-256:	961EAD2C3191B52C52DB022D1BE5BA2768D215C4C1EA5C554A22EF9353321E84
SHA-512:	092FFA6F4D1A21919D1B9827C3A27FB4B1C8E995E37E46A9A52B1AEF7A09356193BB81D02448449C2F11286B33BADF410347552A879A56A6B45CE6F5B2EC3951
Malicious:	false
Preview:	o....................................@....l...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._SHA384...... int SHA384_init(void *shaState);. int SHA384_destroy(void shaState);. int SHA384_update(void hs,. const uint8_t buf,. size_t len);. int SHA384_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA384_copy(const void src, void dst);.. int SHA384_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA3_224.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	5.41830887641494
Encrypted:	false
SSDEEP:	96:MQ4eykv/0we5MGB1jnH0EEXzf+ZXuLOs6ukRUI4i4NSfRe3Awo4c:Mp80P1XEXzf/LAukRUBN4Mo4c
MD5:	C33AD327465D486C4DFF9ADF40BC3007
SHA1:	3EE4D038BD95C610C8BA700DF34F238BDD60993E
SHA-256:	327489209D147110B77BB9F9C246174FA2FB92FA17C5D703419449506D020AF1
SHA-512:	160B165A440F004C29EF16C005825C25C554D39B26BBF143F63B51D6F362629BAB1E1515FF939C7711334A792D9C412C609FD3567E5A903BA666379A628DA534
Malicious:	false
Preview:	o....................................@....f...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.e.j.Z.d.Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..c_ubyte...._raw_keccak_libc....................@....N...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...SHA3_224_Hash..A SHA3-224 hash object.. Do not instantiate directly.. Use the :func:`new` function... :ivar oid: ASN.1 Object ID. :vartype oid: string.. :ivar digest_size: the size in bytes of the resulting hash. :vartype digest_size: integer. .......2.16.840.1.101.3.4.2.7....c....................C....p...\|.\|._.d.\|._.d.\|._.t...}.t...\|.....t.\|.j.d.....t.d.....}.\|.r$t.d.\|.......t.\|.....t.j...\|._.\|.r6\|...\|.....d.S.d.S.).NF................&Error %d while instantiating SHA-3/224...._update_after_digest.._digest_done.._paddingr....r......keccak_init..address

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA3_256.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	5.425564855390692
Encrypted:	false
SSDEEP:	96:MQ4eykv/0ae5wGuajnH0JbXzfbZXDAOs6NkyUzfi4NSfie3Awo4c:Mp80OaGbXzfNAANkyUrN4zo4c
MD5:	B712D9DC13C3F3AD1E40158D7A01F27B
SHA1:	567E7CF977A23326273948703A6258630B7B6532
SHA-256:	893CB73C255E68A550D14D84B6266967EA1FFF24052A5E982DA719371F9EE4AA
SHA-512:	374DBB615CCAD698FC1DDC5488189CDDA368DFAA51895BAD6084569220A07A86CC18695028F6A5AE710FD74DB74F428C91830FF7F53514A501A1B0EC11D21DB1
Malicious:	false
Preview:	o....................................@....f...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.e.j.Z.d.Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..c_ubyte...._raw_keccak_libc....................@....N...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...SHA3_256_Hash..A SHA3-256 hash object.. Do not instantiate directly.. Use the :func:`new` function... :ivar oid: ASN.1 Object ID. :vartype oid: string.. :ivar digest_size: the size in bytes of the resulting hash. :vartype digest_size: integer. . .....2.16.840.1.101.3.4.2.8....c....................C....p...\|.\|._.d.\|._.d.\|._.t...}.t...\|.....t.\|.j.d.....t.d.....}.\|.r$t.d.\|.......t.\|.....t.j...\|._.\|.r6\|...\|.....d.S.d.S.).NF................&Error %d while instantiating SHA-3/256...._update_after_digest.._digest_done.._paddingr....r......keccak_init..address

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA3_384.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4783
Entropy (8bit):	5.401853144734967
Encrypted:	false
SSDEEP:	96:MQ4eykv/WPe5PGimjnH0lcXzfSZXufOs6ZPWUzrXOiVNSfaZ3Awo4g:Mp8WGm+cXzfvfAZPWUPvN44o4g
MD5:	35800B903BDF12F4FD86195346ED7E2D
SHA1:	3C84F7F7A19EDBAB08F86885B15C7D9CBC7A0FBB
SHA-256:	B9597FDE4CB74FE2934FCFBD16D22DBA7DECEC9ACAD721D077AF94911E2C520F
SHA-512:	5305B68E7E92C4D27429F282D8E2E5FDE0DF2E390815CD16FD97F49086FACFA65373DE207B1A50CF9DB75740A97AC9E59B6ACF2C1CB705DB5CB791E0F837373B
Malicious:	false
Preview:	o....................................@....f...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.e.j.Z.d.Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..c_ubyte...._raw_keccak_libc....................@....X...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)...SHA3_384_Hash..A SHA3-384 hash object.. Do not instantiate directly.. Use the :func:`new` function... :ivar oid: ASN.1 Object ID. :vartype oid: string.. :ivar digest_size: the size in bytes of the resulting hash. :vartype digest_size: integer. .0.....2.16.840.1.101.3.4.2.9.h...c....................C....p...\|.\|._.d.\|._.d.\|._.t...}.t...\|.....t.\|.j.d.....t.d.....}.\|.r$t.d.\|.......t.\|.....t.j...\|._.\|.r6\|...\|.....d.S.d.S.).NF................&Error %d while instantiating SHA-3/384...._update_after_digest.._digest_done.._paddingr....r......keccak_ini

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA3_512.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4663
Entropy (8bit):	5.424831856460013
Encrypted:	false
SSDEEP:	96:MQ4eykv/0we5fbGxljnH00HXzfYZXCPOs6ekBUuoigNSfBe3Awo4c:Mp80glnHXzfpPAekBU/N48o4c
MD5:	E7F33F57B4BE2D0C3F0AB0CF7D7EB53C
SHA1:	9C6992A639169FE632893D52E233A44C46FC1876
SHA-256:	A7425D34ADA8281D9D9A05B6600A3B3A6F18884C162E08B6B5FE4B82F3276F64
SHA-512:	B368D8D74D455B2840DA85EF0AF299456D8F675817EC2DBAEB07A2FEC9328D03E3B2EEFAEDDD0BC725B3E3B65F52FD63D73EEB89EA7E72408E596A77CF9F18BA
Malicious:	false
Preview:	o....................................@....f...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.e.j.Z.d.Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..c_ubyte...._raw_keccak_libc....................@....N...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...SHA3_512_Hash..A SHA3-512 hash object.. Do not instantiate directly.. Use the :func:`new` function... :ivar oid: ASN.1 Object ID. :vartype oid: string.. :ivar digest_size: the size in bytes of the resulting hash. :vartype digest_size: integer. .@.....2.16.840.1.101.3.4.2.10.H...c....................C....p...\|.\|._.d.\|._.d.\|._.t...}.t...\|.....t.\|.j.d.....t.d.....}.\|.r$t.d.\|.......t.\|.....t.j...\|._.\|.r6\|...\|.....d.S.d.S.).NF................&Error %d while instantiating SHA-3/512...._update_after_digest.._digest_done.._paddingr....r......keccak_init..addres

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\SHA512.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	5.211870155570872
Encrypted:	false
SSDEEP:	96:ewbykv2OwpRrToqHNEd5gxcMzNyEB1Hq8I2jLZXB/Os6R9LP2YyGG2mDXMswn:evOERvoq2xEB9Pj7AR9LPHYKn
MD5:	F0E19BFB61D74C6CB6F96959F7CD3C4D
SHA1:	A92465DB34436BB81D03B68BB078ECFEF1B47CD5
SHA-256:	916228C4885E34BDF9D7F8173A6DB38C60ECC287261114270D3C09B7B681D955
SHA-512:	DA96B6D9F1409AC4283BBD9E8CDE4F9A4A4C3A5AB3624F7A683996112671F0893DC0A18838DF879E52FE35C8ED2B43681FCFFB8EE789CD71703D48000E8BC1D5
Malicious:	false
Preview:	o....................................@....h...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..Crypto.Hash._SHA512...... int SHA512_init(void *shaState,. size_t digest_size);. int SHA512_destroy(void shaState);. int SHA512_update(void hs,. const uint8_t buf,. size_t len);. int SHA512_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA512_copy(const void src, void dst);.. int SHA512_pbkdf2_hmac_assist(const void *inner,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.212941287344097
Encrypted:	false
SSDEEP:	192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
MD5:	F4EDB3207E27D5F1ACBBB45AAFCB6D02
SHA1:	8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
SHA-256:	3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
SHA-512:	7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.181291194389683
Encrypted:	false
SSDEEP:	192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5:	9D28433EA8FFBFE0C2870FEDA025F519
SHA1:	4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
SHA-256:	FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
SHA-512:	66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140195114409974
Encrypted:	false
SSDEEP:	192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
MD5:	8A92EE2B0D15FFDCBEB7F275154E9286
SHA1:	FA9214C8BBF76A00777DFE177398B5F52C3D972D
SHA-256:	8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
SHA-512:	7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.203867759982304
Encrypted:	false
SSDEEP:	192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
MD5:	FE16E1D12CF400448E1BE3FCF2D7BB46
SHA1:	81D9F7A2C6540F17E11EFE3920481919965461BA
SHA-256:	ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
SHA-512:	A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478301937972917
Encrypted:	false
SSDEEP:	192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
MD5:	34EBB5D4A90B5A39C5E1D87F61AE96CB
SHA1:	25EE80CC1E647209F658AEBA5841F11F86F23C4E
SHA-256:	4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
SHA-512:	82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.69608744353984
Encrypted:	false
SSDEEP:	384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
MD5:	42C2F4F520BA48779BD9D4B33CD586B9
SHA1:	9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
SHA-256:	2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
SHA-512:	1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.7981108922569735
Encrypted:	false
SSDEEP:	384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5:	AB0BCB36419EA87D827E770A080364F6
SHA1:	6D398F48338FB017AACD00AE188606EB9E99E830
SHA-256:	A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
SHA-512:	3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865452719694432
Encrypted:	false
SSDEEP:	384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
MD5:	C8FE3FF9C116DB211361FBB3EA092D33
SHA1:	180253462DD59C5132FBCCC8428DEA1980720D26
SHA-256:	25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
SHA-512:	16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867732744112887
Encrypted:	false
SSDEEP:	384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5:	A442EA85E6F9627501D947BE3C48A9DD
SHA1:	D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
SHA-256:	3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
SHA-512:	850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860044313282322
Encrypted:	false
SSDEEP:	384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
MD5:	59BA0E05BE85F48688316EE4936421EA
SHA1:	1198893F5916E42143C0B0F85872338E4BE2DA06
SHA-256:	C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
SHA-512:	D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.917025846093607
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
MD5:	8194D160FB215498A59F850DC5C9964C
SHA1:	D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
SHA-256:	55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
SHA-512:	969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.532329371511474
Encrypted:	false
SSDEEP:	48:gpokzpHdkloLwZGD2oGw61LmAzZGGwyER9IIIXII69:UlHd/2vCGhuZ
MD5:	AE9C9A4E15E47AAEEC5473C4C33FD580
SHA1:	B61FCDC9ADE87D978438CFB72406DB78998B4E28
SHA-256:	2367910B8B596E23245B231A63CDEB8DE3BF0DEC3D0713CCF34C111BA3DE09D8
SHA-512:	5922D4439617D76A372C1F4C754969B68DE96986AD9143C5CDC12EDBB4AB38DDE489035B2FB4C32C0FB8DE16201E370BE154781AC17C240DBB8E2D8F17FDB7E0
Malicious:	false
Preview:	o....................................@........g.d...Z.d.d...Z.d.S.).....HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512..CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C....T...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........)..KReturn a new hash instance, based on its name or. on its ASN.1 Object ID..z.1.3.14.3.2.26r....z.SHA-1.......r......z.2.16.840.1.101.3.4.2.4r....z.SHA-224..r......z.2.16.840.1.101.3.4.2.1r....z.SHA-256..r......z.2.16.840.1.101.3.4.2.2r....z.SHA-384..r......z.2.16.840.1.101.3.4.2.3r....z.SHA-512..r......z.2.16.840

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.999870226643325
Encrypted:	false
SSDEEP:	192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
MD5:	C89BECC2BECD40934FE78FCC0D74D941
SHA1:	D04680DF546E2D8A86F60F022544DB181F409C50
SHA-256:	E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
SHA-512:	715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.025153056783597
Encrypted:	false
SSDEEP:	192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5:	C4CC05D3132FDFB05089F42364FC74D2
SHA1:	DA7A1AE5D93839577BBD25952A1672C831BC4F29
SHA-256:	8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
SHA-512:	C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.235115741550938
Encrypted:	false
SSDEEP:	192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
MD5:	1E201DF4B4C8A8CD9DA1514C6C21D1C4
SHA1:	3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
SHA-256:	A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
SHA-512:	19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.133714807569085
Encrypted:	false
SSDEEP:	192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
MD5:	76C84B62982843367C5F5D41B550825F
SHA1:	B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
SHA-256:	EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
SHA-512:	03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\keccak.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5478
Entropy (8bit):	5.131592337482681
Encrypted:	false
SSDEEP:	96:Ivykv5F7y2Z52MBXsjnH00jQCNeRZXDF0Qe7PwoLBvLRlKwB:IhIPQXsBjQCNDzbwmLjdB
MD5:	76B1B72094A0ADF412EFBB76FD8F48DE
SHA1:	471B74A7685D5E9E3D4619265FAC0C5FBBC4C2EE
SHA-256:	95C788EC8C9E0103F499DDB0A95EF2EDF7A31A874E0B2020B4A8F54E360D1A30
SHA-512:	F63B5ECE3323901F59DF6B9E76A2B692A2919868CF70F9EF94266EBE47CB8601754D6E975A5D4A62201B9279443CC30767282D9F93FA8CECC50FB871BC02CD46
Malicious:	false
Preview:	o....................................@....Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)..........bord....load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptr..c_ubyte..Crypto.Hash._keccak...... int keccak_init(void *state,. size_t capacity_bytes,. uint8_t rounds);. int keccak_destroy(void state);. int keccak_absorb(void state,. const uint8_t in,. size_t len);. int keccak_squeeze(const void state,. uint8_t out,. size_t len,. uint8_t padding);. int keccak_digest(void *state,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.928082706906375
Encrypted:	false
SSDEEP:	768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
MD5:	B41160CF884B9E846B890E0645730834
SHA1:	A0F35613839A0F8F4A87506CD59200CCC3C09237
SHA-256:	48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
SHA-512:	F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\KDF.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	20353
Entropy (8bit):	5.465606715484852
Encrypted:	false
SSDEEP:	384:JwkALFMLX4XG+Wb/2nIxVhNpRtBQwOTgwphbyJWazxbmHhqYsP:JLAehb/CIxVhNpRtOf/byJWWxbZYsP
MD5:	06C04E481EC192C5F2463F65FE2F698E
SHA1:	6F7F76AFE1F9B3F92860D5FA2C8456676DB08930
SHA-256:	057EED8C5D2019E0B6F5D8370A4CBE34CC84151E4FEC511B6F8FF3AB45643C20
SHA-512:	1A71C2F9D71F6CE5EC6A370626000CC968B27E1FDFAD86B2E95E9A5C998ED2D610A101171824D4A60B136B83DFC1555B21C987F73BEF4BE36E95D75131E12DA1
Malicious:	false
Preview:	o....................................@....$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N....reduce....tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr....SHA1..SHA256..HMAC..CMAC..BLAKE2s....strxor....get_random_bytes....size..long_to_bytes..bytes_to_long....load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_t..Crypto.Cipher._Salsa20... int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. ..Crypto.Protocol._scrypt...... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.467313722462856
Encrypted:	false
SSDEEP:	3:ztWlVlGplK4liueUCN+Z/UA6gDkwlQllhUYBLOMLkcTg/lV:gep3lXed+Z/UA6+XlQ/5BL9MX
MD5:	CDFB95EC34A4F8AF7331CE212D9A546F
SHA1:	30DC0F1B52562CB0261AA2931AA11DAB1964C516
SHA-256:	105802CFAA2832E4EC22D25884155E092EC5B6A9C25A96FBC55ECE48E90709BA
SHA-512:	9E7AEEF0C4F9DBA33DE417362A4D09139767BB5F15ED9A0AFA2F0471C47CDA6B388FCC424AB150384E54F0AD1AF18101C5AD91E8AD2D8BF6DED39B31C32A704B
Malicious:	false
Preview:	o....................................@........g.d...Z.d.S.)...Z.KDFZ.SecretSharingZ.DHN....__all__..r....r....z.Crypto\Protocol\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799063285091512
Encrypted:	false
SSDEEP:	192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5:	BA46602B59FCF8B01ABB135F1534D618
SHA1:	EFF5608E05639A17B08DCA5F9317E138BEF347B5
SHA-256:	B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
SHA-512:	A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959985050181
Encrypted:	false
SSDEEP:	12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
MD5:	3F20627FDED2CF90E366B48EDF031178
SHA1:	00CED7CD274EFB217975457906625B1B1DA9EBDF
SHA-256:	E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
SHA-512:	05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792654050660321
Encrypted:	false
SSDEEP:	384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
MD5:	290D936C1E0544B6EC98F031C8C2E9A3
SHA1:	CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
SHA-256:	8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
SHA-512:	F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060461288575063
Encrypted:	false
SSDEEP:	1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
MD5:	5782081B2A6F0A3C6B200869B89C7F7D
SHA1:	0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
SHA-256:	E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
SHA-512:	F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488437566846231
Encrypted:	false
SSDEEP:	96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
MD5:	289EBF8B1A4F3A12614CFA1399250D3A
SHA1:	66C05F77D814424B9509DD828111D93BC9FA9811
SHA-256:	79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
SHA-512:	4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Random\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.561892485594217
Encrypted:	false
SSDEEP:	24:gUktWRuX2UFOd31erOYRnkOCUqBRQELLELDq1HJ4eBHkS7cRns/:gQRHdleKYZEUqicLcDAP74k
MD5:	2B35597FC80F141C89F7C6813E31642D
SHA1:	DECDE84E4DF6E862D8231269FB5D765F58FB8F11
SHA-256:	DABB7D80017A85DADEFA9A7C55B4DFE00B3B0A1DB5139DB54AD3DAF64BBACE52
SHA-512:	B9FE8AEA133657BBFEC745D9F30B4511BF3BE7FF26BE673C619B93B21C252470AB48FDC04CA1ACD9FFE5C8126AFFC2536C53C29B13C2CBDDB221A7F08E912FBB
Malicious:	false
Preview:	o....................................@....<...d.d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d...Z.e.Z.d.S.)...new..get_random_bytes.........urandomc....................@....,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._UrandomRNGc....................C........t.\|...S.)..0Return a random byte string of the desired size.r........self..n..r......Crypto\Random\__init__.py..read............._UrandomRNG.readc....................C........d.S.)..0Method provided for backward compatibility only.Nr......r....r....r....r......flush!............_UrandomRNG.flushc....................C...r....).r....Nr....r....r....r....r......reinit%...r......_UrandomRNG.reinitc....................C...r....).r....Nr....r....r....r....r......close)...r......_UrandomRNG.closeN....__name__..__module__..__qualname__r....r....r....r....r....r....r....r....r.......................r....c....................O........t...S.)..FReturn a file-like object that outputs cryptographically random bytes...r........args..kwarg

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\Padding.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2289
Entropy (8bit):	5.405046375857783
Encrypted:	false
SSDEEP:	48:gGCbQJrnAeKJdRXlz2KAFsx3miW7WlxeKbNRTAy8edkBQMZ:jCbQJDAeqz22W6re63AsZY
MD5:	694AD12569525ABAED3828DB4611FB9F
SHA1:	D44789BCE976BF39CE33695517578B88A137ACC0
SHA-256:	7DBADF8821588AA61168825175EE96E04338F359C34DA6E662E33F12F47E8702
SHA-512:	9FF10614854F565DDC899AD9A71DFF41079B9BBA4042A79A39A063BF3D6E9D73567200ADA454A0899B23FBD1A1411A44DE0B284506F250AB022F186B9AA62251
Malicious:	false
Preview:	o....................................@....(...d.d.g.Z.d.d.l.T.d.d.d...Z.d.d.d...Z.d.S.)...pad..unpad...........pkcs7c....................C.......\|.t.\|...\|.....}.\|.d.k.r.t.\|...\|...}.\|.\|...S.\|.d.k.rt.d...\|.d.....t.\|.....}.\|.\|...S.\|.d.k.r>t.d...t.d...\|.d.......}.\|.\|...S.t.d.....)......Apply standard padding... Args:. data_to_pad (byte string):. The data that needs to be padded.. block_size (integer):. The block boundary to use for padding. The output length is guaranteed. to be a multiple of :data:`block_size`.. style (string):. Padding algorithm. It can be 'pkcs7' (default), 'iso7816' or 'x923'... Return:. byte string : the original data with the appropriate padding added at the end.. r......x923r...........iso7816......Unknown padding style....len..bchr..ValueError..Z.data_to_pad..block_size..style..padding_len..padding..r......Crypto\Util\Padding.pyr....'..............................c....................C........t.\|...

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	4.763527789838521
Encrypted:	false
SSDEEP:	24:g5l274ApU2gWfri+RHvEIO4oFaQvuYjVrGivBlCmC:g5lbASgf++BcD4YaQVprGGBEB
MD5:	4543969CBD3C591F3AED65B6736C33F9
SHA1:	BA20E634996B0E89D01DCB5AFE113606F94C95F6
SHA-256:	556416E5C767CE50E376CC0E73AFB7CF6885630D79876980CE819DBC0F931135
SHA-512:	2E771B988EAAFDC10FEE3286903127C83CF79FCC4FA2A75C2F45E829801BC29ED5112000EC0D8CFC5869B8936614DC653518D0B5D861B6565AA2FD9BA9010848
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.d.S.)..[...Miscellaneous modules..Contains useful modules that don't belong into any of the.other Crypto.* subpackages...======================== =============================================.Module Description.======================== =============================================.`Crypto.Util.number` Number-theoretic functions (primality testing, etc.).`Crypto.Util.Counter` Fast counter functions for CTR cipher modes..`Crypto.Util.RFC1751` Converts between 128-bit keys and human-readable. strings of words..`Crypto.Util.asn1` Minimal support for ASN.1 DER encoding.`Crypto.Util.Padding` Set of functions for adding and removing padding..======================== =============================================..:undocumented: _galois, _number_new, cpuid, py3compat, _raw_api...Z.RFC1751..number..strxorZ.asn1..CounterZ.PaddingN....__doc__..__all__

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpu_features.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	4.355613545182689
Encrypted:	false
SSDEEP:	12:g/nQ4UlaLgAdUn1w07AZKvrEwWaqEJ0HvqqR:gTUl3Ain1wkAZKlWaqEJAvqqR
MD5:	DB1029C0828B1FD9EDC3DE21F0724632
SHA1:	C2777ECC5A9687B0B47D82FF0E2D8EC31D9F831A
SHA-256:	0DAC8539D3FA131F7045F7C89E4231E12AD68E128FE6EA6D633D8A78AE9D798E
SHA-512:	5BBF9CEE015E4677E94AA8AFF756127910ED386A5CEB2A56D02CE15CDCF2D76A0D5F33C6F4A42BFCD860FC406846C73F8FCDBF2DA3078B4CB8B8AFC5CF57A6A3
Malicious:	false
Preview:	o....................................@....*...d.d.l.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)..........load_pycryptodome_raw_lib..Crypto.Util._cpuid_c... int have_aes_ni(void);. int have_clmul(void);. c....................C........t.....S.).N...._raw_cpuid_lib..have_aes_ni..r....r......Crypto\Util\_cpu_features.pyr....)..........r....c....................C...r....).N..r......have_clmulr....r....r....r....r....-...r....r....N....Crypto.Util._raw_apir....r....r....r....r....r....r....r......<module>.....................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730605326965181
Encrypted:	false
SSDEEP:	96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5:	4D9C33AE53B38A9494B6FBFA3491149E
SHA1:	1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
SHA-256:	0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
SHA-512:	BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_file_system.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	5.216816549610745
Encrypted:	false
SSDEEP:	12:geZQeLuq3LEgiVfDIT1xCZvZBQcOiKZRGOSzJVxsC8m4sgyVxwOrSJNCzh9krMeC:geBLuaoA2HBZ8SlwC8El3O8zh8MP
MD5:	A13FED8828A48BAF46E41872B6052999
SHA1:	D401123081C41408E5702B838FFCF14C1984D284
SHA-256:	C6B317DF1A99B87E0538B6C66839BFAAC32180DE658089687F0CCE0224CD6FC2
SHA-512:	6719E23140D60C8AA5C2A4274C2A645892826F80D7BEE32DC7AB78963222A3A7A99738DC8DA92D1A785F18B2F3823A19E277361FFF82845C0BB321468FD1180F
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d...Z.d.S.)......Nc....................C....d...\|.d...d.k.r.t.d.....t.\|.d.d.......\|.g...}.t.j...t.j...t.....\.}.}.t.j...\|.d...}.t.j.j.\|.g.\|...R...S.)......Return the complete file name for the module.. dir_comps : list of string. The list of directory names in the PyCryptodome package.. The first element must be "Crypto"... filename : string. The filename (inclusing extension) in the target directory.. r......Crypto.)Only available for modules under 'Crypto'.....N........ValueError..list..os..path..split..abspath..__file__..join....dir_comps..filenameZ.util_lib.._Z.root_lib..r......Crypto\Util\_file_system.py..pycryptodome_filename"....................r......r....r....r....r....r....r......<module>.............

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_raw_api.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8660
Entropy (8bit):	5.262097314969627
Encrypted:	false
SSDEEP:	96:LWTlLaVZEmSeYvYF3Y5Yg5eK5LEwKeQWiZIHWQHtGc16fU9/zPq0ZIMd29shFSau:6hLzSNOJQQLtB5zHII/UclN1E/N
MD5:	3EE93C3BF4B943E83DD4E5CEA87F8718
SHA1:	FABB9D4AE0B6D3213EF6573DF00FA27D21D7DB3B
SHA-256:	B1D97B0EDDAA6B86CDE97155E5C2969EC3C8BA4446395186B64FAC165F03FD5F
SHA-512:	5E0A56B67AC93F4038931AD621CD6542EE09DC52F52C4FD4F51EC55413F8A00DDC68E8011872736C312A78DC34807D10D09D6991265D9C890579B3AFEE0713BA
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.d...d.k.r:d.d.l.Z.g.Z.e.....D.].\.Z.Z.Z.e.e.j.k.r8e...e.....q)n.d.d.l.m.Z...e.j.Z.e.e.f.Z.G.d.d...d.e...Z.zkd.e.j.v.r_e.j.j.d.k.r_e.d.....e.j.d.k.rme.j.d.k.rme.d.....d.d.l.m.Z...e...Z.e.j Z!e.."e..#d.....Z$e..#d...j%j&Z'd.d...Z(d.d...Z)e)Ze)Z+e)Z,d.d...Z-d;d.d...Z.d.d...Z/d.d...Z0d.d...Z1G.d.d ..d e...Z2d!d"..Z3d#Z4W.nt..e...y.......d.d.l5Z5d.d$l5m6Z6m7Z7m8Z8m)Z)mZm-Z-m.Z.m,Z,m+Z+..d.d%l9m:Z:..d.d&l5m;Z'..d.Z!g.Z<d'd(..Z,d)d...Z(dd...Z/d+d...Z0e5j=Z>d.Z?e5j@jAZBe5j@jCZDe5jEZFe5.Ge>..ZHG.d,d-..d-e5jI..ZJd.d...Z1G.d/d0..d0e...ZKd1d"..Z3d2Z4Y.n.w.G.d3d4..d4e...ZLd5d6..ZMd7d8..ZNd9d:..ZOd.S.)<.....N....byte_string....pycryptodome_filename.........machineryc....................@....(...e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.d.S.)..._VoidPointerc....................C........d.S.)..&Return the memory location we point toN......selfr....r......Crypto\Util\_raw_api.py..get:............_VoidPointer

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685843290341897
Encrypted:	false
SSDEEP:	96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5:	8F4313755F65509357E281744941BD36
SHA1:	2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
SHA-256:	70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
SHA-512:	FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\number.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	61081
Entropy (8bit):	5.248309682539082
Encrypted:	false
SSDEEP:	1536:knptN5xZjyUy0lwXEgNjOtg78YrIn6VhjlLQ5DR4wLDzwK2csHXH:kn/xpyUy0lsEgZOtg78sI6VTLQ5DRvvc
MD5:	E9C7B71793418C1A36EC4C962F0B16B9
SHA1:	A9467D61B9295EA01AF378119ACAD1ACDE0E8BF1
SHA-256:	73579C02F17E394702DF0784BA8F03D65303F9B79668C40DA60D68501EF737E3
SHA-512:	5610D9C758DBFE854085F12C1776C51532BF0A555A8619F91275136B093CA8F34195B891F4EC0DE22F883704B0BB2DCF1A8E23F1F7A61618C008637EE673C185
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.d(d.d...Z.d(d.d...Z.d(d.d...Z.e.j.d.d.....d.k.r>e.j.Z.n.d.d...Z.e.j.d.d.....d.k.rPd.d...Z.n.d.d...Z.d(d.d...Z.d(d.d...Z.d)d.d...Z.dd.d...Z.d.d.l.Z.d+d.d ..Z.d!d"..Z.d.d.l.Z.d+d#d$..Z.d%d&..Z.d'Z.d.S.),.....N....Random....iter_rangec....................C....P...\|.d.k.r.t.....\|.d.k.s.\|.d.k.r.t.d.....t.\|.\|...\.}.}.\|.d.k.r&\|.d.k.r&\|.d.7.}.\|.S.)..DReturn ceil(n/d), that is, the smallest integer r such that rd >= nr......Non positive values.........ZeroDivisionError..ValueError..divmod....n..d..r..q..r......Crypto\Util\number.py..ceil_div%........................r....c....................C........\|.d.k.r.t.d.....\|.....S.)..)Returns the size of the number N in bits.r.....4Size in bits only available for non-negative numbers..r......bit_length....Nr....r....r......size2..............r....c....................C....Z...\|.d.u.r.t.j.}.\|.\|.d.?...}.\|.d...}.\|.d.k.r't.\|.d.....d.\|...?.}.t

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\py3compat.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5172
Entropy (8bit):	4.954378297408555
Encrypted:	false
SSDEEP:	96:XcF/EpktYDLOjIWTmpSaRBF7mgXIoxnkU5z+YKLA+wsyQ2zL3TEBLEyuVU4Bt:XW/EpkGUIW82fhU9lXsvOXE2VUA
MD5:	28848A6A8742A0595E0D453722DD60FE
SHA1:	99F7CAEC60900D743188D1DBB3089D146EFD3018
SHA-256:	A215C5C0262F6715F9974F12BB6A0916BE7CC74B2871E3222EF056C652DB654A
SHA-512:	98BF77BC54A45F082BC59D7AA5893570017A1E01744E9EDE561FFF6AE366AE9C4C13E4BD3D9BDF547365B2BDB7F90AA6BEC3D9A0BE892009BF2EA7E0D78F6717
Malicious:	false
Preview:	o....................................@....X...d.Z.d.d.l.Z.d.d.l.Z.e.j.d...d.k.r[d.d...Z.d.d...Z.d.d...Z.d.d...Z.d0d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.m.Z...e.Z.d.d.l.m.Z...e.Z.d.d...Z.d.d...Z.d.d...Z.e...d.e.f.d.d.i...Z.e.Z.nId d...Z.d!d...Z.d"d...Z.d#d...Z.d0d$d...Z.d%d...Z.d&d...Z.d'd...Z.d.d(l.m.Z...d.d.l.m.Z...d.d)l.m.Z...e.Z.d*d...Z.d+d...Z.d,d...Z.d.d-l.m.Z...e.Z.d.d/..Z.[.[.d.S.)1....Compatibility code for handling string/bytes changes from Python 2.x to Py3k..In Python 2.x, strings (of type ''str'') contain binary data, including encoded.Unicode text (e.g. UTF-8). The separate type ''unicode'' holds Unicode text..Unicode literals are specified via the u'...' prefix. Indexing or slicing.either type always produces a string of the same type as the original..Data read from a file is always of '''str'' type...In Python 3.x, strings (type ''str'') may only contain Unicode text. The u'...'.prefix and the ''unicode'' type are now redundant. A new type (called.''bytes'') has to b

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\strxor.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3211
Entropy (8bit):	5.090322805928097
Encrypted:	false
SSDEEP:	48:gajdkxR/B0sI/LU/kwf+RDQ+XfSuc0FVQuWP/Z63p3ArWPqE8PRW2QlOqetxC2R:hxkv/3WLJwyJf9c0Fuz/Z6xyWL86M
MD5:	544A52EAA18578CA23E2185E9F6080AB
SHA1:	524FD28E79392A86D02E64C512BFCA817A6DD042
SHA-256:	2892FDE7DB96FA625005379113E1CBBB8C49E4D7510951EE67DDB92D769D2FE3
SHA-512:	6019386F5221E5593E08E3DDF56F9CD13A481DAC3FCCA9703EA026206A906C7704A6C5BBEAB0893D5CC62C3C8349EECCC7A45383D3D3097BD69225C901597B35
Malicious:	false
Preview:	o....................................@....J...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)..........load_pycryptodome_raw_lib..c_size_t..create_string_buffer..get_raw_buffer..c_uint8_ptr..is_writeable_buffer..Crypto.Util._strxor.y.... void strxor(const uint8_t in1,. const uint8_t in2,. uint8_t out, size_t len);. void strxor_c(const uint8_t in,. uint8_t c,. uint8_t *out,. size_t len);. Nc....................C.......t.\|...t.\|...k.r.t.d.....\|.d.u.r.t.t.\|.....}.n.\|.}.t.\|...s!t.d.....t.\|...t.\|...k.r1t.d.t.\|.........t...t.\|...t.\|...t.\|...t.t.\|.........\|.d.u.rKt.\|...S.d.S.).....From two byte strings of equal length,. create a third one which is the byte-by-byte XOR of the two... Args:. term1 (bytes/bytearray/memoryview):. Th

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.913351983003839
Encrypted:	false
SSDEEP:	6:gYpT21NXQNAL/tdxmAfTwAv44Gl/llYleZakvuPlOnitRYPbWQt0xabA/s/9i9n:gYpkokxFjkZaUXnitRMWwuZF
MD5:	605CA9EF1F855CF946AC587943BF0781
SHA1:	F67655A4B875872A9A2880FC972B17436C9A1991
SHA-256:	68EE40F77B0459CEB974AF11923A116CDA97E84C4196E0FA97C301ACB367C6DD
SHA-512:	9213C44B0BD1B1A06E4EF30C210E61A4B7A783444B8AF05592DAFAF459B7F8D62DC1F0790202F11F0C1389C2D58DA7DBB1C0268BB73297C380F5CB252F2CE5CC
Malicious:	false
Preview:	o....................................@....$...g.d...Z.d.Z.d...d.d...e.D.....Z.d.S.)...Z.CipherZ.Hash..ProtocolZ.PublicKeyZ.Util..Signature..IOZ.Math..............0...c....................C........g.\|.].}.t.\|.....q.S.).....str.....0..x..r......Crypto\__init__.py..<listcomp>...........r....N....__all__..version_info..join..__version__r....r....r....r......<module>...............

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\BlpImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12338
Entropy (8bit):	5.520220126447175
Encrypted:	false
SSDEEP:	192:Px9Eb9UdoExZPdKd6OnMT9LhEfdD2Ay6zPGOA9um/chVS3bdTCASsK:gxExZVcMNha2X6zuOIWhVSq
MD5:	E7D86FD747D5A13398D02C09762CCCEA
SHA1:	BA13092D8BA089C8CE1A9A545A09B544E9A3E92D
SHA-256:	4A4488155F97A17B6B7632B94449E526E761A9E073F2E47FD72AC010359F69B2
SHA-512:	E8A7AB405D5A776BE093BB68645FBAD47080B9716C240C3AA33DE8C099631625DA1CE5DDE2675B0F65DCFC5417D4B5BF4475941B02FDCC3BED80BD2D26DD1D00
Malicious:	false
Preview:	o....................................@....d...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e.j...Z.d%d&..Z.e...e.j.e.e.....e.. e.j.d'....e..!d(e.....e..!d)e.....e.."e.j.e.....e..#d*e.....d.S.),......Blizzard Mipmap Format (.blp).Jerome Leclanche <jerome@leclan.ch>..The contents of this file are hereby released in the public domain (CC0).Full text of the CC0 license:. https://creativecommons.org/publicdomain/zero/1.0/..BLP1 files, used mostly in Warcraft III, are not fully supported..All types of BLP2 files used in World of Warcraft are supported...The BLP file structure consists of a header, up to 16 mipmaps of the.texture..Texture sizes must be powers of two, though the two dimensions do.not have to be equal; 512x256 is valid, but 512x200 is not..The first mipmap (mipmap #0) i

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\BmpImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8781
Entropy (8bit):	5.565633214319591
Encrypted:	false
SSDEEP:	192:C9XgXeqyEKzEC91hiZUteNgvNYroxyJlGy9Hm:C/vzNkZ1avic
MD5:	9E885D1587EB7FD0549B685951344D9C
SHA1:	947164D45D6B63D721950159CDAD1D4BB0242452
SHA-256:	4571B5CAA2261248A9E8ADCFEF41A151169BCEEBC825CA5847B2F258F86B1230
SHA-512:	3F0F7BBAD279236BD26CD7BA29782BAC0AA4B7B8443FCB7B313146AC3F3BAFC9E9DEFCF6EE53DE59F018118A1F886E36CD2853BFD4448A67E7E2433B84DD0CD2
Malicious:	false
Preview:	o....................................@....`...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.d.d.d.d.d.d ..Z.d!d"..Z.d*d$d%..Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d&....e...e.j.d'....e.. d(e.....e...e.j.e.e.....e...e.j.e.....e...e.j.d)....e...e.j.d'....d.S.)+.........annotationsN.........Image..ImageFile..ImagePalette....i16le....i32le....o8....o16le....o32le....Pz.P;1..r....z.P;4..r....r........RGB..BGR;15..r......BGR..r......BGRX..r......................... ...c....................C........\|.d.d.....d.k.S.).N..........BM......prefixr(...r(.....PIL\BmpImagePlugin.py.._accept3..........r,...c....................C........t.\|...d.v.S.).N........(....@....l....\|.......i32r)...r(...r(...r+....._dib_accept7..........r7...c....................@....X...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d.d.d.d.d...Z.e.....D.].\.Z.Z.e.e...e.<.q.d.d.d...Z.d.d...Z.d.S.)...BmpImageFil

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\BufrStubImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	5.083979510711263
Encrypted:	false
SSDEEP:	48:gQYBgBDs5xrkr6yH4ziCdV4RAg+BUiRP0g/CMXExgUw:RYBgts5xrkGyYziCdV6oBvm0CaExgUw
MD5:	D9074A8A6E17F5302C80077AB808B72B
SHA1:	4966DF3367ECCBBC5240DDBDD86B93A97658DFC2
SHA-256:	7AE3594C4AB2D4BDEB1509335DA5033D71884549E03E1C49DAB20F76D733D5BE
SHA-512:	E48AC038FC2422E686CA865C48C70819499256BB0F7BBBA8203683FCE9B777D5B812DA80500926C5FF02C546302EFF6FE37BF882280000B42949B9996E45B031
Malicious:	false
Preview:	o....................................@....z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.a.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....d.S.)..........annotations.........Image..ImageFileNc....................C........\|.a.d.S.).._. Install application-specific BUFR image handler... :param handler: Handler object.. N...._handler....handler..r......PIL\BufrStubImagePlugin.py..register_handler...........r....c....................C.... ...\|.d.d.....d.k.p.\|.d.d.....d.k.S.).N..........BUFR.....ZCZCr........prefixr....r....r......_accept ........ .r....c....................@....$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...BufrStubImageFile..BUFRc....................C....\...\|.j.....}.t.\|.j...d.....s.d.}.t.\|.....\|.j...\|.....d.\|._.d.\|._.\|.....}.\|.r,\|...\|.....d.S.d.S.).Nr......Not a BUFR file..F..r....r........fp..tellr......read..SyntaxError..seek.._mode.._size.._load..open....self..offset..msg..loaderr....r....r......_open(................................Buf

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\CurImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	5.241008134389485
Encrypted:	false
SSDEEP:	24:gu/BBeHn8BhIlkZ6qk3eaozWUmAZc6OJTpS/vY/GbgI9357KlPNo82J4vJ9nw55i:geBw8Bgkfk31UWDT6eTg/vY/y9Jl8ZBF
MD5:	AAEF271573D86342515F528261DF9F26
SHA1:	6AB0FF6DFCB0983B14F1B2B5980F72C092AD7C28
SHA-256:	89C6A93AA3A4A1F3817A0EE8685EBF4C3D6F4B7FD8409455EA8381B5772BFCAF
SHA-512:	9C0D09FA661AE184B1C268E69856187DB7B0AAE9108DA33F0AB1BD5FC01465E397A986CE8BD5CC8BFBB4E31A532C9982E99B5C481C9B4721D61340C811779041
Malicious:	false
Preview:	o....................................@....p...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)..........annotations.........BmpImagePlugin..Image....i16le....i32lec....................C........\|.d.d.....d.k.S.).N....................prefixr....r......PIL\CurImagePlugin.py.._accept...........r....c....................@........e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...CurImageFile..CUR..Windows Cursorc....................C........\|.j.....}.\|.j...d...}.t.\|...s.d.}.t.\|.....d.}.t.t.\|.d.....D.].}.\|.j...d...}.\|.s+\|.}.q.\|.d...\|.d...k.r=\|.d...\|.d...k.r=\|.}.q.\|.sFd.}.t.\|.....\|...t.\|.d...\|.......\|.j.d...\|.j.d...d...f.\|._.\|.j.d...\.}.}.}.}.\|.d.\|.j...\|.\|.f.\|.j.d.<.d.S.).N.......not a CUR file.....r.........r....r......No cursors were found............r....r........fp..tell..readr......SyntaxError..range..i16..TypeError.._bitmap..i32..size.._size..tile....self..offset..s..msg..m..i..d..e..o..ar....r....r......_open(....(....................... ..

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\DcxImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.09213751273137
Encrypted:	false
SSDEEP:	48:gSkx2H3/mwUz6iikPpHsiRKyyoWzxZMac:+wvU28MCFezHMz
MD5:	CE2B2E976B6FF68D07E491051E34E40F
SHA1:	9290222126F1BE4A5AEAB8C65CD285CECD32087B
SHA-256:	96966FE4C702E64300696102AF34BA149F1A3808C02BF3F1FC8E7D6E296C4C8E
SHA-512:	A4D0F9C75DD0DCBA85201E27FC10B72D1B679253E85CE5C008E710FCFEFDC763E8A8E046E3EF5E6C21DD8DEA804AD4A51C92F26C3706C09C4F3FF276438016DF
Malicious:	false
Preview:	o....................................@....n...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.G.d.d...d.e...Z.e...e.j.e.e.....e...e.j.d.....d.S.)..........annotations.........Image....i32le....PcxImageFile.h.:c....................C........t.\|...d.k.o.t.\|...t.k.S.).N.........len..i32..MAGIC....prefix..r......PIL\DcxImagePlugin.py.._accept ..........r....c....................@....0...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...DcxImageFile..DCX..Intel DCXFc....................C.......\|.j...d...}.t.\|...s.d.}.t.\|.....g.\|._.t.d...D.].}.t.\|.j...d.....}.\|.s%..n.\|.j...\|.....q.\|.j.\|._.d.\|._.t.\|.j...\|._.\|.j.d.k.\|._.\|...d.....d.S.).Nr......not a DCX file.....r....r........fp..readr......SyntaxError.._offset..ranger......append.._fp..framer......n_frames..is_animated..seek....self..s..msg..i..offsetr....r....r......_open-........................................DcxImageFile._openc....................C....<...\|...\|...s.d.S.\|.\|._.\|.j.\|._.\|.j...\|.j.\|.......t...\|.....d.S.).N...._s

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\DdsImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	13568
Entropy (8bit):	6.030471815289222
Encrypted:	false
SSDEEP:	192:+eP6kxtWfnAy2xe3yrquekVMm72sFjgAnd3HRVC78y9VDcOFSpFWA6j9N5HF4PGK:+U6nAuyrOkVMm7lBHRw8OS6jHz8h
MD5:	C2282A13E5461ECD5A10BCB44D31B59C
SHA1:	C466B65C186795F3BCC7BA62198E8324E3EBAFBB
SHA-256:	138EBB637C7034F234C7757BC8A8595CA5218B9D81E813EBE150F910FF14920E
SHA-512:	605321798935BE495E971AC3771C149522387DD00BCF7AD6211907211F44BC16850F309251E611DFDF0D90D73D2960224636FFB73B26807AE4F563121CB81C4A
Malicious:	false
Preview:	o....................................@....$...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e...Z.e.D.].Z.e.j.d.u.szJ...e.e.d.e.j...e.j ....qqe.D.].Z!e!j.d.u.s.J...e.e.d.e!j...e!j ....q.e.D.].Z"e"j.d.u.s.J...e.e.d.e"j...e"j ....q.e.D.].Z#e#j.d.u.s.J...e.e.d.e#j...e#j ....q.e.j$Z%e.j&Z'e.j&e.j(B.Z)e.jZ+e.je.j(B.Z,e.j-Z.e.j/Z0e.j1e.j2B.e.j3B.e.j4B.Z5e.j6Z7e.j8Z9e.j:Z;e.j<Z=e.j2Z>e.j3Z?e.j@ZAe.jBe.jCB.ZDe.jBZEe.jFe.jGB.ZHe.jFe.jIB.ZJe.jFe.jKB.ZLe.jFe.jMB.ZNe.jFe.jOB.ZPe.jFe.jQB.ZRe.jSZTe.jUZVe.jWZXe.jYZZe.j[Z\e.j]Z^e.j_Z`e.jaZbe.jcZde.jeZfe.jgZhe.jiZje.jkZle.jmZnG.d.d...d.e.j...ZoG.d.d...d.e.jp..Zqd.d ..Zrd!d"..Zse..teojueoes....e..vd#eq....e..weojuer....e..xeojud$....d.S.)%.....A Pillow loader for .dds files (S3TC-compressed aka DXTC).Jerome Leclanche <jerome@leclan.ch>..Documentation:.https://web.archive.org/web/2017

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\EpsImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9242
Entropy (8bit):	5.64989849542079
Encrypted:	false
SSDEEP:	192:ArLoaJdwqGCIWCSujbYbD79uKpMTlNyJhvtqB/xtuPxld8zAD4E:Anlbwqdl+gbD7xuryJhvtqBZsp04
MD5:	BC334EFF6FD101E33814031C14FAA594
SHA1:	5FCFD4F1AF6CA13DE5B4F8982E6D18054B9D8A19
SHA-256:	6F13700951FDAD0FD6B92A7EDEF127A6EFDE3014FEE7B6758BD41B36E0DFE012
SHA-512:	C4EBFD63692C7F0C0FC4FF847EAC140ADCB589921981FE015FAEBB41AAD4CC971C417AAF318D787C87CEA05D49FFC47B351E547476B49AD6D05B77448AA61CAE
Malicious:	false
Preview:	o....................................@........U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.d.a.d.e.d.<.d.a.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.d.g.....e.. e.j.d.....d.S.)..........annotationsN.........Image..ImageFile....i32le....deprecate..^%%([^:]):[ \t](.)[ \t]$..^%[%!\w]([^:])[ \t]$..str \| bool \| None..gs_binaryc....................C.......t.d.u.rJt.j...d...rt.d.u.r$d.d.l.}.d.D.].}.\|...\|...d.u.r!\|.a...n.q.d.a.t.a.t.d.u.S.z.t.j.d.d.g.t.j.d.....d.a.W.t.d.u.S...t.yI......d.a.Y.t.d.u.S.w.t.d.u.S.).N..winr......Z.gswin32cZ.gswin64c..gsFr......--version....stdout..r......sys..platform..startswith..gs_windows_binary..shutil..which..subprocess..check_call..DEVNULL..OSError..r......binary..r%.....PIL\EpsImagePlugin.py..has_ghostscript-.................................................r'...Fc....................C.......t...s.d.}.t.\|....

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\ExifTags.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	10158
Entropy (8bit):	5.880161368987175
Encrypted:	false
SSDEEP:	192:7FtjnAy29y2T4SG6pbtQPELBiQAY13FaUBc0ZkqRG+l9jdzoebW/zj2aEaDqNOeJ:7FtjAnqSfhtfLBiQAY1V1Bc0Zkq/7dzz
MD5:	94D280876BB750EBA107F0BC9622C0DD
SHA1:	9A5C3F5BFA351C7C52B4425FF799D0C8126EA8BE
SHA-256:	23CDD9C3BB1323B0210EB17FFC8A6CB4B284742410F1C336CF9E284B22461C58
SHA-512:	8305CA940F2B41BEB116F94D4712A032F26149556B514E944FB8373CC01D30BABF84BA7372FDA400D01B4591A629A4DE0C825F3411B375E76C938D44E1BBE691
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z...i.d.d...e.D.....d.d.d.d.d.d.d.....Z.G.d.d...d.e...Z...d.d...e.D...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)..W.This module provides constants and clear-text names for various.well-known EXIF tags...........annotations....IntEnumc....................@....v...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Zd)Z+dZ,d+Z-d,Z.d-Z/d.Z0d/Z1d0Z2d1Z3d2Z4d3Z5d4Z6d5Z7d6Z8d7Z9d8Z:d9Z;d:Z<d;Z=d<Z>d=Z?d>Z@d?ZAd@ZBdAZCdBZDdCZEdDZFdEZGdFZHdGZIdHZJdIZKdJZLdKZMdLZNdMZOdNZPdOZQdPZRdQZSdRZTdSZUdTZVdUZWdVZXdWZYdXZZdYZ[dZZ\d[Z]d\Z^d]Z_d^Z`d_Zad`ZbdaZcdbZddcZeddZfdeZgdfZhdgZidhZjdiZkdjZldkZmdlZndmZodnZpdoZqdpZrdqZsdrZtdsZudtZvduZwdvZxdwZydxZzdyZ{dzZ\|d{Z}d\|Z~d}Z.d~Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\FitsImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3622
Entropy (8bit):	5.3664274957396865
Encrypted:	false
SSDEEP:	96:VFkKfkJtW81ifz8sRYK72TGDY/FfApl6CYb:VYtWjYK72TGIAP6CYb
MD5:	DF2CF17C4AD732B3B9D9CCB388B59D7F
SHA1:	5B220C1F47D6BF692403299711C62942AC6BDDB5
SHA-256:	E97D3407A714E75415BD0A9F689CB5EF786443FF062B020C775CE07E4A8975B9
SHA-512:	09AB7F0F7995B76A000102A33CA7723A012B6781037A72ADAA706ECDFD0A400ABA11A8AA4FC7E012173638D7C7405FB5C823458441BB6A6E153334E0C3DEAC7B
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...d.e.....e...e.j.d.d.g.....d.S.)..........annotationsN.........Image..ImageFile..prefix..bytes..return..boolc....................C........\|.d.d.....d.k.S.).N..........SIMPLE....r....r....r......PIL\FitsImagePlugin.py.._accept...........r....c....................@....2...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)...FitsImageFile..FITSr......Nonec....................C....B...\|.j.d.u.s.J...i.}.d.}.d.}...\|.j...d...}.\|.s.d.}.t.\|.....\|.d.d.........}.\|.d.v.r+d.}.n&\|.r0\|.s0nS\|.d.k.rQ\|.j...t...\|.j.....d.....d.......\|.sN\|...\|...\.}.}.}.d.}.q.\|.rTq.\|.d.d.......d...d.......}.\|...d...rn\|.d.d.........}.\|.s~t.\|...rx\|.d.k.r~d.}.t.\|.....\|.\|.\|.<.q.\|.s.d.}.t.\|.....\|.\|.j.....d...7.}.\|.d.\|.j...\|.\|.f.g.\|._.d.S.).NF..T.P.....Truncated FITS file.......r.........XTENSION.....END.@......../r.........=r.........T..Not a FITS file..No image data..r....

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\FliImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	5.28339702314769
Encrypted:	false
SSDEEP:	96:tlrOA3JGYpNoDvUOsC6joAMAdcRy2bXpbZJn2:tnFgmoR+G3drn2
MD5:	6E6A044204681E387A74035CC29F2DB3
SHA1:	6FF863CE473707B9F46D501F0979DF4E65051150
SHA-256:	0CFA09C2675311E0A26D817CE1B60B3191FD9F368FF1821E094A18A9A80AAD40
SHA-512:	5AEBEAD059A80D9408DF864EB321C66DE0DD1622EA1DD79DBEDD48065275DF10409B2CCCEAF5D5EBA47A9449EA2A40DEE5B57C6B01DC3634070E2FB13F4C93D6
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.d.g.....d.S.)..........annotationsN.........Image..ImageFile..ImagePalette....i16le....i32le....o8c....................C....(...t.\|...d.k.o.t.\|.d...d.v.o.t.\|.d...d.v.S.).N.................i...........r.............len..i16....prefix..r......PIL\FliImagePlugin.py.._accept...................r....c....................@....@...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...FliImageFile..FLI..Autodesk FLI/FLC AnimationFc....................C........\|.j...d...}.t.\|...r.\|.d.d.....d.k.s.d.}.t.\|.....t.\|.d...\|._.\|.j.d.k.\|._.d.\|._.t.\|.d...t.\|.d...f.\|._.t.\|.d...}.t.\|.d...}.\|.d.k.rF\|.d...d...}.\|.\|.j.d.<.d.d...t.d...D...}.\|.j...d...}.d.\|._.t.\|.d...d.k.ry\|.j.t.\|.....\|._.\|.j...\|.j.....\|.j...d...}.t.\|.d...d.k.r.t.\|.d...}.d.}.t.\|...D.]5}.\|.d.u.r.\|.j...\|.d...t.j.....\|.j...d...}.t.\|.d...}.\|.d.v.r.\|...\|.\|.d.k.r.d.n

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\FpxImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4189
Entropy (8bit):	5.540033890236367
Encrypted:	false
SSDEEP:	96:kgVua0FShUWt+fMyLnVdGYEc56m/ZJBMiCIE7GuEn:kFFShPt+fDLnVdGYE2nvVCIEyuEn
MD5:	C0B35226CD83CB56EFB54BA6A1479D2F
SHA1:	471C24166C9FBA682482B022FAE26C7B9A43967E
SHA-256:	EDCBDA53DEF84F84F921A6CF7CF47C8CA69F7D673F43377F7609C4CFF0EABFB7
SHA-512:	C53A512CF0146F8117B01CEC84D5E7DDC8478CFE17078F86123A3B8CEAB1FD49C330190623EBE294E63398C39B7AE3C577BC14EC9358F8FCF72984AFA315210D
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d.d.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)..........annotationsN.........Image..ImageFile....i32le....A..L..r....r........RGBA..LA....RGBz.YCC;P..r....z.YCCA;P..r....r......r....r......).i....).i....).i....i....).i....i....i....).i....i....i....i....).i....i....i....).i....i....i....i....c....................C........\|.d.d.....t.j.k.S.).N.........olefile..MAGIC....prefix..r......PIL\FpxImagePlugin.py.._accept,..........r!...c.........................T...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z.....Z.S.)...FpxImageFile..FPX..FlashPixc....................C....b...z.t...\|.j...\|._.W.n...t.y...}...z.d.}.t.\|...\|...d.}.~.w.w.\|.j.j.j.d.k.r*d.}.t.\|.....\|...d.....d.S.).N.!not an FPX file; invalid OLE file.$56616700-C154-11CE-8553-00AA00A1F95B..not an FPX file; bad root CLSIDr......r......OleFileIO..fp..ole..OSError..SyntaxError..r

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\FtexImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3686
Entropy (8bit):	5.527388787888457
Encrypted:	false
SSDEEP:	96:MxQ4HUHtK0WYFWx5/X9JfI6wGM7fHSWEbkRldNJ:MxycjIJGUyKDNJ
MD5:	697324737F0122F97DE66AE4CAE3658F
SHA1:	45EE6CAD9FF7FCC47F5F31ECF30FCE6C18B18E54
SHA-256:	87C35064F332FB3345B6C1E8CCA5E42BE6285FA97F74032B1F2AC5A0A53BD01F
SHA-512:	9F5336B82806F1618561281F0F0D6ECA7677B04D30A973DD34C3A8B2E21C11BE380C3710737D64F77CF9D0072F2429D90A8DD4C7977AAEC841D69C09BEC7D27E
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.d.d.g.....d.S.).......A Pillow loader for .ftc and .ftu files (FTEX).Jerome Leclanche <jerome@leclan.ch>..The contents of this file are hereby released in the public domain (CC0).Full text of the CC0 license:. https://creativecommons.org/publicdomain/zero/1.0/..Independence War 2: Edge Of Chaos - Texture File Format - 16 October 2001..The textures used for 3D objects in Independence War 2: Edge Of Chaos are in a.packed custom format called FTEX. This file format uses file extensions FTC.and FTU..* FTC files are compressed textures (using standard texture compression)..* FTU files are not compressed..Texture File Format.The FTC and FTU texture files both use the same format. This.has the following structure:.{header}.{format_directory}.{data}.Where:.{header} = {. u32:magic,. u32:version,. u32:width,.

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\GbrImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.360145577657032
Encrypted:	false
SSDEEP:	48:gK6t9Hxs0NYdCEM4DqFwqVWGpBfFpSzD1fTXcybjgNYiLE:qHxyhZuWSXyf77iLE
MD5:	D537D7850C1669327DFC006A8CCF7739
SHA1:	833E2659FFF895F2E4AF055A547551BEC82DEDF3
SHA-256:	CE1EBC9A389A00B3874B97083E9F3AB6B1EACBF84733312FA4DEE4AC471947C6
SHA-512:	881A25FBB5FC399D54F4C12CDD5A712347F3B513A3B23BAF9F257D660A53F7C2A2DB3192880566DFBBF5D650DF5E869969E3C60297DF553043BAF4961FE908A1
Malicious:	false
Preview:	o....................................@....d...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)..........annotations.........Image..ImageFile....i32bec....................C....(...t.\|...d.k.o.t.\|.d...d.k.o.t.\|.d...d.v.S.).N.....r................r.............len..i32....prefix..r......PIL\GbrImagePlugin.py.._accept ........(.r....c....................@....$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...GbrImageFile..GBR..GIMP brush filec....................C....`...t.\|.j...d.....}.\|.d.k.r.d.}.t.\|.....t.\|.j...d.....}.\|.d.v.r'd.\|.....}.t.\|.....t.\|.j...d.....}.t.\|.j...d.....}.t.\|.j...d.....}.\|.d.k.sG\|.d.k.rMd.}.t.\|.....\|.d.v.rZd.\|.....}.t.\|.....\|.d.k.rc\|.d...}.n.\|.d...}.\|.j...d...}.\|.d.k.rwd.}.t.\|.....t.\|.j...d.....\|.j.d.<.\|.j...\|...d.d.....}.\|.d.k.r.d.\|._.n.d.\|._.\|.\|.f.\|._.\|.\|.j.d.<.t...\|.j.....\|.\|...\|...\|._.d.S.).Nr....r......not a GIMP brushr..... Unsupported GIMP brush version: r......r....r.....$Unsupported GIMP brush color depth: r....

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\GifImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	20418
Entropy (8bit):	5.542909541940616
Encrypted:	false
SSDEEP:	384:m7bDNVCFtQWt3ppwc1Tl8me2TFa4T9nvGqFZrKqz:m/xKpWcvdxTeYFKqz
MD5:	16DAD416EFEEBFB9535E6BDD3E64ED56
SHA1:	91911A7C2F6222D3D326DC37B9236F81EE891849
SHA-256:	AE0121A54C23FBAE9E02D54757DE140EEB54F6CD50278F761F13F92429B5B121
SHA-512:	CE9E6648F783260BFFAD41701066E79A6FDCC5B02B7CF5D335EAACAB5068DC8DE835B893B40AF8579FE6B885C70821F0592F69D7BDB7A1DA6DFCA53ADD9BA9C3
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.d...Z.G.d.d...d.e.j...Z.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d<d.d ..Z"d!d"..Z#d#d$..Z$d%d&..Z%d.Z&d'd(..Z'd)d..Z(d+d,..Z)d-d...Zd/d0..Z+d1d2..Z,d3d4..Z-d=d5d6..Z.d>d8d9..Z/e..0e.j1e.e.....e..2e.j1e"....e..3e.j1e!....e..4e.j1d:....e..5e.j1d;....d.S.)?.........annotationsN....IntEnum.........Image..ImageChops..ImageFile..ImageMath..ImageOps..ImagePalette..ImageSequence....i16le....o8....o16lec....................@........e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...LoadingStrategy.... versionadded:: 9.1.0r....r.........N....__name__..__module__..__qualname__..__doc__..RGB_AFTER_FIRST. RGB_AFTER_DIFFERENT_PALETTE_ONLY..RGB_ALWAYS..r"...r".....PIL\GifImagePlugin.pyr....0..................r....c....................C........\|.d.d.....d.v.S.).N.......s....GIF87as....GIF89ar".......pref

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\GimpGradientFile.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3284
Entropy (8bit):	5.168800967814726
Encrypted:	false
SSDEEP:	48:g6RthMCtOyum0AdjNG0ebTSeYSXOrmgOPzttbK4lo9B44oMg9JqABhEA:1dXum0w5/0lYS+a5tbK4SQd9JHBhr
MD5:	D885FB0512AC61EF067A3355CDD7A6CE
SHA1:	6CEA062A39F0AB8E77851D225601EBDE2A2BCA6D
SHA-256:	EC44FF9AA2B2302E3322ED7434F22DC2B606BCF35A3EB428420D535A4553CFDD
SHA-512:	B7802625A5B12CFB603C2D20E9A4AD9EDE90DDDBB3693BBE1EDDFCDF6F71B4834E6D9B4597425A6D6790B2A64A27A989F6E49EB19D6283A0D954C966E5CA2684
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.e.e.e.g.Z...G.d.d...d...Z.G.d.d...d.e...Z.d.S.)....Stuff to translate curve segments to palette values (derived from.the corresponding code in GIMP, written by Federico Mena Quintero..See the GIMP distribution for more information.)..........annotations....log..pi..sin..sqrt.........o8....\|.=c....................C....L...\|.\|.k.r.\|.t.k.r.d.S.d.\|...\|...S.\|.\|...}.d.\|...}.\|.t.k.r.d.S.d.d.\|...\|.....S.).N.................?........?....EPSILON....middle..pos..r......PIL\GimpGradientFile.py..linear...........................r....c....................C........\|.t.d...t.t.\|.t.........S.).Nr......r......maxr....r....r....r....r......curved...........r....c....................C....$...t.t...d...t.t.\|.\|.........d...d...S.).N........@r......r....r....r....r....r....r....r......sine2........$.r$...c....................C........t.d.t.\|.\|...d...d.......S.

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\GimpPaletteFile.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.204126977020441
Encrypted:	false
SSDEEP:	24:gOpNNL2JlxA53yXENIvBYkeoz7tsi4X9paBVKPNk3HXrZaRQzgyX:gE53y7JFJ74XXmwlsH763yX
MD5:	07E6741738C27CF9A1D71E1D771F6A98
SHA1:	77A0B8B7DB1739080465E079F3F0A968056CBE17
SHA-256:	25299A04FEB77C8323E21EDCA2C9A9C65E790F0B6B8F63C4D23EB1BA622AECFE
SHA-512:	ED80A0E700A1F833ACEA7DE551BD34AF83E7C86B27857156858327D5EDD042962C6ECF9CE9BFC61CBB17DFBC315EE857A1C876FCDE69BC7BB2B8C2E68F1D1890
Malicious:	false
Preview:	o....................................@....2...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.d.S.)..........annotationsN.........o8c....................@....$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...GimpPaletteFile.'File handler for GIMP's palette format...RGBc....................C........d.d...t.d...D...\|._.\|.....d.d.....d.k.r.d.}.t.\|.....t.d...D.]K}.\|.....}.\|.s(..nBt...d.\|...r/q.t.\|...d.k.r;d.}.t.\|.....t.t.t.\|.....d.d.........}.t.\|...d.k.rTd.}.t.\|.....t.\|.d.....t.\|.d.......t.\|.d.......\|.j.\|.<.q.d...\|.j...\|._.d.S.).Nc....................S........g.\|.].}.t.\|...d.....q.S.)......r.........0..i..r......PIL\GimpPaletteFile.py..<listcomp>............,GimpPaletteFile.__init__.<locals>.<listcomp>...............GIMP Palette..not a GIMP palette file.....\w+:\|#.d.....bad palette filer......bad palette entryr....r..................range..palette..readline..SyntaxError..re..match..len..tuple..map..int..split..ValueErrorr......join....self..fp..msgr......s..vr....r....r......__init__.....&........

C:\Users\user\AppData\Local\Temp\_MEI69562\PIL\GribStubImagePlugin.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1660
Entropy (8bit):	5.067285381983805
Encrypted:	false
SSDEEP:	48:gQYBgYEO5aRrkhCyR4ziCeV4gEVgM3BUiRP0LgXCMk3xgUw:RYBgYEO5aRrkhCyWziCeVfEL3BveLgCm
MD5:	3FFF364D524DCB6848574FAA16259423
SHA1:	F754E938D40E80CE705345856857C8FD61DD6665
SHA-256:	E5D61E6725392D16805B05FBFA2DDFD3673EF5DCB07101E9AFA68FD49358CAE8
SHA-512:	51D10E28F076DA47C1BF4AE739350A8B6740A8BEF81E985764FC06CF860303CD0E50E64108DA9DE5780BD457EEEB1B7261E10465631736DD619ABF9CEB3B6C29
Malicious:	false
Preview:	o....................................@....z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.a.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....d.S.)..........annotations.........Image..ImageFileNc....................C........\|.a.d.S.).._. Install application-specific GRIB image handler... :param handler: Handler object.. N...._handler....handler..r......PIL\GribStubImagePlugin.py..register_handler...........r....c....................C........\|.d.d.....d.k.o.\|.d...d.k.S.).N..........GRIB.....r....r........prefixr....r....r......_accept ..........r....c....................@....$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...GribStubImageFile..GRIBc....................C....\...\|.j.....}.t.\|.j...d.....s.d.}.t.\|.....\|.j...\|.....d.\|._.d.\|._.\|.....}.\|.r,\|...\|.....d.S.d.S.).N.......Not a GRIB file..F..r....r........fp..tellr......read..SyntaxError..seek.._mode.._size.._load..open....self..offset..msg..loaderr....r....r......_open(................................GribSt

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.619913450163593
Encrypted:	false
SSDEEP:	192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
MD5:	1C58526D681EFE507DEB8F1935C75487
SHA1:	0E6D328FAF3563F2AAE029BC5F2272FB7A742672
SHA-256:	EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
SHA-512:	8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	7.054510010549814
Encrypted:	false
SSDEEP:	384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
MD5:	BFFFA7117FD9B1622C66D949BAC3F1D7
SHA1:	402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
SHA-256:	1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
SHA-512:	B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.625331165566263
Encrypted:	false
SSDEEP:	192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
MD5:	E89CDCD4D95CDA04E4ABBA8193A5B492
SHA1:	5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
SHA-256:	1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
SHA-512:	55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.737397647066978
Encrypted:	false
SSDEEP:	192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
MD5:	ACCC640D1B06FB8552FE02F823126FF5
SHA1:	82CCC763D62660BFA8B8A09E566120D469F6AB67
SHA-256:	332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
SHA-512:	6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.6569647133331316
Encrypted:	false
SSDEEP:	192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
MD5:	C6024CC04201312F7688A021D25B056D
SHA1:	48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
SHA-256:	8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
SHA-512:	D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.882042129450427
Encrypted:	false
SSDEEP:	192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
MD5:	1F2A00E72BC8FA2BD887BDB651ED6DE5
SHA1:	04D92E41CE002251CC09C297CF2B38C4263709EA
SHA-256:	9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
SHA-512:	8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.355894399765837
Encrypted:	false
SSDEEP:	384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
MD5:	724223109E49CB01D61D63A8BE926B8F
SHA1:	072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
SHA-256:	4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
SHA-512:	19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.771309314175772
Encrypted:	false
SSDEEP:	192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
MD5:	3C38AAC78B7CE7F94F4916372800E242
SHA1:	C793186BCF8FDB55A1B74568102B4E073F6971D6
SHA-256:	3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
SHA-512:	C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.7115212149950185
Encrypted:	false
SSDEEP:	192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
MD5:	321A3CA50E80795018D55A19BF799197
SHA1:	DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
SHA-256:	5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
SHA-512:	3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.893761152454321
Encrypted:	false
SSDEEP:	192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
MD5:	0462E22F779295446CD0B63E61142CA5
SHA1:	616A325CD5B0971821571B880907CE1B181126AE
SHA-256:	0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
SHA-512:	07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.231196901820079
Encrypted:	false
SSDEEP:	192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
MD5:	C3632083B312C184CBDD96551FED5519
SHA1:	A93E8E0AF42A144009727D2DECB337F963A9312E
SHA-256:	BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
SHA-512:	8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.799245167892134
Encrypted:	false
SSDEEP:	192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
MD5:	517EB9E2CB671AE49F99173D7F7CE43F
SHA1:	4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
SHA-256:	57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
SHA-512:	492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.587063911311469
Encrypted:	false
SSDEEP:	192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
MD5:	F3FF2D544F5CD9E66BFB8D170B661673
SHA1:	9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
SHA-256:	E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
SHA-512:	184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.754374422741657
Encrypted:	false
SSDEEP:	192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
MD5:	A0C2DBE0F5E18D1ADD0D1BA22580893B
SHA1:	29624DF37151905467A223486500ED75617A1DFD
SHA-256:	3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
SHA-512:	3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.664553499673792
Encrypted:	false
SSDEEP:	192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
MD5:	2666581584BA60D48716420A6080ABDA
SHA1:	C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
SHA-256:	27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
SHA-512:	BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.146069394118203
Encrypted:	false
SSDEEP:	384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
MD5:	225D9F80F669CE452CA35E47AF94893F
SHA1:	37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
SHA-256:	61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
SHA-512:	2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.834520503429805
Encrypted:	false
SSDEEP:	192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
MD5:	1281E9D1750431D2FE3B480A8175D45C
SHA1:	BC982D1C750B88DCB4410739E057A86FF02D07EF
SHA-256:	433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
SHA-512:	A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.916367637528538
Encrypted:	false
SSDEEP:	192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
MD5:	FD46C3F6361E79B8616F56B22D935A53
SHA1:	107F488AD966633579D8EC5EB1919541F07532CE
SHA-256:	0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
SHA-512:	3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.829681745003914
Encrypted:	false
SSDEEP:	192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
MD5:	D12403EE11359259BA2B0706E5E5111C
SHA1:	03CC7827A30FD1DEE38665C0CC993B4B533AC138
SHA-256:	F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
SHA-512:	9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.612408827336625
Encrypted:	false
SSDEEP:	192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
MD5:	0F129611A4F1E7752F3671C9AA6EA736
SHA1:	40C07A94045B17DAE8A02C1D2B49301FAD231152
SHA-256:	2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
SHA-512:	6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.918215004381039
Encrypted:	false
SSDEEP:	192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
MD5:	D4FBA5A92D68916EC17104E09D1D9D12
SHA1:	247DBC625B72FFB0BF546B17FB4DE10CAD38D495
SHA-256:	93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
SHA-512:	D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.882777558752248
Encrypted:	false
SSDEEP:	192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
MD5:	EDF71C5C232F5F6EF3849450F2100B54
SHA1:	ED46DA7D59811B566DD438FA1D09C20F5DC493CE
SHA-256:	B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
SHA-512:	481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.738587310329139
Encrypted:	false
SSDEEP:	192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
MD5:	F9235935DD3BA2AA66D3AA3412ACCFBF
SHA1:	281E548B526411BCB3813EB98462F48FFAF4B3EB
SHA-256:	2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
SHA-512:	AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.202163846121633
Encrypted:	false
SSDEEP:	192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
MD5:	5107487B726BDCC7B9F7E4C2FF7F907C
SHA1:	EBC46221D3C81A409FAB9815C4215AD5DA62449C
SHA-256:	94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
SHA-512:	A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.866983142029453
Encrypted:	false
SSDEEP:	192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
MD5:	D5D77669BD8D382EC474BE0608AFD03F
SHA1:	1558F5A0F5FACC79D3957FF1E72A608766E11A64
SHA-256:	8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
SHA-512:	8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.828044267819929
Encrypted:	false
SSDEEP:	192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
MD5:	650435E39D38160ABC3973514D6C6640
SHA1:	9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
SHA-256:	551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
SHA-512:	7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30328
Entropy (8bit):	5.14173409150951
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
MD5:	B8F0210C47847FC6EC9FBE2A1AD4DEBB
SHA1:	E99D833AE730BE1FEDC826BF1569C26F30DA0D17
SHA-256:	1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
SHA-512:	992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.883012715268179
Encrypted:	false
SSDEEP:	192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
MD5:	272C0F80FD132E434CDCDD4E184BB1D8
SHA1:	5BC8B7260E690B4D4039FE27B48B2CECEC39652F
SHA-256:	BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
SHA-512:	94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26208
Entropy (8bit):	5.023753175006074
Encrypted:	false
SSDEEP:	192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
MD5:	20C0AFA78836B3F0B692C22F12BDA70A
SHA1:	60BB74615A71BD6B489C500E6E69722F357D283E
SHA-256:	962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
SHA-512:	65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.289041983400337
Encrypted:	false
SSDEEP:	192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
MD5:	96498DC4C2C879055A7AFF2A1CC2451E
SHA1:	FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
SHA-256:	273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
SHA-512:	4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.284932479906984
Encrypted:	false
SSDEEP:	384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
MD5:	115E8275EB570B02E72C0C8A156970B3
SHA1:	C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
SHA-256:	415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
SHA-512:	B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.253102285412285
Encrypted:	false
SSDEEP:	192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
MD5:	001E60F6BBF255A60A5EA542E6339706
SHA1:	F9172EC37921432D5031758D0C644FE78CDB25FA
SHA-256:	82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
SHA-512:	B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.810971823417463
Encrypted:	false
SSDEEP:	192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
MD5:	A0776B3A28F7246B4A24FF1B2867BDBF
SHA1:	383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
SHA-256:	2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
SHA-512:	7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\argparse.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	63060
Entropy (8bit):	5.395710765053623
Encrypted:	false
SSDEEP:	1536:0pUD+QNFjLL8PelugD8kKNu9HuizYcV9NCksWEMeFFHB44C:0uNl8k5HuyrV9NCxsb
MD5:	78650773A499E91AB1E5E317E1D193FC
SHA1:	191CBE87829F30A08E6536F38B60C868DA11F42B
SHA-256:	9F9C6E5C225ABB38005EF447EFC61D9E99068054CC2D9051054C0FF241C1486A
SHA-512:	0975E552B6CCE07BE2E62B0466EE19C8EB32955FC108E2C6FB563D086945436F8D312E2805706FD1D7C4672030306D4F5023F25B3E50ECAF6573C5A814E9F6E2
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z G.d%d&..d&e...Z!G.d'd(..d(e...Z"G.d)d..de"..Z#G.d+d,..d,e"..Z$G.d-d...d.e...Z%G.d/d0..d0e...Z&G.d1d2..d2e...Z'G.d3d4..d4e...Z(G.d5d6..d6e...Z)G.d7d8..d8e...Z*G.d9d:..d:e%..Z+G.d;d<..d<e...Z,G.d=d>..d>e...Z-G.d?d@..d@e...Z.G.dAdB..dBe...Z/G.dCdD..dDe/..Z0G.dEdF..dFe.e...Z1d.S.)G.....Command-line parsing library..This module is an optparse-inspired command-line parsing library that:.. - handles both optional and positional arguments. - produces highly informative usage messages. - supports parsers that dispatch to sub-parsers..The following is a simple usage example that sums integers from the.command-line and writes the result to a file::.. parser = argparse.ArgumentParser

C:\Users\user\AppData\Local\Temp\_MEI69562\ast.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	55749
Entropy (8bit):	5.34245641113114
Encrypted:	false
SSDEEP:	1536:V4+GlgD7UGQCeB6LFmp2aws7yqDuKY071l:V4WBF7hs7yqDuKfz
MD5:	E3F82E600B60E57B37F1711432A07912
SHA1:	2FC1A29A7CFB33078DDF1A862D636C0CC2A44FA2
SHA-256:	33F3781AE4336565B7E782561E1108FC899C0DB1AEE97CCAC348A93F41DADAFD
SHA-512:	456491BB7277717CB7ACAF53B555216249C828778E377871329EF9696C3E4489CE51378633D34BAFEFD011C3F8E04B96BA5DD56433C5FF0E114D7B0EC12F2B53
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d`d.d.d...d.d...Z.d.d...Z.dad.d...d.d...Z.d.d...Z.d.d...Z.dbd.d...Z.d.d...Z.d.d...Z.dcd.d...Z.d.d ..Z.d!d"..Z.d.d#..d$d%..Z.d&d'..Z.G.d(d)..d)e...Z.G.dd+..d+e...Z.e.e.d,..s.d-d...Z.d/d0..Z.e.e.e...e._.e.e.e...e._.G.d1d2..d2e ..Z!d3d4..Z"G.d5d6..d6e.e!d7..Z#G.d8d9..d9e.e!d7..Z$G.d:d;..d;e.e!d7..Z%G.d<d=..d=e.e!d7..Z&G.d>d?..d?e.e!d7..Z'e#e(e)ef.e$e+f.e%e,f.e&e d...e-f.e'e d@..f.i.Z.e#e-f.i.Z/e-d=e d...d=e(d6e)d6e*d6e+d9e,d;e d@..d?i.Z0G.dAdB..dBe1..Z2G.dCdD..dDe2..Z3G.dEdF..dFe2..Z4e.e5dG....s"dHdI..Z6dJdK..Z7e.e6e7..e5_8G.dLdM..dMe9..Z:G.dNdO..dOe;..Z<G.dPdQ..dQe;..Z=G.dRdS..dSe;..Z>dTe?e.j@jAd.......ZBG.dUdV..dVe...ZCdWZDdXZEg.eD..eE..R.ZFG.dYdZ..dZe...ZGd[d\..ZHd]d^..ZIeJd_k...ryeI....d.S.d.S.)d.H.... ast. ~~~.. The `ast` module helps Python applications to process trees of the Python. abstract syntax grammar. The abstract syntax itself might change with. each Python re

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	5.386603720912848
Encrypted:	false
SSDEEP:	12:gejTBnYu4GUk44uTDiWOX7WJ6FZSf3/Km0rh44mUljw6n1/n01n57ZWIYuiH+kR:g0YVk4PilCJ6y6m0Vlk6n6LRMbR
MD5:	39B7CDECBCBBECCA1F9FFE4731102D78
SHA1:	7B7ED244E886749A47C7476452FED0F7BD95DCA5
SHA-256:	CEFF5D9392A7FE5D4B4735DFD57907A7F6EBEFF009B47190F40BD2B3DD1A1237
SHA-512:	DD0456D7DCE6A6291771021090A43823078366B392ADBAE109FA8897613CA0C2FFEC3F744037A1B32CE008DAC1BDDDBAFBFA0CF08ED4165C85146A2B1FDE9DCB
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.e.j.e.j...e.j...e.j...e.j...e.j...e.j...e.j...e.j...e.j...e.j...e.j...e.j...e.j...Z.e.j.d.k.rxd.d.l.T.e.e.j.7.Z.d.S.d.d.l.T.e.e.j.7.Z.d.S.)..'The asyncio package, tracking PEP 3156......N.........*..win32....__doc__..sys..base_events..coroutines..events..exceptions..futures..locks..protocols..runners..queues..streams..subprocess..tasks..threads..transports..__all__..platform..windows_events..unix_events..r....r....z.asyncio\__init__.py..<module>.....`...................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\base_events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	51794
Entropy (8bit):	5.540876390550062
Encrypted:	false
SSDEEP:	768:jHr7Sg5pnqhNyD9EHg/CaPIEVBVX7Jgsn0/UHAtPFumnPw2bt7gJSr18vIc1KK:jLWg5iyOA/QUv9g5C4PLt7HoJ
MD5:	D081AB6E090972865E510BCC2769FD4F
SHA1:	5002B025077C8A966BC25B2C88D874FB7E9BDF18
SHA-256:	24033F8BC3B9F9C0C4AE101F8BB57638948936657BDDED7D4823FB6C862348D3
SHA-512:	C72C43C02FCF766F8DE4BCEE72734A861C1018887543D16E7464144C49ABE049AEBF8E70B55D1AC78B5EA68D70FC8CAB3DE2828AF78AACB58E44F0ED78F72467
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.yS......d.Z.Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.Z"d.Z#d.Z$e%e.d...Z&d.Z'e(..Z)d.d...Zd.d...Z+d.d...Z,d-d.d...Z-d.d.d...Z.d.d ..Z/e%e.d!..r.d"d#..Z0n.d$d#..Z0d%d&..Z1G.d'd(..d(e.j2..Z3G.d)d..d*e.j4..Z5G.d+d,..d,e.j6..Z7d.S.)/....Base implementation of event loop...The event loop can be broken up into a multiplexer (the part.responsible for notifying us of I/O events) and the event loop proper,.which wraps a multiplexer with functionality for scheduling callbacks,.immediately or at a given time in the future...Whenever a public API takes a callback, subsequent positional.arguments will be passed to the callback if/when it is called. This.avoids the proliferation of trivial lamb

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\base_futures.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	5.419327342409172
Encrypted:	false
SSDEEP:	48:gpqP2GFGsMILvFIAvotTRqGVaQP4CayMOFfEQi1d8alqr:lP2WE7qGYzlQYrlqr
MD5:	AA20D268E5D7443EDAF0D8F171E934B3
SHA1:	EF8A4C7D752905166DCC9F329124DC5FC557D2D9
SHA-256:	5F7C5C12D77119FBB80D67AD0CC452F51929336DAE40F35C09F70C2681DD1AD4
SHA-512:	6C97EBA41EC85D0EED851F5DFECCBAAFBB78C656DDA5274A211A7E551C7883AF41FC0BE53E26D893AFB88E603F7113C35DD1722D7AD7FD9F6FCD21F086865946
Malicious:	false
Preview:	o....................................@....R...d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.d.S.)........N....get_ident.........format_helpers..PENDING..CANCELLED..FINISHEDc....................C........t.\|.j.d...o.\|.j.d.u.S.)...Check for a Future... This returns True when obj is a Future instance or is advertising. itself as duck-type compatible by setting _asyncio_future_blocking.. See comment in Future for more details.. .._asyncio_future_blockingN....hasattr..__class__r........objr....r......asyncio\base_futures.py..isfuture...............r....c....................C.......t.\|...}.\|.s.d.}.d.d...}.\|.d.k.r.\|.\|.d...d.....}.n0\|.d.k.r0d...\|.\|.d...d.....\|.\|.d...d.......}.n.\|.d.k.rId...\|.\|.d...d.....\|.d...\|.\|.d...d.......}.d.\|...d...S.)..#helper function for Future.__repr__..c....................S........t...\|.d...S.).Nr......r......_format_callback_source....callbackr....r....r......format_cb............$_format_callbacks.<locals>.format_cbr....

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\base_subprocess.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9328
Entropy (8bit):	5.048639971418342
Encrypted:	false
SSDEEP:	192:ETsxR7A/+w/rDF6UhL/Od6CQh6NPowKM+G8X4Ku9po7sDPwIV+BmvcBC:EQpTwDQyO4sDPjvc4
MD5:	57D66EA492AFB600DCCCAFEEA3A54579
SHA1:	3E96351B75861B6AB7F35CEA083EC7F7E3F3AD44
SHA-256:	3E7848123A7D6304D4CAC2AB0D297ED479EFCFDA9A0B8AE0FB4A75CCAC48BA62
SHA-512:	FDEF87A35C3551C27C788613E2FEB33068D0FC6ADF3193BFB79F0E594CE4248E0BF9C20F65695FA5E5FC62352504C875E75E3C462BFDFFADB81E8359AACDEBF5
Malicious:	false
Preview:	o....................................@....x...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.d.S.)......N.........protocols....transports....loggerc.............................e.Z.d.Z...d0..f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.....Z.S.)1..BaseSubprocessTransportNc.............................t.....\|.....d.\|._.\|.\|._.\|.\|._.d.\|._.d.\|._.d.\|._.g.\|._.t.....\|._.i.\|._.d.\|._.\|.t.j.k.r0d.\|.j.d.<.\|.t.j.k.r:d.\|.j.d.<.\|.t.j.k.rDd.\|.j.d.<.z.\|.j.d.\|.\|.\|.\|.\|.\|.d...\|.......W.n.......\|.........\|.j.j.\|._.\|.j.\|.j.d.<.\|.j.....r.t.\|.t.t.f...rx\|.}.n.\|.d...}.t...d.\|.\|.j.....\|.j...\|...\|.......d.S.).NFr....r.............args..shell..stdin..stdout..stderr..bufsize..subprocess..process %r created: pid %s......super..__init__.._closed.._protocol.._loop.._proc.._pid.._returncode.._exit_waiters.

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\base_tasks.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	5.319150942226155
Encrypted:	false
SSDEEP:	48:gqesG7erGRGjk+8OBnKVmpNPS5WODw2TLJ8ZrvwejOEm:3G7erGkj98GnKVm2WODLqZ8ejOb
MD5:	A3F825BEB04EAF0B2064EE7DD8F73F2E
SHA1:	59DC72B59F03054FDD5DC89A70AE90E5568FEAD6
SHA-256:	27741ECFA0FC8E7DF19A87D834FCDDC0BCEF650C3132D9D626D56C7FF60E4CB8
SHA-512:	9715FCA098DEA134CF6FF87429B8DCB12DAF219064B737F1B9C85EEF769E81A094DFB8EAEBD0DBCE231AF51D3A69BE5EA32D1CE88C79246EBEF030AF5E85B022
Malicious:	false
Preview:	o....................................@....D...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.S.)......N.........base_futures....coroutinesc....................C....n...t...\|...}.\|.j.r.d.\|.d.<.\|...d.d.\|...........t...\|.j...}.\|...d.d.\|...d.......\|.j.d.u.r5\|...d.d.\|.j.........\|.S.).N..cancellingr....r......name=%r.......coro=<..>.......wait_for=..r......_future_repr_info.._must_cancel..insert..get_namer......_format_coroutine.._coro.._fut_waiter....task..info..coro..r......asyncio\base_tasks.py.._task_repr_info...........................r....c....................C........g.}.t.\|.j.d...r.\|.j.j.}.n.t.\|.j.d...r.\|.j.j.}.n.t.\|.j.d...r#\|.j.j.}.n.d.}.\|.d.u.rL\|.d.u.rF\|.d.u.r:\|.d.k.r6n.\|.d.8.}.\|...\|.....\|.j.}.\|.d.u.s-\|.......\|.S.\|.j.d.u.ru\|.j.j.}.\|.d.u.ru\|.d.u.rh\|.d.k.rd..\|.S.\|.d.8.}.\|...\|.j.....\|.j.}.\|.d.u.sY\|.S.).N..cr_frame..gi_frame..ag_framer....r........hasattrr....r!...r"...r#.....append..f_back..reverse.._exception..__traceback__..tb_frame..tb_next..r......limit..frames.

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\constants.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	566
Entropy (8bit):	5.176743641797334
Encrypted:	false
SSDEEP:	12:gYofzo0epgpl81mQRDKo4PdhXcCfHqVtLTN+MdjRI6fS/L:gREgLKmU4PnsCfE+GjRI6q/L
MD5:	0F3E6B24610CEF78569FD103D6D2F6EE
SHA1:	AA70AB482AF25F03134C39159EDE5A4487254E5B
SHA-256:	4872BC1F7AB5711C43924C6CEAF27356450522AF386D9F2126DE7FF651713B36
SHA-512:	F00872A92A89C45995C0A2D038C280E9ACCC891177C27EBBE8ADBA30F114EB09B6ECD3170D249EF4365ECE7EB279A172F77ECF583A605DDDA0102020D34D4B41
Malicious:	false
Preview:	o....................................@....2...d.d.l.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.S.)......N......................N@.....c....................@....$...e.Z.d.Z.e.....Z.e.....Z.e.....Z.d.S.)..._SendfileModeN....__name__..__module__..__qualname__..enum..auto..UNSUPPORTED..TRY_NATIVE..FALLBACK..r....r......asyncio\constants.pyr.....................r......r.....!LOG_THRESHOLD_FOR_CONNLOST_WRITES..ACCEPT_RETRY_DELAY..DEBUG_STACK_DEPTH..SSL_HANDSHAKE_TIMEOUT.!SENDFILE_FALLBACK_READBUFFER_SIZE..Enumr....r....r....r....r......<module>.......................

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\coroutines.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6579
Entropy (8bit):	5.215227782806074
Encrypted:	false
SSDEEP:	96:u3C1BBIBekyWZYxeXXwotN+cYeOpr6jOKNRrNE3XTTaWB4RjFnm52D8HRzXmPNfN:labNgKNcXHZBq6hHRSuL87vTAQ
MD5:	1D608F938ED7A602DAF33F6878FDF993
SHA1:	DADC6081E837278752821FC9DCF0ED65599DFC81
SHA-256:	81F37287A0703F284B0E0F11ACADA379E7BD2BFECEA77BD81879ED8B84085236
SHA-512:	30BBDCF8D5A70A087A67413B0DCE4A58356894A326EE4E989E66F7A5088FACB8CCF64364B5C1E499B7354735A94AC9E8F6336FE97C92D80BE4003B8859F08FDF
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.e...Z.G.d.d...d...Z.d.d...Z.e...Z.d.d...Z.e.j.e.j.e.j.j.e.f.Z.e...Z.d.d...Z.d.d...Z.d.S.).....coroutine..iscoroutinefunction..iscoroutine.....N.........base_futures....constants....format_helpers....loggerc....................C...."...t.j.j.p.t.j.j...o.t.t.j...d.....S.).N..PYTHONASYNCIODEBUG....sys..flags..dev_mode..ignore_environment..bool..os..environ..get..r....r......asyncio\coroutines.py.._is_debug_mode...............r....c....................@.......e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.e.d.d.....Z.d.d...Z.d.S.)...CoroWrapperNc....................C....Z...t...\|...s.t...\|...s.J.\|.....\|.\|._.\|.\|._.t...t...d.....\|._.t.\|.d.d...\|._.t.\|.d.d...\|._.d.S.).Nr......__name__..__qualname__....inspect..isgeneratorr......gen..funcr......extract_stackr....

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	28194
Entropy (8bit):	5.136872240433448
Encrypted:	false
SSDEEP:	384:ETR5Tu4nWX4XjqYDUPgohKLx+fIAsXIAnXWtiV/vPzx/jWU7tPbqX:EuojqmU4owLMIAsXIgYiJ3l/SU7tDqX
MD5:	E5BC4677257E46C2457F1A1F6AE7C8CD
SHA1:	B2E312B33CA0E726C48516ABEF1412063DA07B93
SHA-256:	2B277CD1E492D72E6D53C872C5E84F05C82928CBBB9DFC9802C5E82314DBD5B9
SHA-512:	6CBD8DFD8B7406834E9625A9841DDD6A6EC23FB46D8182BC451D0C0E9FA881A27624761BAE19474DB356B057FF2E7B3B209CB65E86CCDD469E0DC1D6E24692D4
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.a.e.....Z.G.d.d...d.e.j...Z.e...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d.d#d$..Z.d%d&..Z.d'd(..Z.d)d..Z d+d,..Z!e.Z"e.Z#e.Z$e.Z%e.Z&z.d.d-l'm.Z.m.Z.m.Z.m.Z.m.Z...W.n...e(y.......Y.d.S.w.e.Z)e.Ze.Z+e.Z,e.Z-d.S.)/.!Event loop and event loop policy.....AbstractEventLoopPolicy..AbstractEventLoop..AbstractServer..Handle..TimerHandle..get_event_loop_policy..set_event_loop_policy..get_event_loop..set_event_loop..new_event_loop..get_child_watcher..set_child_watcher.._set_running_loop..get_running_loop.._get_running_loop.....N.........format_helpersc....................@....F...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r.....1Object returned by callback registration methods....._callback.._args.._cancelled.._loop.._source_traceback.._repr..__we

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\exceptions.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2446
Entropy (8bit):	4.888926250356528
Encrypted:	false
SSDEEP:	48:g1h9ahDbIXnsDZzWBL6mZKygU7wpSPo+AsuYhkgJwfGLoDyRemapjNCCpZI:7bNDZu6r732ZuwkG7LomApjdI
MD5:	FE6458E4748F9FF122FA3DB2560022DD
SHA1:	FA37B4FA3D05422E61C804548F3F8D08213F7835
SHA-256:	02E23F0651EB055E57E2D51866E34DD6811FD7983542CC3C7B29D90EA4DDFFEB
SHA-512:	6DA9B5A85CE032913ACAD7308D1398339DD38BE02B4C1DA0B9E9CC839043930254831E1CFD65AE3814DBEC10E927CE7C586A9DA85667AA7B5B56DAECA2B8C3A6
Malicious:	false
Preview:	o....................................@....l...d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)...asyncio exceptions.....CancelledError..InvalidStateError..TimeoutError..IncompleteReadError..LimitOverrunError..SendfileNotAvailableErrorc....................@........e.Z.d.Z.d.Z.d.S.).r.....!The Future or Task was cancelled.N....__name__..__module__..__qualname__..__doc__..r....r......asyncio\exceptions.pyr.................r....c....................@...r....).r.....*The operation exceeded the given deadline.Nr....r....r....r....r....r........r....r....c....................@...r....).r.....+The operation is not allowed in this state.Nr....r....r....r....r....r........r....r....c....................@...r....).r.....~Sendfile syscall is not available... Raised if OS does not support sendfile syscall for given socket or. file type.. Nr....r....r....r....r....r........r....r....c.........................(...e.Z.d.Z.d.Z...f.d.

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\format_helpers.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	5.214220490627916
Encrypted:	false
SSDEEP:	48:glRQlQyhTGnPCyOO6/gVjJz+SCP0SyLC9eGi4Tb4AXtmLg/xWX:VlQyMOxsN+Sk0S9uSb4AsLUWX
MD5:	BA274A0B92A8D50B3F80DA80663D0FC5
SHA1:	2BA9A5EDFCEF5D03485335AF91B373C5E66CD196
SHA-256:	E4AF6EB87FBC606E6AC27EDDD9CEEAE9989D08CA39671E419E490FE70E0D2633
SHA-512:	3041196DAC5280F868FEA524EF2B47BB8C12BDD1EF90313D524F252F183845E0E6E64F9A2BC95D6032874E981BB2EC2FF16140B272F8C24B44DF7105A9BA3677
Malicious:	false
Preview:	o....................................@....d...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......N.........constantsc....................C....V...t...\|...}.t...\|...r.\|.j.}.\|.j.\|.j.f.S.t.\|.t.j...r.t.\|.j...S.t.\|.t.j...r)t.\|.j...S.d.S.).N....inspect..unwrap..isfunction..__code__..co_filename..co_firstlineno..isinstance..functools..partial.._get_function_source..func..partialmethod..r......code..r......asyncio\format_helpers.pyr...............................r....c....................C....8...t.\|.\|.d...}.t.\|...}.\|.r.\|.d.\|.d.....d.\|.d.......7.}.\|.S.).N.. at r......:r........_format_callbackr......r......args..func_repr..sourcer....r....r......_format_callback_source...................r"...c....................C....H...g.}.\|.r.\|...d.d...\|.D.......\|.r.\|...d.d...\|.....D.......d...d...\|.....S.)...Format function arguments and keyword arguments... Special case for a single parameter: ('hello',) is formatted as ('hello').. c...........

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\futures.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11852
Entropy (8bit):	5.29853568429324
Encrypted:	false
SSDEEP:	192:0DmeTY34zYtdaVQOS+HoP4jd/Hj7tOURe+:0DU3SYtdai3soQ1hN
MD5:	C194EBD1E8FA2583CA0A2BD09D04AA0D
SHA1:	491EC6DC735E5FF9490382AE5371B9E52296ACE9
SHA-256:	96B391185FFAEF9420C88CC1810433770B97DB9ABB8420418515C78AD1BFC23E
SHA-512:	DE9ED63BF240B02C40D005D6CF8B37E0E8BC4ACFD20C16908EEC2A004C94747C534E84F0F9963495E91D590C47ECA5AC050A723154DAD2601D1CBEA303B164C5
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.d...Z.G.d.d...d...Z.e.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...d.d...Z.z.d.d.l.Z.W.n...e.y{......Y.d.S.w.e.j...Z.Z.d.S.)...A Future class similar to the one in PEP 3148.....Future..wrap_future..isfuture.....N....GenericAlias.........base_futures....events....exceptions....format_helpersc....................@........e.Z.d.Z.d.Z.e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...d.d...Z.e.j.Z.d.d...Z.d.d...Z.e.e...Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.d...Z.d)d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...d.d ..Z"d!d"..Z#d#d$..Z$d%d&..Z%d'd(..Z&e&Z'd.S.)r.....,...This class is almost* compatible with concurrent.futures.Future... Differences:.. - This class is not thread-safe... - result() and exception() do not take a timeout argument and. raise an exception when the future isn't done yet

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\locks.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	14190
Entropy (8bit):	5.139182302623557
Encrypted:	false
SSDEEP:	384:azSP0V7mTrIh2GGO6tm2yp8mB30MuPlVT:hOm3I8G56lyp8U30MQt
MD5:	6F53E673226ACFE3E9CDD29751EF4112
SHA1:	5E4643EAEBF172CBBEF89CA3D3A109833F1B66A1
SHA-256:	5086A4FC11EAAB93CCD9CAB1ABE8D931101611DE7F7033F4E6F2EC2044FA52D2
SHA-512:	CAB6C073FBBB83CB7CE83D5932A5E96BEB3ADBCD4CC4A16A208A43983D1907D2A4A7C5F4EC533AAFF018AEAC81FF4B6BC1799F7AE5E12D8B84EE1090B6D51B16
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e...Z.d.S.)...Synchronization primitives.....Lock..Event..Condition..Semaphore..BoundedSemaphore.....N.........exceptions....mixins....tasksc....................@........e.Z.d.Z.d.d...Z.d.d...Z.d.S.)..._ContextManagerMixinc...............................\|.....I.d.H...d.S.).N....acquire....self..r......asyncio\locks.py..__aenter__................._ContextManagerMixin.__aenter__c...............................\|.......d.S.).N....release..r......exc_type..exc..tbr....r....r......__aexit__..............._ContextManagerMixin.__aexit__N....__name__..__module__..__qualname__r....r$...r....r....r....r....r...................r....c.........................T...e.Z.d.Z.d.Z.e.j.d.....f.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r........Primitive lock objects... A primitive lock

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\log.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.675722393587733
Encrypted:	false
SSDEEP:	3:ztWl//lllPkBEmHuk7DQIMeMt7i668CqKBZDTd8AXktflD15kITkTl:g///OBrHRQIw7Z6oMDfUp5kIsl
MD5:	FA210C18B84D0FBD7071932ECF77E910
SHA1:	F5E7E42F99972CC8DAE0B224FE3FBF4E2F145BE2
SHA-256:	696642C8296E727541BCBC9F9637C69BDC98761BC722BB52F81C90C126098133
SHA-512:	A8050A31AD74F1B6AA52A25334D4ADFDE6E40ACDFBD14E382071EC1E583D7BBB921D8FCFDDF58BFB052E2BAA9A81627FC844649B7D0C35A7BC8AA8D768F3E88D
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.e...e...Z.d.S.)...Logging configuration......N....__doc__..logging..getLogger..__package__..logger..r....r....z.asyncio\log.py..<module>...............

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\mixins.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	5.1442428393605955
Encrypted:	false
SSDEEP:	24:gD+sVUloU4eZFoc7uhENmV7O5cZcwlWU1KJmeMVR5QltwZ5t5oKD:gDnVUo3qFkeNm5YciwlBptncmZ5HD
MD5:	D50D4FB5E44BA414EDF13A22E6FD0DC4
SHA1:	18BE0BD0469CE1A2022CC75E0A92498C2F5ABD7D
SHA-256:	A0DD3529851B3B9CBD87E8C37F8E757012C1AD5CC5BB26CF1C0A906BBBA18127
SHA-512:	92B26ACE16130B8F6E71F174B9A2F56306395F2B455A5F80AA6D84E9A8A8DE396822D042B9E2584C6253B1E4CFEE8F09AB1AF1A0D13EC0C003284182A5E594CE
Malicious:	false
Preview:	o....................................@....8...d.Z.d.d.l.Z.d.d.l.m.Z...e.....Z.e...Z.G.d.d...d...Z.d.S.)...Event loop mixins......N.........eventsc....................@....&...e.Z.d.Z.d.Z.e.d...d.d...Z.d.d...Z.d.S.)..._LoopBoundMixinN....loopc....................C...."...\|.t.u.r.t.d.t.\|...j...d.......d.S.).N.2As of 3.10, the loop parameter was removed from ."() since it is no longer necessary...._marker..TypeError..type..__name__....selfr......r......asyncio\mixins.py..__init__........................._LoopBoundMixin.__init__c....................C....b...t.....}.\|.j.d.u.r#t.....\|.j.d.u.r.\|.\|._.W.d.........n.1.s.w.......Y...\|.\|.j.u.r/t.\|...d.......\|.S.).N.# is bound to a different event loop..r......_get_running_loop.._loop.._global_lock..RuntimeErrorr....r....r....r......_get_loop..............................._LoopBoundMixin._get_loop..r......__module__..__qualname__r....r....r....r!...r....r....r....r....r.....................r........__doc__..threading..r......Lockr......objectr...

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\proactor_events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	24618
Entropy (8bit):	5.223202710422959
Encrypted:	false
SSDEEP:	384:xtYZgHhszEu5/KCOlI3ebufSpm5M38uvhYDMLBQeuUR7uLialcsys:LBhK/alIubufS1hZ7uUR7u0s
MD5:	CC1686E1EB6A0EB984A8D95ACFE7AD48
SHA1:	292062105E1B49A17E86F2F4B7DA172E35717C2A
SHA-256:	E5970C273032FDA464BCF1784F63C5D48026676F43F5C8A412D045E7079AE43A
SHA-512:	AB79CA4A68A65DD865CE9E715DFDDCD898746C102B9FAA53A0F3C4200F94335E29D99725F6768B2942C90FA6DFC464BD9AF936570175D3F44C1DC47D7E0501A6
Malicious:	false
Preview:	o....................................@....X...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.e.j...Z G.d.d...d.e.e.e.j...Z!G.d.d...d.e.j"..Z#d.S.) ..Event loop using a proactor and related classes...A proactor is a "notify-on-completion" multiplexer. Currently a.proactor is only implemented on Windows with IOCP......BaseProactorEventLoop.....N.........base_events....constants....futures....exceptions....protocols....sslproto....transports....trsock....loggerc....................C.......t...\|...\|.j.d.<.z.\|.....\|.j.d.<.W.n...t.j.y(......\|.j.....r&t.j.d.\|.d.d.....Y.n.w.d.\|.j.v.rIz.\|.....\|.j.d.<.W.d.S...t.j.yH......d.\|.j.d.<.Y.d.S.w.d.S.).N..socket..sockname..getsockname() failed on %rT....exc_info..peername..r......TransportSocket.._extra..getsoc

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\protocols.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8281
Entropy (8bit):	4.957943359362495
Encrypted:	false
SSDEEP:	192:e+vkQ7vV9qAquFqqJRuw8BBqeqqF461QSE3qtqqkbKfYq5qqCqzqkq2qqfskrWFF:e+vH7V9qAquFqqaw8rqeqqF4+Qb3qtqH
MD5:	395FBB145F9118BF2FA5B1631536CCE8
SHA1:	F06D101DCC84D1A804CF8CC38F827CCFEB0D0F1C
SHA-256:	E8632BE71690AB5F2254C6E1F82C27360BA0BEE44A9C482E020C093F1B83E4AF
SHA-512:	44DC7B292292C6385C11E95300C5080CA6C12256828B0CCE4BF5D8A27055E34620B4F08E993AEC0E82EB5B7B1DF628A614C54D288A8C4E2BDAFFB0D0476B7096
Malicious:	false
Preview:	o....................................@....b...d.Z.d.Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.S.)...Abstract Protocol base classes.....BaseProtocol..Protocol..DatagramProtocol..SubprocessProtocol..BufferedProtocolc....................@....4...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r.........Common base class for protocol interfaces... Usually user implements protocols that derived from BaseProtocol. like Protocol or ProcessProtocol... The only case when BaseProtocol should be implemented directly is. write-only transport like write pipe. ..c....................C........d.S.)...Called when a connection is made... The argument is the transport representing the pipe connection.. To receive data, wait for data_received() calls.. When the connection is closed, connection_lost() is called.. Nr........self..transportr....r......asyncio\protocols.py..connection_made.............BaseProtoco

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\queues.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	5.12143069884677
Encrypted:	false
SSDEEP:	96:WvPNcyZbS/YDdG44XZlVXcWk9k7WPl8hOjdSlOrXxKPlIZMzAq47agu+d6Qa0TGI:WvFcysQDoVX1dW2IaJNId0gb6GEWlCE
MD5:	E5B01DB7FEA3E85C0218A79E8DC8CCA4
SHA1:	5CE7DCD93CEDA1566693D30B03C2FDC64B4EBB2F
SHA-256:	6C02B2FEA549EC71649083651BDF2AC61C06F4C1A82ADE77335CB9BD1CAC104E
SHA-512:	7D3023032A0B891766AF947667847AC7B13EA100963D362DA2B4BB4EB68CE1F728C5556DDED85DCBD9FA1C670759C481017326FC5291F3FB11A0ACB6194B0717
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).....Queue..PriorityQueue..LifoQueue..QueueFull..QueueEmpty.....N....GenericAlias.........locks....mixinsc....................@........e.Z.d.Z.d.Z.d.S.).r.....;Raised when Queue.get_nowait() is called on an empty Queue.N....__name__..__module__..__qualname__..__doc__..r....r......asyncio\queues.pyr...................r....c....................@...r....).r.....DRaised when the Queue.put_nowait() method is called on a full Queue.Nr....r....r....r....r....r........r....r....c............................e.Z.d.Z.d.Z.d(e.j.d.....f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.....Z.S.))r.........A queue, useful for coordinating producer and consumer coroutines... If maxsize is less than or equal

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\runners.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2072
Entropy (8bit):	5.295353679422315
Encrypted:	false
SSDEEP:	48:gD+v9RahXuGjUhFiIirL0CIo/zJduGLPo:hrahpUhVqklEPo
MD5:	3B3C8B7D7BF1B1C4479A6FAF8B3A447F
SHA1:	6F102EC4ADEF3046ACC149455682397645457D25
SHA-256:	382F81099108D46CB4E9BFDB71143F84368E35A9FF74ADF8012D2B2A98FAC987
SHA-512:	4321149D868CCD945509DC88287848F227D5084E24484ACCE557C655BB970DD678C19F3C7E4B56B6945F4EE6415EADAC7143C19A9B0B3E5DECB255FC1B0442CF
Malicious:	false
Preview:	o....................................@....B...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...d.d...Z.d.d...Z.d.S.).....run.........coroutines....events....tasksN....debugc....................C........t.....d.u.r.t.d.....t...\|...s.t.d...\|.......t.....}.z;t...\|.....\|.d.u.r)\|...\|.....\|...\|...W.z.t.\|.....\|...\|.........\|...\|.........W.t...d.....\|.......S.t...d.....\|.......w.z.t.\|.....\|...\|.........\|...\|.........W.t...d.....\|.......w.t...d.....\|.......w.).....Execute the coroutine and return the result... This function runs the passed coroutine, taking care of. managing the asyncio event loop and finalizing asynchronous. generators... This function cannot be called when another asyncio event loop is. running in the same thread... If debug is True, the event loop will be run in debug mode... This function always creates a new event loop and closes it at the end.. It should be used as a main entry point for asyncio programs, and should. ideally only be called once...

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\selector_events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	29511
Entropy (8bit):	5.2954759833185205
Encrypted:	false
SSDEEP:	384:bh8dzD50TajtWAtFn82c15fDioCzq462Rku4F0ztoyPrEvQJiZJ:V8dzNfxnnjc15fDsXxku4FoxrEP
MD5:	5929105FACBBE260033F606B55F2BCB8
SHA1:	A6E68547A38F88D06A7A30E6B1F879EDE38A750B
SHA-256:	9B55B7E5F7029351383A34EB5DF9B359E85EA752C534C5AE4ED57431C487A41B
SHA-512:	1FB5858C50ECF27971716EAE668677480A4F781E48180AAF693E92C69DBC102330713B9639C25523A9BF0B9BE6DFD9109C1CB3A2F3F2AB870DB7D7BFBEEA3A1B
Malicious:	false
Preview:	o....................................@....$...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y1......d.Z.Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)...Event loop using a selector and related classes...A selector is a "notify-when-ready" multiplexer. For a subclass which.also includes support for signal handling, see the unix_events sub-module......BaseSelectorEventLoop.....N.........base_events....constants....events....futures....protocols....sslproto....transports....trsock....loggerc....................C....2...z.\|...\|...}.W.n...t.y.......Y.d.S.w.t.\|.j.\|.@...S.).NF....get_key..KeyError..boolr........selector..fd..event..key..r#.....asyncio\selector_events.py.._test_selector_event ....................r%...c............................e.Z.d.Z.d.Z.dS..f.d.d...Z.dSd.d.d...d.d...Z...dSd.d.d.d.e.j.d

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\sslproto.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	21916
Entropy (8bit):	5.373763504699509
Encrypted:	false
SSDEEP:	384:lJYob6eoLREOFrfPFQuwDbD+ft/7oi/384pA3gw9Nk/ClM:c06eoVhr3FAT2/7b/3ZpA3goNk/AM
MD5:	F53BB029C7848274E8F7700408781B48
SHA1:	DBA7D2B499EA9CE71B971DF3A98A4B4E8F9BD07C
SHA-256:	326F867F996A7A7DED6A64A1DA443067949CBAA398A3E047615690B4FCC14C7D
SHA-512:	2F5DF3422011377EAA8EB674484B8DF91A900AD272EB53775631F8C594BBB6D116959237B238E3CE90907124FE4B39B7B7DD93C0E6F2D3D7002FBAA903A5FB15
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.j.e.j...Z.G.d.d...d.e.j...Z.d.S.)......N.........constants....protocols....transports....loggerc....................C...."...\|.r.t.d.....t.....}.\|.s.d.\|._.\|.S.).N.(Server side SSL needs a valid SSLContextF....ValueError..ssl..create_default_context..check_hostname....server_side..server_hostname..sslcontext..r......asyncio\sslproto.py.._create_transport_context.....................r......UNWRAPPED..DO_HANDSHAKE..WRAPPED..SHUTDOWNc....................@....~...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._SSLPipe.....An SSL "Pipe"... An SSL pipe allows you to communicate with an SSL/TLS protocol instance. through memory buffers. It can be used to implement a security layer for an. existing connection

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\staggered.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4163
Entropy (8bit):	5.412183040932218
Encrypted:	false
SSDEEP:	96:OGRVAmauUTtyShmRyVqfMnyxJYpakQIwshGF1d2wetVEnS1BCghCXf:OMem7UTNpNxKHnHg4Xf
MD5:	D1B5D6B8E423A66507CD055B2EF1AB5D
SHA1:	10882EED0648828AA058A414471503B1278F673D
SHA-256:	CE81A7A384B0F762ECECA6D81AB227B6FD53E93024E60145FCBA1F6EF49F4C0D
SHA-512:	10D4881F56CE99D099BDF77AEF909CD4AA4674A61DEF5133FD812E1EB13F962E6D9C599FAB7ACC574211FE48A643D0C9C600ABFD0ACFADF1F83A6D1EB92AF5D4
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...d.e.j.e.j.g.e.j.f.....d.e.j.e...d.e.j.d.e.j.e.j.e.j.e...e.j.e.j.e.....f...f.d.d...Z.d.S.)..FSupport for running coroutines in parallel with staggered start times.....staggered_race.....N.........events....exceptions....locks....tasks....loop..coro_fns..delayr......returnc.................................p.t.......t.\|.....d...d...g...g...d.t.j.t.j...d.d.f.................f.d.d...........d.....}.....\|.....zAd.}.\|.t.....k.rht.......I.d.H.\.}.}.t.\|...}...\|.D.].}.\|.....ra\|.....sa\|.....ra\|.......qO\|.t.....k.s>......f.W...D.].}.\|.......qoS...D.].}.\|.......qyw.)......Run coroutines with staggered start times and take the first to finish... This method takes an iterable of coroutine functions. The first one is. started immediately. From then on, whenever the immediately preceding one. fails (raises an exception), or when delay seconds has passed, the next. co

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\streams.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	20328
Entropy (8bit):	5.269907945733645
Encrypted:	false
SSDEEP:	384:9uOHlOk6VpTePNS7RL/qSqN46hEc0l6wHHQvYNTX30FrRvarZOBEwWSwN2lbI/:9pFHOpTeP4L/q/46hSlRb30FdSvwLZ98
MD5:	9A3F89C10065250C2FD424CECEFA25F4
SHA1:	0C34D136F86D4FB678B6D549B70E6E5A691A5872
SHA-256:	416EB954F871B5BE7AA8150DD536A2CF0430D579E8D86C8B41F857DB664F851F
SHA-512:	0E3338B73DF2BD530FFB230016463873CFD3637A1967A75AEB0DF4849A90243BB22C7D3151B299C393DAD762932D48F2334DD116AE5A32EF35B4F25755FF304F
Malicious:	false
Preview:	o....................................@....&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.d...r.e.d.7.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.e.d...d.d...Z.d.e.d...d.d...Z.e.e.d...rpd e.d...d.d...Z.d e.d...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)!....StreamReader..StreamWriter..StreamReaderProtocol..open_connection..start_server.....N..AF_UNIX....open_unix_connection..start_unix_server.........coroutines....events....exceptions....format_helpers....protocols....logger....sleep.........limitc.........................`.....t.....}.t.\|.\|.d...}.t.\|.\|.d.....\|.j...f.d.d...\|.\|.f.i.\|.....I.d.H.\.}.}.t.\|...\|.\|...}.\|.\|.f.S.)......A wrapper for create_connection() returning a (reader, writer) pair... The reader returned is a StreamReader instance; the writer is a. StreamWriter instance... The arguments are all the usual arguments to create_connection(). except protocol_factory; most common a

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\subprocess.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7039
Entropy (8bit):	5.079920209682612
Encrypted:	false
SSDEEP:	192:zLOraGVJ64hc94zVWihEqVesPsoEUmrki3:8TPSiVEsPswM
MD5:	C1E5DF557854B501765A529C292CB33B
SHA1:	A62BC5D3258D9DB0F4F1CF418696DB4D7C77EE29
SHA-256:	FBDD18702743051606E3CBE9567970F0D48E5019B9AD6CCDEB8E21644820FE88
SHA-512:	BAD7F67B44DD0094B384F01C04C08427988DE7B4CDE5A6858754D047BE56EF07D68E0641EC2F8692395DA6D8ACA5D022F5C0FBFC9625CFDA32ACF4528A6FF245
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e.j.Z.e.j.Z.G.d.d...d.e.j.e.j...Z.G.d.d...d...Z.d.d.d.e.j.f.d.d...Z.d.d.d.e.j.d...d.d...Z.d.S.).....create_subprocess_exec..create_subprocess_shell.....N.........events....protocols....streams....tasks....loggerc.........................X...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)...SubprocessStreamProtocol.0Like StreamReaderProtocol, but for a subprocess.c.........................H...t...j.\|.d.....\|.\|._.d...\|._...\|._.\|._.d.\|._.d.\|._.g.\|._.\|.j.....\|._.d.S.).N....loopF....super..__init__.._limit..stdin..stdout..stderr.._transport.._process_exited.._pipe_fds.._loop..create_future.._stdin_closed....self..limitr........__class__....asyncio\subprocess.pyr............................!SubprocessStreamProtocol.__init__c....................C....n...\|.j.j.g.}.\|.j.d.u.r.\|...d.\|.j.........\|.j.d.u.r!\|...d.\|.j.........\|.j.d.u.r/\|

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\tasks.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	23926
Entropy (8bit):	5.411591840104135
Encrypted:	false
SSDEEP:	384:jIhab4Bnlp39qH8X+gbw4uHb6LPa8Ec1LOpITTgUGIYdt+2sWTXjKrnVlmx:yRZ9qm+OwFHb6LPa8Ec9Op2TgUGfdt+C
MD5:	E3404062480379FCC3B14390160A50F3
SHA1:	A14BB11EB657DBC07C4AF76FEC28EEACAAB09A8D
SHA-256:	8CB139DE2A55884C53AF5C5CC7D5385E3FE503EB6FB4668B460D7DB94B97C021
SHA-512:	6BC0FF4E390DE79FE305CC92F90AA5BF4CB2733820B5735B04D0EC4CF91994DC6084BE52FC9410A4D6CE2C53816CFC9A990FE73E47D3200235C907121C373B1A
Malicious:	false
Preview:	o....................................@....l...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...j.Z.dCd.d...Z.dCd.d...Z.d.d...Z.G.d.d...d.e.j...Z.e.Z.z.d.d.l.Z.W.n...e.y\|......Y.n.w.e.j...Z.Z.d.d...d.d...Z.e.j.j Z e.j.j!Z!e.j.j"Z"d.e"d...d.d...Z#d.d...Z$d.d...Z%d.d...Z&d d!..Z'd.d"..d#d$..Z(e.j)d%d&....ZdCd'd(..Z+d.d)..dd+..Z,d.d)..d,d-..Z-e.j)d.d/....Z.e.e._.G.d0d1..d1e.j/..Z0d2d3..d4d5..Z1d6d7..Z2d8d9..Z3e..4..Z5i.Z6d:d;..Z7d<d=..Z8d>d?..Z9d@dA..Z:e7Z;e:Z<e8Z=e9Z>z.d.dBl.m7Z7m:Z:m8Z8m9Z9m5Z5m6Z6..W.n...e...y+......Y.d.S.w.e7Z?e:Z@e8ZAe9ZBd.S.)D.0Support for tasks, coroutines and the scheduler.....Task..create_task..FIRST_COMPLETED..FIRST_EXCEPTION..ALL_COMPLETED..wait..wait_for..as_completed..sleep..gather..shield..ensure_future..run_coroutine_threadsafe..current_task..all_tasks.._register_task.._unregister_task.._enter_task.._leave_task.....N....GenericAlias.........ba

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\threads.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.205162064221456
Encrypted:	false
SSDEEP:	24:gasp1Ep1H1MvBTtRaPiXnN9PjcoWjYVKbZ6WCG7BuT2qK+I:gakEp1HSdna6XN9OjikMGA2GI
MD5:	389392F37CC59D26424174F047851330
SHA1:	FE9B9F9C0B215B803970709D5A5F4E0F707BDCD1
SHA-256:	D397F34C64A552C45530F69F38EBEB17B26483DF8D5B677746B0335610A804C3
SHA-512:	BE7C187B8B41DCC0FC6D9EB9652141622AC161C5E3C034E911E221A8B489836C5B4CBCCD514B57E439330515A74A5DA256670CE9BF1B0BA2A7B76001369C4F16
Malicious:	false
Preview:	o....................................@....0...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.d...Z.d.S.)..6High-level support for working with threads in asyncio.....N.........events....to_threadc.........................@.....t.....}.t.....}.t.j.\|.j.\|.g.\|...R.i.\|.....}.\|...d.\|...I.d.H.S.).....Asynchronously run function func in a separate thread... Any args and kwargs supplied for this function are directly passed. to func. Also, the current :class:`contextvars.Context` is propagated,. allowing context variables from the main thread to be accessed in the. separate thread... Return a coroutine that can be awaited to get the eventual result of func*.. N..r......get_running_loop..contextvars..copy_context..functools..partial..run..run_in_executor....func..args..kwargs..loop..ctxZ.func_call..r......asyncio\threads.pyr.......................r........__doc__r....r......r......__all__r....r....r....r....r......<module>.....................

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\transports.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12308
Entropy (8bit):	5.078406944584904
Encrypted:	false
SSDEEP:	192:2aYZwlKSozVkeNx0KQhq9RkgcZCR4wZmBE:HYZ/zJNqm8qZmBE
MD5:	21BAA45D2D81EAE3032AF0BCF7748F38
SHA1:	0999085F38BDACDB269733FC10EAB416CF36224B
SHA-256:	DCA1866FF1DBE0B32BA739CF10D19C2AE0C075B3063A6522FC6995FC4ED9F3AE
SHA-512:	C5FF895B31CA745AFA4B229C83D0D1B41C5BB4948465EDA69449981CFA87CDECA6A0CA66A8C94D65E621C1664596E6028E0697EBB1C3644C47F14783A6438951
Malicious:	false
Preview:	o....................................@....\|...d.Z.d.Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)...Abstract Transport class.....BaseTransport..ReadTransport..WriteTransport..Transport..DatagramTransport..SubprocessTransportc....................@....H...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r......Base class for transports....._extraNc....................C........\|.d.u.r.i.}.\|.\|._.d.S.).Nr........self..extra..r......asyncio\transports.py..__init__.................BaseTransport.__init__c....................C........\|.j...\|.\|...S.)..#Get optional transport information...r......get..r......name..defaultr....r....r......get_extra_info.............BaseTransport.get_extra_infoc....................C........t...)..2Return True if the transport is closing or closed.....NotImplementedError..r....r....r....r......is_closing.............BaseTransport.is_closingc....................C...r!..

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\trsock.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7801
Entropy (8bit):	4.80099298791545
Encrypted:	false
SSDEEP:	96:+qDTnTDDzzDDD5ulgFHf3CvpHphkskOW6laaPtQHbjo0VeC/iLINT9CojcrvJQws:dv0gF/34IskElXiRVeC/jmB4yVVXm
MD5:	36691B39C5A4465DF94BFD292F891F0E
SHA1:	9C49B542432E01E28FC1AEF341E75E2EE47D57DF
SHA-256:	55782EB7899699358C9EB4682178E2DC3E402297CDF377F5775CAC22376E53F7
SHA-512:	68459AEFEDE14538F88FFE456E6F53C0F53C7D8454181A5EF4BF665273D866B379977B1906B92B8C8B84B41C5943003F1DE0049A76B9F724A4CFC63024C28778
Malicious:	false
Preview:	o....................................@...."...d.d.l.Z.d.d.l.Z.G.d.d...d...Z.d.S.)......Nc....................@.......e.Z.d.Z.d.Z.d.Z.d.e.j.f.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z d8d9..Z!d:d;..Z"d<d=..Z#d>d?..Z$d@dA..Z%dBdC..Z&dDdE..Z'dFdG..Z(dHdI..Z)dJdK..ZdLdM..Z+dNdO..Z,dPdQ..Z-dRdS..Z.dTdU..Z/dVdW..Z0dXdY..Z1dZd[..Z2d\S.)]..TransportSocket..A socket-like wrapper for exposing real transport sockets... These objects can be safely returned by APIs like. `transport.get_extra_info('socket')`. All potentially disruptive. operations (like "socket.close()") are banned.. ...._sock..sockc....................C........\|.\|._.d.S.).Nr........selfr......r......asyncio\trsock.py..__init__.............TransportSocket.__init__c....................C........t.j.d.\|...d...t.\|.d.....d.S.).N..Using .. on socket

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\unix_events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	41602
Entropy (8bit):	5.337800693021204
Encrypted:	false
SSDEEP:	768:Lkd4/hiWx8T8JpwK4QScBVZflFlvasgPMnom2sy8t64JbU1KwU3Wd1cOxU8F+rkS:LPPO8Jp+QScBVFlFwsgPMnoVsy8tpJbR
MD5:	971509127B4ACDECCB229E0D50B92935
SHA1:	DC44F9732B0539DB25485DBA295D9C99807A87AF
SHA-256:	ACF9867BF9A205510380D12F44DCB169A94DE6182CB355C3B9C59CB374FD7403
SHA-512:	0585A584ACFE7375FE673DFFA6AD331CC4F0440BE814BBF34D7CA1EDC6CB7CA8C892B257B5C198E7157CE95FD5EFAC56EA494FDE43438E4CDF3D50F2E09C06CC
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r.e.d.....d.d...Z.d.d...Z.G.d.d...d.e.j...Z G.d.d...d.e.j!..Z"G.d.d...d.e.j#e.j$..Z%G.d.d...d.e.j&..Z'G.d.d...d...Z(G.d d!..d!e(..Z)G.d"d#..d#e(..ZG.d$d%..d%e..Z+G.d&d'..d'e..Z,G.d(d)..d)e(..Z-G.dd+..d+e(..Z.G.d,d-..d-e.j/..Z0e Z1e0Z2d.S.)..2Selector event loop for Unix with signal handling......N.........base_events....base_subprocess....constants....coroutines....events....exceptions....futures....selector_events....tasks....transports....logger....SelectorEventLoop..AbstractChildWatcher..SafeChildWatcher..FastChildWatcher..PidfdChildWatcher..MultiLoopChildWatcher..ThreadedChildWatcher..DefaultEventLoopPolicy..win32.+Signals are not really supported on Windowsc....................C........d.S.).

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\windows_events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	24107
Entropy (8bit):	5.293961018050662
Encrypted:	false
SSDEEP:	384:8hnUjfHEsoZWsJzy3zcxrkgfg/I4brVridW5adXFmALaAjbFx:8dSHEskED+rkug/I4HVridD1FmUBbX
MD5:	04A199247538A916DC4F9D87C6D46222
SHA1:	72FB7FFC1950B1FA8559E6B5902AF0A91C307D05
SHA-256:	B034DEDAC79431B1966E16E2B2817284788C2502A8CB79C47BBDA6D8CB63BDF9
SHA-512:	780945EED26A364AAF182286AAF401540E8B80E7C247E9E6D0B35DE562C792DBE1D1DF38FEF2D1BC3531B165CD3E9799D988233A7EB39D637F0A56093B3C9A4C
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.e.j.d.k.r.e.d.....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z G.d.d...d.e.j...Z!G.d.d...d.e!..Z"G.d.d...d.e!..Z#G.d.d...d.e$..Z%G.d.d ..d e.j&..Z'G.d!d"..d"e.j(..Z)G.d#d$..d$..ZG.d%d&..d&e.j+..Z,e'Z-G.d'd(..d(e.j...Z/G.d)d..d*e.j...Z0e0Z1d.S.)+..Selector and proactor event loops for Windows......N..win32..win32 only.........events....base_subprocess....futures....exceptions....proactor_events....selector_events....tasks....windows_utils....logger....SelectorEventLoop..ProactorEventLoop..IocpProactor..DefaultEventLoopPolicy..WindowsSelectorEventLoopPolicy..WindowsProactorEventLoopPolicy..........................MbP?......?c.........................`...e.Z.d.Z.d.Z.d.d.....f.d.d...Z...f.d.d...Z.d.d...Z.d...f.d.d...Z...f.d.d...Z...f.d.d...Z.....Z.S.)

C:\Users\user\AppData\Local\Temp\_MEI69562\asyncio\windows_utils.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4468
Entropy (8bit):	5.492094492366352
Encrypted:	false
SSDEEP:	96:x4AgTQkn7CmeKwF53SCFgiDUYBT1bXwETppVKgHfd5e4:mnhczF7UU10Y///b9
MD5:	7A1D4B959FA0FD70FFCAD3B84DF59028
SHA1:	242CDB14AF7F26E78146AF47AFB05088FEFFF368
SHA-256:	487A7AD451078F2A152F3CAFEDB9B66D108A865E9737A5F6D3D463D8E679D1CA
SHA-512:	BCB280593FB60EAC3D52FEECF270833E838A99344A2AF89184C07A2A0361265F80206DE558AFB99C7ED5D5ABBC59D060527E9F089C6B009F4498DFCEB3DCB40C
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.e.j.d.k.r.e.d.....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.....Z.d.d.e.d...d.d...Z.G.d.d...d...Z.G.d.d...d.e.j...Z.d.S.)..)Various Windows specific bits and pieces......N..win32..win32 only....pipe..Popen..PIPE..PipeHandle.. ..F..TT....duplex..overlapped..bufsizec....................C........t.j.d...t.....t.t.....d...}.\|.r.t.j.}.t.j.t.j.B.}.\|.\|...}.}.n.t.j.}.t.j.}.d.\|...}.}.\|.t.j.O.}.\|.d...r8\|.t.j.O.}.\|.d...r@t.j.}.n.d.}.d...}.}.z.t...\|.\|.t.j.d.\|.\|.t.j.t.j...}.t...\|.\|.d.t.j.t.j.\|.t.j...}.t.j.\|.d.d...}.\|...d.....\|.\|.f.W.S.......\|.d.u.r.t...\|.....\|.d.u.r.t...\|.......)..ELike os.pipe() but with overlapped support and using handles not fds...\\.\pipe\python-pipe-{:d}-{:d}-....prefixr.........NT..r........tempfile..mktemp..format..os..getpid..next.._mmap_counter.._winapi..PIPE_ACCESS_DUPLEX..GENERIC_READ..GENERIC_WRITE..PIPE_ACCESS_INBOUND..FILE_FLAG_FIRST_PIPE_INSTANCE..FILE_FLAG_OVERLAPPED..Crea

C:\Users\user\AppData\Local\Temp\_MEI69562\base64.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17110
Entropy (8bit):	5.524272634297277
Encrypted:	false
SSDEEP:	384:QxayMwXlrYhA1T1cRX6KbWJ5uKLudrIgV3:c3MwlGWIX1b+OrIgV3
MD5:	1964FC5D3CD98FABDD626DEDF4760ECE
SHA1:	C6CD18D61F79C04E11D33D5CC4425A8937B5E8BA
SHA-256:	ACB6F9EC7B6737B931E17EE1A85FE44FB28239CFF6A63ADCCAE8B78CF21C79A0
SHA-512:	188C5DB00EADF61106A368B8B15C777C67FF25D40DD26939A2928D07C3500127DBA3E6BCF70A256A2F239DF67192D8FED7F22F3507EF2DCEB6710ECAF2A7CE86
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'dd$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.ad.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)V.DBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N....encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C....l...t.\|.t...r.z.\|...d...W.S...t.y.......t.d.....w.t.\|.t...r.\|.S.z.t.\|.......W.S...t.y5......t.d.\|.j.j.....d...

C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880569
Entropy (8bit):	5.682988287908638
Encrypted:	false
SSDEEP:	12288:lgYJu4KXWyBC6S4IEa8A4a2YWD3dOVwx/fpEWertSLMNE:lgYJiVBFLa2VIVwx/fpEWe+MNE
MD5:	483D9675EF53A13327E7DFC7D09F23FE
SHA1:	2378F1DB6292CD8DC4AD95763A42AD49AEB11337
SHA-256:	70C28EC0770EDEFCEF46FA27AAA08BA8DC22A31ACD6F84CB0B99257DCA1B629E
SHA-512:	F905EB1817D7D4CC1F65E3A5A01BADE761BCA15C4A24AF7097BC8F3F2B43B00E000D6EA23CD054C391D3FDC2F1114F2AF43C8BB6D97C1A0CE747763260A864F5
Malicious:	false
Preview:	PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI69562\bdb.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	25810
Entropy (8bit):	5.270686990353677
Encrypted:	false
SSDEEP:	768:lDIaBEqyQLS9hYq6vo2kIQ92iKZi9ILTGVpH0O1A:lU6F0hevw32iP9lLH1A
MD5:	66E1FD6C661FD9AACC2C7B9D0F4C2013
SHA1:	2741C7D187BB0767043BB9146607F5D5C30FEE28
SHA-256:	429774AED76CA6E5A9CDCC0FC8620BF33D23330CF71926A6E9DAC2F18835DB4E
SHA-512:	1D4CE1868B8C0172AB0FA982B23715381C516A83523507010E5EFB58FE5829CCAEFC2BB221F38EDA0BB9DC3DB9057185EC1B9892B34DD78ECF9AF5B4005B2C77
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...g.d...Z.e.e.B.e.B.Z.G.d.d...d.e...Z.G.d.d...d...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Debugger basics.....N....CO_GENERATOR..CO_COROUTINE..CO_ASYNC_GENERATOR....BdbQuit..Bdb..Breakpointc....................@........e.Z.d.Z.d.Z.d.S.).r..... Exception to give up completely.N....__name__..__module__..__qualname__..__doc__..r....r......bdb.pyr.................r....c....................@.......e.Z.d.Z.d.Z.d^d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d_d&d'..Z.d^d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d^d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.....d`d9d:..Z.d;d<..Z.d=d>..Z d?d@..Z!dAdB..Z"dCdD..Z#dEdF..Z$dGdH..Z%dIdJ..Z&dKdL..Z'dMdN..Z(dOdP..Z)dQdR..ZdadTdU..Z+dbdVdW..Z,dbdXdY..Z-dZd[..Z.d\d]..Z/d.S.)cr.........Generic Python debugger base class... This class takes care

C:\Users\user\AppData\Local\Temp\_MEI69562\bisect.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	5.196969918057239
Encrypted:	false
SSDEEP:	48:gfhwHaPJ7Bn7V39r0OCl7VU30bEBn7B3OeuznCRl7VC3COTvNV:8h7Bx39AOC030QB93OeYCRi3ZV
MD5:	74E81ACE5771AB47EC6AFDC44208398D
SHA1:	048CF3D553040D39B4813C96984D66D954D0F1B9
SHA-256:	B675A4C9818ED7A7F6B24B9822FAEB9BA93539CD79FE182A9215A8BD611AB6B6
SHA-512:	60BD5044BA219A03DA577668AADB445462AA06C63443941B4A32653035D8E11C8B4BD3FACD0BA520E83DE58FFE176D42EA00318425F3810CAB4690DDF0510ABB
Malicious:	false
Preview:	o....................................@....p...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.)...Bisection algorithms......N....keyc....................C....>...\|.d.u.r.t.\|.\|.\|.\|...}.n.t.\|.\|.\|...\|.\|.\|.d...}.\|...\|.\|.....d.S.)...Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr........bisect_right..insert....a..x..lo..hir......r......bisect.py..insort_right.................r....c....................C.......\|.d.k.r.t.d.....\|.d.u.r.t.\|...}.\|.d.u.r1\|.\|.k.r/\|.\|...d...}.\|.\|.\|...k.r'\|.}.n.\|.d...}.\|.\|.k.s.\|.S.\|.\|.k.rN\|.\|...d...}.\|.\|.\|.\|.....k.rF\|.}.n.\|.d...}.\|.\|.k.s5\|.S.).....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i] have e <= x, and all e in. a[i:] have e

C:\Users\user\AppData\Local\Temp\_MEI69562\bz2.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	10850
Entropy (8bit):	5.284896366892046
Encrypted:	false
SSDEEP:	96:eURZ9KATZ38E9/5v7iv25L9Dz+zJ74k17vVfuxwmTy+6GY8hABFFUATxtStyCcQA:BP6Eb22dRCzZlvVowmTVABpbS6t+2
MD5:	6742F99C98780ADE923EBBF36EB9AB92
SHA1:	0DC7CA9351C2DC6E2B42495D506BB7FF4CB381EA
SHA-256:	14340CB02529EBF0D8EE34D0600CB9C8BB054D97D248565A6CD362A55FCA1C5D
SHA-512:	4E9FBAE2F6B1CE56BAE910A9A5A55DDA586B5BD2F4A6ABBE61664B8BB5ACE5AFC73622E615496BB306664E6837F90380824294EA4504EA1770E0B7405AF887B6
Malicious:	false
Preview:	o....................................@.......d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression......BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompress.%Nadeem Vawda <nadeem.vawda@gmail.com>.......r....N..r....r..............c....................@.......e.Z.d.Z.d.Z.dd.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r.....@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a binary* file interface - data read is. returned as bytes, and data t

C:\Users\user\AppData\Local\Temp\_MEI69562\calendar.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	26227
Entropy (8bit):	5.273500257644362
Encrypted:	false
SSDEEP:	384:r9ZsjX1NmHeR3PgF94uDxilyQOjjmzsSLA14xnoMEcHW8t9s/I5VZJsbKP7:rCNeKu4uDxilyBjmxOcoMEcH2XKP7
MD5:	9F293014C1B9136415D112FF3B3FA5D3
SHA1:	CB285F3575D9DA3A19A3275DFA3E71839345A2F4
SHA-256:	4819BC122521D85FD73D2D877292D97A95050B0B44541F5195FF322AA61840DB
SHA-512:	B940F710677D97A01BEE6A0FF074A3F67F09E3A22F989EC53B7721D74B6641A620EAC6005859897CCA356C02F4A7DAA586C6159F9654C2D4AC26A2A4E31C0CC9
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d..d..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=.$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N....repeat....IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

C:\Users\user\AppData\Local\Temp\_MEI69562\certifi\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.564185041201542
Encrypted:	false
SSDEEP:	6:gexsZvEG/XgcdLTC2Q/F2Q//N6/lqNS4G:geeeGBPQQQ3N68NS7
MD5:	A3A4AC09BE9B7C08F46B6A7356A11B09
SHA1:	94CD1FC640BA882BB55504973C8BD2146F1A8447
SHA-256:	AAD7B3E6D0CD65E3DB4A306E215310532AD8C6EF294634499846018EC37CEF2E
SHA-512:	067AD9DDB3670B77D9B84A375193C0A1AFF3A9F4838F0ED8C9AAD66FC6E146CA1FBC79E45C6CD60322273E2AF8FB3C3B40A3BC45CB1CE11ACE3BA19286446A52
Malicious:	false
Preview:	o....................................@.... ...d.d.l.m.Z.m.Z...d.d.g.Z.d.Z.d.S.)..........contents..wherer....r......2024.02.02N....corer....r......__all__..__version__..r....r....z.certifi\__init__.py..<module>...............

C:\Users\user\AppData\Local\Temp\_MEI69562\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292541
Entropy (8bit):	6.048162209044241
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
MD5:	D3E74C9D33719C8AB162BAA4AE743B27
SHA1:	EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
SHA-256:	7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
SHA-512:	E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI69562\certifi\core.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	4.875601670596195
Encrypted:	false
SSDEEP:	48:gq5BUoxmgDZLaSLlEZxF81g69ehWFCtCewnGJ:dfUC/cZx6aIeGPGJ
MD5:	574D9B80C511D453E76F7A1500C00989
SHA1:	BD211E262A0AB19453D7E2A58DEF1D6C021CEE36
SHA-256:	D3CE6589F2DC0626B706B196A53F205B56056CEE55463D6FF1DABC7E300185F1
SHA-512:	3F6FB0ADC3A7920B4CE1F9B094DADE0CAB529B2DC8BD0BC58715FD5C49D3AB145C1AFF341917D76FA7130D3FDEDF8ED33F307F1CE823CE7F22DDB87466C42A20
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.d...Z.e.j.d.k.r0d.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.e.j.d.k.rQd.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.j.e.f...Z.e.e.d.f...Z.....d.d.e.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.)..e.certifi.py.~~~~~~~~~~..This module returns the installation location of cacert.pem or its contents.......N..returnc....................C........t...d.d.d.....d.S.).N...._CACERT_CTX..__exit__..r....r......certifi\core.py..exit_cacert_ctx...........r....................as_file..filesc....................C....4...t.d.u.r.t.t.d.....d.....a.t.t.......a.t...t.....t.S.).N..certifi..cacert.pem...._CACERT_PATHr....r......joinpathr......str..__enter__..atexit..registerr....r....r....r....r......where...................r....c....................C........t.d.....d...j.d.d...S.).Nr....r......ascii....encoding..r....r......read_textr....r....r....r......contents.........

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	5.675472519363452
Encrypted:	false
SSDEEP:	24:gAV4U0b8ybWPxg+QQMzy/ClB3N/PLo3bIB3Nvh4VMhGlXwu+H2C/ZC/BgYfUy:go4jbqjQtyat/c2vhCMhju/C/o/6YfUy
MD5:	9B3F6D9382897CA9275CBD21112111DC
SHA1:	E87E6C8311BCFE63198A5A60A1EE4B499569D6DA
SHA-256:	BE018CCD65BD8B3D4F2561A42A5D780E3B9D3D5DD5917AD95911D5892B37B5AE
SHA-512:	E988B9B99E52721DA1B46E0DD9232B0BA79EE2DF249E26755D50800286F1C3D03CB4EEF4AD519352DBFC29C47AD15C7F74832B598ED55FD54DCF485463A976CB
Malicious:	false
Preview:	o....................................@....x...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.e...d.....e.........d.S.).......Charset-Normalizer.~~~~~~~~~~~~~~.The Real First Universal Charset Detector..A library that helps you read text from an unknown charset encoding..Motivated by chardet, This package is trying to resolve the issue by taking a new approach..All IANA character set names for which the Python core library provides codecs are supported...Basic usage:. >>> from charset_normalizer import from_bytes. >>> results = from_bytes('B.... ..... ... ..... .. ............ O............!'.encode('utf_8')). >>> best_guess = results.best(). >>> str(best_guess). 'B.... ..... ... ..... .. ............ O............!'..Others methods and usages are available - see the full documentation.at <https://github.com/Ousret/charset_normalizer>..:copyright

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\api.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11336
Entropy (8bit):	5.834280811275831
Encrypted:	false
SSDEEP:	192:XWeJLd8V6fySfPAraft774k4M1Cz9ZZER6gJzaaTZyZP7BpWA+BfAgZSK7cwF0:XWeJLdcS7ft77cZZaFzaa9WXWA+BfAgW
MD5:	671160FBEB77D8A0AD0A94FCFCCB24FA
SHA1:	6F72481A67D1098117DC961A817B2DBDF24DD4F0
SHA-256:	64967C669E55A5F5D071C62E7693FFB55B22CCC894A2DA1183E2DBC2F6362696
SHA-512:	9EC6F8079A46F9CE318620469B6A7705B324A7C60E3520C67F93C5DB8501FF6ED2C3E9F5F46EC4B548F508BAE802E540B957F0E9E7B30336F47976378C91E450
Malicious:	false
Preview:	o....................................@....L...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.. d...Z!e.."..Z#e#.$e..%d.........................d(d.e.e&e'f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d.d...Z,..................d(d.e.d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d d!..Z-..................d(d"e.ee&e.f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d#d$..Z...................d)d%e.e.ee.e&f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e+f.d&d'..Z/d.S.)*.....N....PathLike....BinaryIO..List..Optional..Set..Union.........coherence_ratio..encoding_languages..mb_encoding_languages..merge_coherence_ratios....IANA_SUPPORTED..TOO_BIG_SEQUENCE..TOO_SMALL_SEQUENCE..TRACE....mess_ratio....CharsetMatch..CharsetMatches....any_specified_encoding..cut_sequence_chunks..iana_name..identify_sig_or_bom..is_cp_similar..is_multi_b

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\cd.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9597
Entropy (8bit):	5.545330754474741
Encrypted:	false
SSDEEP:	192:ozqRXboHRH+tBqz+mspqUuOKxpPc7Gsv+BOgOtTatBtgpPDT6l:oe9S+nmySOKLPc7Gsv+BOgOQ7tgROl
MD5:	75BA08E7B3AB2DCB08077B0BC293F506
SHA1:	B4E4B0E85D66A68F15C1A5E6D31E5F9F9AB70033
SHA-256:	16B1A9FD028FDC8898883696019C484C7AC27509A25790613F1DC08647B2C67C
SHA-512:	B3F28668FF883BAE178C4D7BE1C913682F015BADB5F74DE6C0768F8938494A985D7E3D07D9F1C514762EBDE85640F87A1A258C064AAD09034AC1DD34A11BCD17
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.e.d.e.e...f.d.d...Z.d.e.d.e.e...f.d.d...Z.e...d.e.d.e.e...f.d.d.....Z e...d.e.d.e.e...f.d.d.....Z!e.e.d...d.e.d.e.e"e"f...f.d.d.....Z#..d0d.e.e...d.e"d.e.e...f.d.d...Z$d.e.d.e.e...d.e%f.d d!..Z&d"e.d.e.e...f.d#d$..Z'd%e.e...d.e.f.d&d'..Z(d%e.d.e.f.d(d)..Z)e.dd.....d1d"e.d,e%d-e.e...d.e.f.d.d/....Zd.S.)2.....N....IncrementalDecoder....Counter....lru_cache..r......Dict..List..Optional..Tuple.........FREQUENCIES..KO_NAMES..LANGUAGE_SUPPORTED_COUNT..TOO_SMALL_SEQUENCE..ZH_NAMES... is_suspiciously_successive_range....CoherenceMatches....is_accentuated..is_latin..is_multi_byte_encoding..is_unicode_range_secondary..unicode_range..iana_name..returnc............................t.\|...r.t.d.....t...d...\|.....j.}.\|.d.d...}.i...d...t.d.d...D.]/}.\|...t.\|.g.....}.\|.rNt.\|...}.\|.d.u.r4q.t.\|...d.u.rN\|...

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\constant.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	30387
Entropy (8bit):	5.980242343233114
Encrypted:	false
SSDEEP:	768:XvZKN0taqbKcwWiSqCDy0sK24BY9I6m6wREp2dYqOkRz/FnO8jLGLGfn7Y5Xyq2j:XvZ6EKcRiSHGi2V9gTAAOUFRPr7rd0Y7
MD5:	211FBCFE5F5900850E7BECEFAE4E16B1
SHA1:	3D88C6A9A939B042C5965D647EFB9B8CA43769B6
SHA-256:	1F7855305943455827B23E4D30B93C2DA5964CB412A991E9923A9EA25EBCC828
SHA-512:	104E2D74C198D323E320676814F0CBF5F2087D4CB7C3DAAD9FBBA917DF7A1085551D23886B863953E5637E56D4EC0CFE6730FD2E7748FA4B1399B68369BCC414
Malicious:	false
Preview:	o....................................@....~...U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.g.d...d.e.e.g.e.e.g.d...Z.e.e.e.e.e.e...f...f...e.d.<.d.Z.e.e.d.<.e.d...Z.e.e.d.<.d.Z.e.e.d.<.i.d.e.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d e.d.d!....d"e.d!d#....d$e.d#d%....d&e.d%d'....d(e.d'd)....d*e.d)d+....d,e.d+d-....d.e.d-d/....i.d0e.d/d1....d2e.d1d3....d4e.d3d5....d6e.d5d7....d8e.d7d9....d:e.d9d;....d<e.d;d=....d>e.d=d?....d@e.d?dA....dBe.dAdC....dDe.dCdE....dFe.dEdG....dHe.dGdI....dJe.dIdK....dLe.dKdM....dNe.dMdO....dPe.dOdQ......i.dRe.dQdS....dTe.dSdU....dVe.dUdW....dXe.dWdY....dZe.dYd[....d\e.d[d]....d^e.d]d_....d`e.d_da....dbe.dadc....dde.dcde....dfe.dedg....dhe.dgdi....dje.didk....dle.dkdm....dne.dmdo....dpe.dodq....dre.dqds......i.dte.dsdu....dve.dudw....dxe.dwdy....dze.dyd{....d\|e.d{d}....d~e.d}d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d...

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\legacy.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.464346081872393
Encrypted:	false
SSDEEP:	48:gIwwE8mcebSh3Ue75yubxKp4mNfBhsZLg+aVa:rwAmcebSyo5ycFmN8ZLg+2a
MD5:	74BA81F5CBC0C8C60601D61DD6AFA751
SHA1:	864B887406791BD03473FD111C838CB2109CBE22
SHA-256:	32A18B267DEC97229B2E6B4CF344D04CB4C2B05C54E99ECB5DFE9DE854DB0A4A
SHA-512:	CDB337A29254B7ACFD527B5C4F2440BC43A7D22B4586FF7311F4A16169E23F7027717D744225E0C1D1108517410A23C1FA7580711E21DEFC2BF3ADFA67A8EDC9
Malicious:	false
Preview:	o....................................@....r...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.d.e.d.e.d.e.d.e.e.e.e.e.e.f.....f...f.d.d...Z.d.S.)..........Any..Dict..Optional..Union....warn.........from_bytes....CHARDET_CORRESPONDENCEF..byte_str..should_rename_legacy..kwargs..returnc....................K........t.\|...r.t.d.d...t.\|...........d.......t.\|.t.t.f...s#t.d...t.\|.........t.\|.t...r,t.\|...}.t.\|.......}.\|.d.u.r9\|.j.n.d.}.\|.d.u.rG\|.j.d.k.rG\|.j.n.d.}.\|.d.u.rRd.\|.j...n.d.}.\|.d.u.rc\|.d.k.rc\|.j.rc\|.d.7.}.\|.d.u.ro\|.t.v.rot.\|...}.\|.\|.\|.d...S.)..J.... chardet legacy method. Detect the encoding of the given byte string. It should be mostly backward-compatible.. Encoding name will match Chardet own writing whenever possible. (Not on encoding name unsupported by it). This function is deprecated and should be used to migrate your project easily, consult the documentation for. further information. Not planned for removal... :param byte_str: The byte seque

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.675182011095312
Encrypted:	false
SSDEEP:	96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5:	F33CA57D413E6B5313272FA54DBC8BAA
SHA1:	4E0CABE7D38FE8D649A0A497ED18D4D1CA5F4C44
SHA-256:	9B3D70922DCFAEB02812AFA9030A40433B9D2B58BCF088781F9AB68A74D20664
SHA-512:	F17C06F4202B6EDBB66660D68FF938D4F75B411F9FAB48636C3575E42ABAAB6464D66CB57BCE7F84E8E2B5755B6EF757A820A50C13DD5F85FAA63CD553D3FF32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.879886869577473
Encrypted:	false
SSDEEP:	3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5:	494F5B9ADC1CFB7FDB919C9B1AF346E1
SHA1:	4A5FDDD47812D19948585390F76D5435C4220E6B
SHA-256:	AD9BCC0DE6815516DFDE91BB2E477F8FB5F099D7F5511D0F54B50FA77B721051
SHA-512:	2C0D68DA196075EA30D97B5FD853C673E28949DF2B6BF005AE72FD8B60A0C036F18103C5DE662CAC63BAAEF740B65B4ED2394FCD2E6DA4DFCFBEEF5B64DAB794
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%............02....................................... ............`.............................................d..........................................Px...............................w..@............@...............................text...X-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\models.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11471
Entropy (8bit):	5.209157884767145
Encrypted:	false
SSDEEP:	192:t53OuUZ2H4pAmGjjg4cijgxcJxdSfTpNyRhBq5hEt1Bp0rBlu/819Rb:t5euUZ2H4pAmGj04cijgxcJx4VkvBqTn
MD5:	A98948D97FC7BE3C65C0DBC26627DE05
SHA1:	50B531F5B5C3323AB9C16432A5EB4D20DADA5274
SHA-256:	FC2A5E7273BF832D4840516FD8AEBB18E629E7384F32E71F98467CC8D683F66F
SHA-512:	990967FDE402A24238D0CC79701A498BD792CBDE9700B9B5D9C5E4AE9D3D47DEFA3898DCF08C018F5FD465A0E0863C9EA9C9072C73A489D653FB741D64A4CF92
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.e.e.e.f...Z.e.e...Z.G.d.d...d...Z.d.S.)..........aliases....sha256....dumps....Any..Dict..Iterator..List..Optional..Tuple..Union.........TOO_BIG_SEQUENCE....iana_name..is_multi_byte_encoding..unicode_rangec....................@........e.Z.d.Z...d=d.e.d.e.d.e.d.e.d.d.d.e.e...f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d.e.f.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d>d.d...Z.e.d.e.f.d.d.....Z.e.d.e.e...f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d ....Z.e.d.e.e...f.d!d"....Z.e.d.e.f.d#d$....Z.e.d.e.f.d%d&....Z.e.d.e.f.d'd(....Z.e.d.e.f.d)d*....Z.e.d.e.f.d+d,....Z.e.d.e.f.d-d.....Z.e.d.e.d...f.d/d0....Z.e.d.e.f.d1d2....Z.e.d.e.e...f.d3d4....Z.e.d.e.e...f.d5d6....Z d?d8e.d.e.f.d9d:..Z!e.d.e.f.d;d<....Z"d.S.)@..CharsetMatchN..payload..guessed_encoding..mean_mess_ratio..has_sig_or_bom..languages..CoherenceMatches..decod

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\utils.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8855
Entropy (8bit):	5.496637154146926
Encrypted:	false
SSDEEP:	96:ynaWBnyfyXwAjTpiNO6dKnsQVoJzORILuL80y22RZocUvsfvWhFN/ibTe5ccb1O:5LOnHuuLtTcZTUyvde2cbE
MD5:	33609E3019831EDB676E112E58CD43D3
SHA1:	D61CF655E82000B6FBE12CF5545AD3B058039388
SHA-256:	E5A05ABB933B7F37D88F13675DF9DB2AF0931ADAFC2DE813E505F13DC8A5B2EA
SHA-512:	64B41AD15A0025A0FFA50F86A7E8F84BC3AC0627E01B7E6AD2751E606EB21221A23DFEB6C8B1BA64FEEA3C4854774873A1045EC4B40EF71DEC7DEDD7FC7793D0
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.e...f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z e.e.d...d.e.d.e.f.d.d.....Z!e.e.d...d.e.d.e.f.d.d.....Z"e.e.d...d.e.d.e.f.d.d.....Z#e.e.d...d.e.d.e.f.d.d.....Z$e.e.d...d.e.d.e.f.d.d.....Z%e.e.d...d.e.d.e.f.d.d ....Z&e.e.d...d.e.d.e.f.d!d"....Z'e.e.d...d.e.d.e.f.d#d$....Z(e.e.d...d.e.d.e.f.d%d&....Z)e.e.d...d.e.d.e.f.d'd(....Ze.e.d...d.e.d.e.f.d)d....Z+e.e.d...d.e.d.e.f.d+d,....Z,e.e-e...d...d-e.d.e.f.d.d/....Z.e.e.d...d.e.d.e.f.d0d1....Z/d_d3e0d4e1d.e.e...f.d5d6..Z2e.d7d...d8e.d.e.f.d9d:....Z3d3e0d.e.e.e...e0f...f.d;d<..Z4d=e.d.e.f.d>d?..Z5d`dAe.dBe.d.e.f.dCdD..Z6dEe.d.e.e...f.dFdG..Z7dHe.dIe.d.e8f.dJdK..Z9dHe.dIe.d.e.f.dLdM..Z:dNe.j;dOf.d8e.dPe1dQe.d.d.f.dRdS..Z<..dadTe0dUe.dVe=dWe1dXe.dYe.dZe0d[e.d\e.e...d.e.e.d.d.f...f.d]d^

C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\version.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.885555590098653
Encrypted:	false
SSDEEP:	3:ztWl/zlr/bkszHuBmh2V5XL6rLMvogqnKCLcTkWwlflLNEG06GVyWD8ITkTi:g/zGszf2rb6rL6Dbie6G3D8Isi
MD5:	E71C209AD82586EA73B85CBE452E61DF
SHA1:	46570A014A367E63ED5DF58B6BA659E692D220AA
SHA-256:	179104A0E9154B11500D8DDFA088700FDFB5FD829714D28195D2028F5A4037FD
SHA-512:	BC37E0D99973BA79364A761A7B143575C620E29E07923A4F84A452B6375BFFCC642E1DDA26FFD37693746A14C8ABBE281D33DD63181A57CEEB678F4A0B57CF81
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.e...d...Z.d.S.)....Expose version...3.3.2...N....__doc__..__version__..split..VERSION..r....r....z.charset_normalizer\version.py..<module>...............

C:\Users\user\AppData\Local\Temp\_MEI69562\cmd.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12682
Entropy (8bit):	5.417020357966628
Encrypted:	false
SSDEEP:	192:Q0eP/AixV/822T36A7Rs62uBlEs5FCasXfkOoNP2uNSlW/OcM9BgL:re3VN2T3H9s1uBjaFPkOoNPKWrWyL
MD5:	71FCE033156E62972FAC178E3CEA7701
SHA1:	7C0B05977938E3BD898BEAC51539FC4A7F58E137
SHA-256:	D6A9BA829B20E470E344FADD4C80812CE4981FACD94A45AD1AA5421AC42D2284
SHA-512:	114A969A3FC8AF31411DCAC66BC139FCCA41D225CFE7AA87638C410A485AD2CCC16E6D6D2CD95CE836F4E38D5821095717CE3B71DC2130E398CB3FC512F85034
Malicious:	false
Preview:	o....................................@....@...d.Z.d.d.l.Z.d.d.l.Z.d.g.Z.d.Z.e.j.e.j...d...Z.G.d.d...d...Z.d.S.)......A generic class to build line-oriented command interpreters...Interpreters constructed with this class obey the following conventions:..1. End of file on input is processed as the command 'EOF'..2. A command is parsed out of each line by collecting the prefix composed. of characters in the identchars member..3. A command `foo' is dispatched to a method 'do_foo()'; the do_ method. is passed a single argument consisting of the remainder of the line..4. Typing an empty line repeats the last command. (Actually, it calls the. method `emptyline', which may be overridden in a subclass.).5. There is a predefined `help' method. Given an argument `topic', it. calls the command `help_topic'. With no arguments, it lists all topics. with defined help_ functions, broken into up to three topics; documented. commands, miscellaneous help topics, and undocumented commands..

C:\Users\user\AppData\Local\Temp\_MEI69562\code.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9937
Entropy (8bit):	5.2207191808558395
Encrypted:	false
SSDEEP:	192:qL3xy0BMPIVfWZOgWSC47ONdPyytW/3sho9zppK7p3Aq8:qL3AUMQVXPc7GKymsqzud6
MD5:	25FD96DCA698B2001B09B5298C082796
SHA1:	C323C5E1244E2684F949346E0F1D69EBC0FBA021
SHA-256:	4EC12A9298B82A27BFEABDA7BEEEC69F363C9A2FBD40C67AE6DDA63E3F0C88D9
SHA-512:	4E3F6FAD075A30368CCCEB7242AA88DADDC6177BD0AFAE24778B32D8A41CE3071E76806CE684D4ED1F5BAD261838C5DB6B64171CA82F2787AA17B9D60E12A1A2
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.d.d...Z.e.d.k.rTd.d.l.Z.e.....Z.e.j.d.d.d.d.....e.....Z.e.j.sIe.j.j.rLd.Z.n.d.Z.e.e.....d.S.d.S.)..?Utilities needed to emulate Python's interactive interpreter........N....CommandCompiler..compile_command....InteractiveInterpreter..InteractiveConsole..interactr....c....................@....F...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).r......Base class for InteractiveConsole... This class deals with parsing and interpreter state (the user's. namespace); it doesn't deal with input buffering or prompting or. input file naming (the filename is always passed in explicitly)... Nc....................C....$...\|.d.u.r.d.d.d...}.\|.\|._.t...\|._.d.S.)......Constructor... The optional 'locals' argument specifies the dictionary in. which code will be executed; it defaults to a newly created. dictionary with key "__na

C:\Users\user\AppData\Local\Temp\_MEI69562\codeop.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5568
Entropy (8bit):	5.232981040307866
Encrypted:	false
SSDEEP:	96:TGrjoken19Ha2a/Z8U/2fUWqxMP7tkdvg9Dliqsqp9ZfAVeEbx34AqqwpvAwjqO/:xkenIh8U/2fdq87tZiq9ThUeEbdqqwpP
MD5:	F9FF1A14550D9AF62B3CF8F83BA7959D
SHA1:	BECE46F580C15FBF7EBDE7E0F1545C5FFF6F6777
SHA-256:	D1614D47A4BB2CEC8FB461185B63EE768C26084CAF680E46A5087AD22AA04EE7
SHA-512:	28E371B5AB84FDE154C150A1C4F7E6958FB027BE57F8C0ECF55FE24F865319AEC64FBC7CF8F4BE40A8A8F9EAB69D50916B37EA9A2BC9794AB8729F467E9049F4
Malicious:	false
Preview:	o....................................@....v...d.Z.d.d.l.Z.d.d.l.Z.d.d...e.j.D...Z.g.d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..A...Utilities to compile possibly incomplete Python source code...This module provides two interfaces, broadly similar to the builtin.function compile(), which take program text, a filename and a 'mode'.and:..- Return code object if the command is complete and valid.- Return None if the command is incomplete.- Raise SyntaxError, ValueError or OverflowError if the command is a. syntax error (OverflowError and ValueError can be produced by. malformed literals)...The two interfaces are:..compile_command(source, filename, symbol):.. Compiles a single command in the manner described above...CommandCompiler():.. Instances of this class have __call__ methods identical in. signature to compile_command; the difference is that if the. instance compiles program text containing a __future__ statement,. the instance '

C:\Users\user\AppData\Local\Temp\_MEI69562\colorsys.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.368234924790349
Encrypted:	false
SSDEEP:	48:gFXK0Y+GM5oU8rYIkp/pVXMMxIVBJ2ylDlVNYllCcmlUkXU9hqrlElWc:KknGtIkp/Lc6CBjEll+VXTED
MD5:	EAE2BFE2FE6706E6DA3A17561461CAA0
SHA1:	4E84C9E0AD16408DE1D3CF564EF38DAED6817119
SHA-256:	F9BF3B126198594245EDAA3A84547FB85A5C081725948573F32484102BA8D238
SHA-512:	A5C39F901C74E71C5CE500752493E5B768E907C7ECB9926ACD9CDC1E520A7EAF8322CF0F589B8C1FB7D7E8E7072B6014E26D6134945FADC2149477206F338499
Malicious:	false
Preview:	o....................................@....T...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..J...Conversion functions between RGB and other color systems...This modules provides two functions for each color system ABC:.. rgb_to_abc(r, g, b) --> a, b, c. abc_to_rgb(a, b, c) --> r, g, b..All inputs and outputs are triples of floats in the range [0.0...1.0].(with the exception of I and Q, which covers a slightly larger range)..Inputs outside the valid range may cause exceptions or invalid outputs...Supported color systems:.RGB: Red, Green, Blue components.YIQ: Luminance, Chrominance (used by composite video signals).HLS: Hue, Luminance, Saturation.HSV: Hue, Saturation, Value.....rgb_to_yiq..yiq_to_rgb..rgb_to_hls..hls_to_rgb..rgb_to_hsv..hsv_to_rgb.UUUUUU.?.UUUUUU.?.UUUUUU.?c....................C....R...d.\|...d.\|.....d.\|.....}.d.\|.\|.....d.\|.\|.......}.d.\|.\|.....d.\|.\|.......}.\|.\|.\|.f.S.).N.333333.?..z..G..?.)\...(.?.G.z...?.H.z..G.?....Q..?.=..p=

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\GUID.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2875
Entropy (8bit):	5.0888898573115995
Encrypted:	false
SSDEEP:	48:gEetYdOquikANDszCmt2+hmZ7L8uANnV7ATYhVltJXd9AG0t:2BikA02+kpL8uANu0h5JXdeG0t
MD5:	5DA9C8F2BC3B5DAD409453C6A10C9E8F
SHA1:	DE48C2176C22872227FE9748CFF51452F824B366
SHA-256:	BACD5CD259B15248A0E22D96B7E4FDD7E84A146D4371BEF1E9CF60325E4A6037
SHA-512:	A58D2FD23FABAF567CDF0A0DCC4F16F61A521D04F33B2DE40695218B838C8BB7DD617D07254EA34CB9B9A53BB0FE52F5DEA9D19843C36DA2544ABC4D3E12953C
Malicious:	false
Preview:	o....................................@....p...d.d.l.T.d.d.l.Z.d.d...Z.e.Z.e.Z.e.Z.e.j.Z.e.j.Z.e.j.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.G.d.d...d.e...Z.e...Z.d.g.Z.d.S.)..........Nc....................C........t.\|...S.).N....bytes....obj..r......comtypes\GUID.py..binary...........r....c....................@.......e.Z.d.Z.d.e.f.d.e.f.d.e.f.d.e.d...f.g.Z.d.d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.e.d.d.....Z.d.S.)...GUID..Data1..Data2..Data3..Data4.....Nc....................C...."...\|.d.u.r.t.t.\|...t.\|.......d.S.d.S.).N...._CLSIDFromString..str..byref....self..namer....r....r......__init__.................GUID.__init__c....................C........d.t.\|.....S.).N..GUID("%s")..r......r....r....r....r......__repr__!............GUID.__repr__c....................C.......t...}.t.t.\|...t.\|.......\|.j.}.t.\|.....\|.S.).N....c_wchar_p.._StringFromCLSIDr......value.._CoTaskMemFree..r......p..resultr....r....r......__unicode__$....................GUID.__unicode

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	28275
Entropy (8bit):	5.5119502135354335
Encrypted:	false
SSDEEP:	384:9UrL7q18ygrTYfzh0HyfLYFfCdPMatah9Ju5FOTPUGgjJ+ZjqkCFg29d9G02/17h:9UP218IqWYvhj8FOwjsZovj2mC
MD5:	749AEBC2C8055C3474B63E17F76153E6
SHA1:	007F674DDDEC16520A7CF62210CA7639521BDE1A
SHA-256:	0E118038A1591C98EF9D2D735CC1562654DE2AB31F5413DEB8DF5BC325B4396B
SHA-512:	571979AB7ACFBF32AA748D09E6B58EFFC9707BA146241BA62ABA3E2AA796E24C8B186B6A9C9E25EE8B5B47DF7930B9957EC1807C9C49AAFF8870145E88E260AF
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y0..Z...z.d...d...Z.e.e...e...d.Z.[.w.w.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.rpd.d.l.m.Z...d.d.l m!Z!..n.e.j"d.d.....d...Z.d.d.l#m$Z$..d.d.l m%Z%..d.d.l&m'Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/..e0d.d.d...Z1G.d.d...d.e.j2..Z3e..4e5..Z6e6.7e3......d.d.d...Z8e9g.e:j;_<e9e:j;_=e>e:.;e?....Z@d.d...ZAG.d.d...d.eB..ZCe$ZDe$ZEeFZGeFZHd.ZId.ZJd.ZKd.ZLd.ZMd.ZNd.ZOd.ZPd ZQd!ZRd"ZSd#ZTd$ZUd%ZVd&ZWd'ZXd(ZYd)ZZd*Z[d+Z\d,Z]e^Z_e_Z`d.Zad-Zbd.Zcd.Zdd.Zed.ZfegjhZiejjhZkd.Zld.Zmd.Znd.Zod.d/..Zpd.d0d1..Zqeq....d2d3..Zrekjre6jsete.d4d5d6....f.d7d8..Zue..veu....i.Zwi.Zxd9d:..ZyG.d;d<..d<e>..ZzG.d=d>..d>e>e{..ez..Z\|G.d?d@..d@e{e\|dA..Z}G.dBdC..dCe...Z~G.dDdE..dEe...Z.G.dFdG..dGe...Z.G.dHdI..dIe...Z.d.dKe+f.dLdM..Z.dKe-f.dNdO..Z.dKe-f.dPdQ..Z.dKe+f.dRdS..Z.e.dTdUdV..Z.e...r.G.dWdX..dXe{ezdA..Z.n.e.Z.G.dYdU..dUe.ezdA..Z.G.dZd[..d[e...Z.G.d\d]..d]e...Z.

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\_comobject.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	18950
Entropy (8bit):	5.372038244007506
Encrypted:	false
SSDEEP:	384:Qq9EBBrbHDB3h5Mg/nhbiwOeGgtFZAwbsWOtM2W:Qhvjhh5BbiwhGu3A3WOtMp
MD5:	1280C9A6B603044A28BACEFFF0761843
SHA1:	3E0B8EE57CBAF3F9BE988123904B1BDC19218176
SHA-256:	F267FCD07C900D62D172990936930D5B7AA118245DC44E8A9CEF33E0C4BCD5D6
SHA-512:	C27F8D4D23481BDD3522E4F28D080D7A0A48D8C94EA6DC0912D3DEB37B32E2CFF76BDB35A8DFB4FD2865E07829B4B851BE8202749699BCCD2AC9B9E9B51222E7
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&m'Z'..e..(e)..Zej+Z,ej-Z.ej/Z0d.Z1d.Z2d.Z3d.Z4G.d.d...d.e5..Z6d.d...Z7d.d...Z8d.d...Z9d.d...Z:d.d...Z;G.d.d...d.e<..Z=d.d...Z>i.Z?z.e.j@jAZBe.j@jCZDW.n...eEy.......d.d.lFZFeF.G..ZHeHjIZJeHjKZLd.d...ZBd.d ..ZDY.n.w.e.e...g.eB_Me.e...g.eD_Me.eB_Ne.eD_NG.d!d"..d"e<..ZOG.d#d$..d$e<..ZPG.d%d&..d&e<..ZQd&g.ZRd.S.)'.........FormatError..POINTER..Structure..WINFUNCTYPE..byref..c_long..c_void_p..oledll..pointer..windll....CopyComPointerN....COMError..ReturnHRESULT..instancemethod.._encode_idl....ISupportErrorInfo..ReportException..ReportError....IPersist....DISP_E_BADINDEX..DISP_E_MEMBERNOTFOUND..E_FAIL..E_NOINTERFACE..E_INVALIDARG..E_NOTIMPL..RPC_E_CHANGED_MODE..S_FALSE..S_OK....IProvideClassInfo..IProvideClassInfo2....................c..........

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\_memberspec.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17783
Entropy (8bit):	5.158929845465528
Encrypted:	false
SSDEEP:	384:NEw//RAY96ChWvqRLLeAWBpvwGfranfMmzvBmW+18:Nb/RVhWiRuAWzvw9nfMmbBmWG8
MD5:	6E6A96137DC554D55EB06D09E015174C
SHA1:	B1A4DCBCD93FF347D95CF7CD3D7CE74B44B28084
SHA-256:	BDC8D473F64DAF8CBE0158683E64D554D18A5496331780732179C9A356A44EC5
SHA-512:	24CFEF1E6EBBB86D34EAE7E8D61BD96564D951A18EA9A73266DBDEF0C70147A4AEAEB9A2446782D69A07F0578B2A63E998B1AC66A823B54B33806520ECD7619F
Malicious:	false
Preview:	o....................................@....d...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.e.e.e...f...Z.e.e.e.e...e.f...Z.e.e.e.f...Z.e.e.e...e.e...e.f...Z.e.e.e...e.e...e.e.f...Z.e.e.e.f...Z.d.d.d.d.d.d...Z.d.d...Z.e...Z.d.e.f.d.e.e...d.e.e...d.e.e...d.e.d.e.e.e...e.e...e.e...e.f...f.d.d...Z.d.e.e.d.f...d.e.e.e.d.f...e.e.e...d.f...f...f.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.f...Z.d.e.f.d.d...Z e.e.d.e.f.....Z!e.e...Z"d.e.d.e.f...d.e.e.e...d.f...d e.e.d.f...d.e.d.e.f...f.d!d"..Z#G.d#d$..d$e...Z$G.d%d&..d&e...Z%G.d'd(..d(e%..Z&G.d)d..de%..Z'G.d+d,..d,e...Z(G.d-d...d.e...Z)G.d/d0..d0e...Z*G.d1d2..d2e...Z+d.S.)3.....N....Any..Callable..Dict..Iterator..List..NamedTuple..Optional..Tuple..Type..Union...._CData.............................in..out..lcid..retval..optionalc....................C........t.d.d...\|.D.....S.).Nc....................S........g.\|.].}.t...\|.d.....q.S.).r........_PARAMFLAGS..get.....0..n..r#.....comtypes\_memberspec.py..<listcom

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\_meta.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1474
Entropy (8bit):	4.9375393285443465
Encrypted:	false
SSDEEP:	24:g4FWir5UsKbohnDaiScezh5vYs/6s8VInrSlfHhdPEo4LWKbiyZDzOTLs:gCWiFjJBScLG6s8VInrStBx8DiyZzUs
MD5:	78E07EC62E3C7B9C49E44AD28C37E196
SHA1:	57A42DD7D5C3D7FA5A4EFE1CE461257425D37629
SHA-256:	F94E9325025F076B6C95EE2B9AA0732ECB5D3387B7B04199014371663421D1BD
SHA-512:	8F40A044903C706FD72900E2508D449C2CC10F0BEE907A51140FC0CF824304BA61E08D0547D1DED72ECBDDB171C91AA1E26CD2427080CF5C906289D34557D378
Malicious:	false
Preview:	o....................................@....V...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...e...Z.d.S.)..........POINTER..c_void_p..castNc....................C....6...\|.j.d...}.t.\|.t.\|.....}.\|...\|...}.t.\|.j...\|.j.d.<.\|.S.).Nr......__clsid...._com_interfaces_r....r......QueryInterface..str.._reg_clsid_..__dict__....self..itf..punk..result..r......comtypes\_meta.py.._wrap_coclass...................r....c....................C.... ...t.\|.\|.j.d...\|.f...r.\|.S.t.\|.....).Nr........isinstancer......TypeError....cls..objr....r....r......_coclass_from_param...............r....c....................@........e.Z.d.Z.d.d...Z.d.S.)..._coclass_metac....................C....t...t...\|.\|.\|.\|...}.\|.t.f.k.r.\|.S.d.\|.v.r.\|.d...}.\|.t.j.t.\|...<.t.d.\|.j...\|.t.f.t.t.t...d.....}.d.d.l.m.}...\|.\|.\|.<.\|.S.).Nr......POINTER(%s)....__ctypes_from_outparam__..from_paramr........_pointer_type_cache....type..__new__..object..comtypes..com_coclass_registryr......_coclass_pointer_meta..__name__r

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\_npsupport.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	5.490658242215756
Encrypted:	false
SSDEEP:	96:mtpNbI6uOKWO15UIyAJ+EqAf78sj6sJrPPe44z:m/5OTURAJ+yvjdJrPPJc
MD5:	6A4F416917B22B544A4D9A08410A90BA
SHA1:	372EE024C337064EBAB5DBC2A34978F59C4575E3
SHA-256:	E4F0A93B6D4B1AE49612BCB960C49398C7FA71495C5205E2FDF69AF657175D3F
SHA-512:	15148CE7B1F443B77015566EE2F4947B1C20AEC2DAAEFBDDB6621990843073567F5AA49EF97C35A299EB6E91C9F861DEDFC39DE39B782B2B268C1D21FFCFEC07
Malicious:	false
Preview:	o....................................@....4...d.Z.d.d.l.Z.e.j.d.k.Z.G.d.d...d...Z.e...Z.d.g.Z.d.S.)..+ Consolidation of numpy support utilities. .....N...........c....................@....L...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.S.)...Interop..Class encapsulating all the functionality necessary to allow interop of. comtypes with numpy. Needs to be enabled with the "enable()" method.. c....................C...."...d.\|._.d.\|._.i.\|._.d.\|._.d.\|._.d.S.).NF....enabled..VARIANT_dtype..typecodes..datetime64..com_null_date64....self..r......comtypes\_npsupport.py..__init__.....................Interop.__init__c....................C.......\|.j.s.d.S.t.r.d.n.d.}.d.\|.f.d.\|.f.g.}.t.g.d...d.d.d.d.d.d.d.d.d.d.d.d.d.d.\|.\|.\|.\|.\|.g.d.g.d...d...}.d.d.d.d.d.\|.f.g.}.\|.j...\|...S.)...Create a dtype for VARIANT. This requires support for Unions, which. is available in numpy version 1.7 or greater... This does not support the decimal type... Return

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\_safearray.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2566
Entropy (8bit):	5.458815908394629
Encrypted:	false
SSDEEP:	48:g8KrDlnP5AlgNxKyMM90LA/4HBFSAz6HAKQ5m326a4zsR60ggXPdGjJwTqhQM:BKrDlnvNxKyMM90LA/4HrLGHAKQa2EzZ
MD5:	E391A1AAC7CDCAA92AC9DC0276E8203A
SHA1:	083A411D11C0667265D1B9957C1D5BBCF6095576
SHA-256:	F7914210AAFDFC5402AFC66C02985AA1015BAF730792B31B3C2DCA8447B80CD4
SHA-512:	373DDB3A911CD2A70960BE4D47162B65B6333025449DA1F3D878F172A13309082B9899EAC56DD800DEA285296B8C9C570FFC283F38D0E948444E5E60B7E42984
Malicious:	false
Preview:	o....................................@....~...d.Z.d.d.l.T.d.d.l.T.d.d.l.m.Z.m.Z...e.Z.e.Z.e.Z.e.d...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e.Z.e.j.Z.e.e._.e.e...e.g.e._.e.j.Z.e.e...e._.e.e.e.e.g.e._.e.j.Z.e.e...e._.e.e.e.e...e.g.e._.e.j.Z.e.e...e._.e.e.e.e...g.e._.e.j.Z.e.e._.e.e...g.e._.e.j.Z.e.e._.e.e...e.e...g.e._.d.d...Z.e.j.Z.e.e._.e.e...e.e...e.g.e._.e.j Z e.e _.e.e...g.e _.e.j!Z!e.e...e!_.e.e.e.g.e!_.e.j"Z"e.e"_.e.e...g.e"_.e.j#Z#e$e#_.e.e...g.e#_.e.j%Z&e.e&_.e.e...e$e.e...g.e&_.d.d...Z%e.j'Z(e.e(_.e.e...e$e.e...g.e(_.d.d...Z'e.j)Z)e.e)_.e.e...g.e)_.e.jZe.e_.e.e...e.e...e.g.e_.e.j+Z+e.e+_.e.e...g.e+_.e.j,Z-e.e-_.e.e...e.e...g.e-_.d.d...Z,e.j.Z.e.e._.e.e...g.e._.d.S.)..3SAFEARRAY api functions, data types, and constants..........*....HRESULT..GUID..oleaut32c....................@........e.Z.d.Z.d.e.f.d.e.f.g.Z.d.S.)...tagSAFEARRAYBOUND..cElements..lLboundN....__name__..__module__..__qualname__..DWORD..LONG.._fields_..r....r......comtypes\_safearray.pyr.....................r....

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\automation.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	19953
Entropy (8bit):	5.68913333831818
Encrypted:	false
SSDEEP:	384:8jo65EQyqAKDZpQOyo8076DUHMICOznSN:MgQyLKtpgUBVDzm
MD5:	4C5DD413D7C5891D4B1413C6EF3DC992
SHA1:	89654D174DE55E7C6771790ED3807B890C55A5D0
SHA-256:	A9532164709CDB6C3FA4FAF84B10B74AE2CB45001CFE8D5EFA69C1FBF4C4AFA6
SHA-512:	514CBFC94E6A9CF6BC5E7C660524003290FAEC184C6566767864F978D51F78172093E5103A05C89C08265C1EFAA8427469B115FD8477B0DA1DE045AE288E904A
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z ..d.d.l!T.d.d.l"Z.d.d.l.Z.e.rjd.d.l.m#Z#..z.d.d.l.m$Z$..W.n...e%e&f.y.......G.d.d...d.e'..Z$Y.n.w.e.Z(e.Z)e.Ze+Z,d.Z-d.Z.d.Z/d.Z0e1Z2e-Z3e.Z4e/Z5e0Z6e2Z7e...Z8e9e8..Z:e;e9e1......Z<e...d.d.d.d.d.d...Z=e1Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd.ZGd.ZHd.ZId.ZJd.ZKd.ZLd.ZMd.ZNd.ZOd.ZPd.ZQd ZRd!ZSd"ZTd#ZUd$ZVd%ZWd&ZXd'ZYd(ZZd)Z[d.Z\dZ]d+Z^d,Z_d-Z`d.Zad/Zbd0Zcd1Zdd2Zed3Zfd4Zgd5Zhd6Zid7Zjd8Zkd9Zld:Zmd;Znd<Zod=Zpd8Zqd8ZrG.d>d?..d?es..ZtetZueuZvG.d@dA..dAes..ZwewZxG.dBdC..dCes..ZyeyZzezZ{e\|dD..Z}e}j~Z.e.ez..e.ez..e+e,f.e._.e}j.Z.e.ez..f.e._.e.j.j.Z.e.e.f.e._.e.e._.e}j.Z.e.ez..e.ez..f.e._.e}j.Z.e.ez..e.ez..f.e._.ezd...ez_.ez..ez_.ez....ez_.Z.eIe._.dEe.j._B[.e;e9e1......Z.d.dFl.m.Z...e.j...e.ez....G.dGdH..dHe'....Z.G.dIdJ..dJe...Z.e.g.e.dKdLg.e.dMf.dNg.e.ez..dOf.dNg.e.e...dPf...e.g.e.dQ

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8313
Entropy (8bit):	5.56696024555529
Encrypted:	false
SSDEEP:	192:rXt20EZo5Q0MNcaVnYS/kLNpmEZ/TP3u6pFt6UE4u6LREGCJHe/c1:BEEQx0iEIAtA0/UHe4
MD5:	C22CCBE927618561168508A5DC6E7229
SHA1:	41846B5BF37CA12F9037083A7E552DBB8193A5CC
SHA-256:	9225FD35B9F8B53EE2A40C7951EB1DCB69A88EB5FEB2661F964A017DC988A225
SHA-512:	31485AC24B53947B8CE77C8D2087D17011E4897ED8F648701927B56934C42EA11F28360153AEFA376F497DCED91D9DCF912A15E9A51DD5E7F5573971AA0BAD7E
Malicious:	false
Preview:	o....................................@....0...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.rbd.d.l.m Z ..e...Z!d.d.l"Z.e.d.e.d...Z#e..$e%..Z&d.e.d.e.f.d.d...Z'd.e.d.e.f.d.d...Z(e(Z)e'e..e.j+.._,e.d.e.e-e.e.f...d.e.f.d.d.....Z.e.d.e.e-e.e.f...d.e.e#..d.e#f.d.d.....Z.....d1d.e.e-e.e.f...d.e.e.e.....d.e/d.e.f.d.d...Z.d.e.d.e.e...d.e.e.e.....d.e.f.d.d...Z0e.r.e.d2d.d ....Z1e.d3d!d ....Z1d3d"d ..Z1e.d.e.e-e.e...e.f...d.e.f.d#d$....Z2e........%..d4d.e.e-e.e...e.f...d&e.e3..d'e.e-..d.e.e.e#....d.e/d(e.e.j4..d.e#f.d)d$....Z2..........d5d.e.e-e.e...e.f...d&e.e3..d'e.e-..d.e.e.e.....d.e/d(e.e.j4..d.e.f.dd$..Z2e.d+e-d.e.e#..d.e#f.d,d-....Z5e.d1d+e-d.d.d.e/d.e.f.d.d-....Z5....d1d+e-d.e.e.e.j.....d.e/d.e.f.d/d-..Z5g.d0..Z6d.S.)6.>comtypes.client - High level client level COM support package......N....Any..Optional..overload..Type..TYPE_CHECKING..TypeVar..Union..

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\_code_cache.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4826
Entropy (8bit):	5.551900638749422
Encrypted:	false
SSDEEP:	96:E4G1QUzx+ao1aOaNp4byfon6kKbGDJl3h5VWaq5BjiwADH6GP9h7TnoqB2:C0ao1dTtwAfKB2b6i7TnoqB2
MD5:	3B45755BECB71F82EED857B63E8B4A82
SHA1:	3A206C84D43C86D14A03C5C044EB272D2844203E
SHA-256:	3CDA1E4F44BB0F89A61E30A3DA02CE206C564D0A16D85852A9390FA2920ECA12
SHA-512:	1119DC53153C06DC882A51C8B6176C76C3505B2CBF71F1520E6F3B5FAF7CE923DD7A8628A9CC10605C1F707D9857B06DB6F71A1C05126E7B1F9A3570058B749C
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...e...Z.d.d...Z.d.d...Z.e...d...j.Z.e...d...j.Z.e.j.e.j.e.j.e.j.g.e._.e.j.e._.e.j.e.j.e.j.g.e._.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...comtypes.client._code_cache helper module...The main function is _find_gen_dir(), which on-demand creates the.comtypes.gen package and returns a directory where generated code can.be written to.......N....wintypesc....................C........t.\|...S.)..8.... On Python 3.4 and later, when a package is imported from. an empty directory, its `__path__` will be a _NamespacePath. object and not a list, and _NamespacePath objects cannot. be indexed, leading to the error reported in #102.. This wrapper ensures that the path is a list for that reason.. ....list....path..r......comtypes\client\_code_cache.py.._ensure_list...........r....c....................C...."...t.....d.d.l.m.}...t.\|.j...}.t.\|...s.t.t.d.d...}.d.t.j.d.d..

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\_constants.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4621
Entropy (8bit):	5.230052291110813
Encrypted:	false
SSDEEP:	48:gvXlYBj9/4aUXH0Xzx9Oiu2xx88aio9cqAJCtaOLv/e0r2Rk/DPH6sB9zbTZrxJM:rBj9/4/kd9Nu2b1DJz0asxHcFhD3Z
MD5:	39CA5D343961B11FF5530F648A673090
SHA1:	D4CAEE219A98040EC40D81D1A0C5889BD1B54958
SHA-256:	D1E21CEF9565500F52BA7BBA5111C5DA8A382CA60744E27B8E6913CEFE338C9E
SHA-512:	1A033CEF491365BD180A4198FACF3A6810ED4A901E32C97304C32C279AAC752E0F1E70207DFCA62E4135BA81F12ED4B53DBE4BA3C078100B24A6718E3AB78593
Malicious:	false
Preview:	o....................................@....L...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......Nc....................@....V...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._frozen_attr_dict..c....................C........\|.\|.v.r.t...\|.\|...S.).N....AttributeError....self..namer....r......comtypes\client\_constants.py..__getattr__................._frozen_attr_dict.__getattr__c....................C........t...).N....TypeError..r......key..valuer....r....r......__setitem__............._frozen_attr_dict.__setitem__c....................C...r....).Nr....r....r....r....r......__delitem__....r......_frozen_attr_dict.__delitem__c....................C...r....).Nr......r......otherr....r....r......__ior__............._frozen_attr_dict.__ior__c....................C...r....).Nr......r....r....r....r......clear!...r......_frozen_attr_dict.clearNc....................C...r....).Nr......r....r......defaultr....r....r......pop$

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\_events.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8511
Entropy (8bit):	5.377055048592428
Encrypted:	false
SSDEEP:	192:qj+M9ilgoA1Xpjjv3sJ/l26AzznKIIMF1sLYbNIWolUvzlFLL:qSjgoA5pjjv8ovnKbIeIf
MD5:	0368B5A6CB45BA648452D2EE00F47304
SHA1:	26F6B9F05FA08D5BAFE9194E96652AE4A98C45A2
SHA-256:	5B1B59BBF387F35A19F166F6BCD24AEB1BAB5E4F2682AA81E32504A8541E9C1B
SHA-512:	D19F0816DD13EC0CA16FA728F46B55DB7C61AC2B72E7730D15F994FB52F4166E3829C441F2097F0B7A0A60F0A4C40347FA6C3EE13585CDFF74429D3C8D26D057
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.e...e...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.d...Z.d.d...Z.d.S.)..........print_functionN....GetModulec....................@....,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._AdviseConnectionc....................C....$...d.\|._.d.\|._.d.\|._.\|...\|.\|.\|.....d.S.).N....cp..cookie..receiver.._connect....self..source..interfacer......r......comtypes\client\_events.py..__init__..................._AdviseConnection.__init__c....................C....F...\|...t.j.j...}.\|...t...\|.j.....\|._.t...d.\|.....\|.j...\|...\|._.\|.\|._.d.S.).N..Start advise %s....QueryInterface..comtypes..connectionpoints..IConnectionPointContainer..FindConnectionPoint..ctypes..byref.._iid_r......logger..debug..Adviser....r......r....r....r....r......cpcr....r....r....r........................._AdviseConnection._co

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\_generate.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8425
Entropy (8bit):	5.588339831256897
Encrypted:	false
SSDEEP:	192:JiKR3ap/45QzuRr0niuiylV6byu6GXF2jmHo5Ys9T:Ji7p/EQw0iuiylV6bybGXwmHo5zF
MD5:	1A1E8DBD914D2DBFE078EC04000A364B
SHA1:	B8ABBC2471FA9737D33687621EC54666F2DBBEE4
SHA-256:	E12C3D97CB2658A596C1B17E4EF05BEBEAC6EA5F20277716E458E29E3090E7B9
SHA-512:	C10264F2E20C47328470643D191F1433A1D43FC8C5448817EFF4039F6F8D345ABE8267054FAC5BD31D351F3F1E730798F181EA666DA348ABFA6F970DA19A77BB
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...e...e...Z.e.j.d.....e.j...Z.d.e.d.e.j f.d.d...Z!d.e.d.e.d.e.e.e"f...f.d.d...Z#d.e.e.e.j$f...d.e.j f.d.d...Z%d.e.d.e.j$f.d.d...Z&d.e.d.e.d.e.j f.d.d...Z'd.e.d.e.d.e.j f.d.d...Z(G.d.d...d.e)..Z*d.e.e.e.f...f.d.d...Z+e.d.k.r.e%e.j,d ......d.S.d.S.)!.........print_functionN....Any..Tuple..List..Optional..Dict..Union....GUID..typeinfo....codegenerator..tlbparser..PATH..fullname..returnc....................C....<...d.d.l.m.}...t.j.j.r.t.j.j.\|.j.v.r.\|.j...t.j.j.....t...\|...S.)..(helper function to import dotted modulesr....N....comtypes.gen..gen..comtypes..client..gen_dir..__path__..append..importlib..import_module..r......g..r#.....comtypes\client\_generate.py.._my_import.................r%.....tlib_string..dirpathc....................C....x...t.\|.t...s.J...t.j...\|...r.\|.d.f.S.\|.r(t.j...t.j...\|.\|.....}.t.j...

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\dynamic.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	5.321692011159353
Encrypted:	false
SSDEEP:	96:Zo91Z05qABKbMMGOKerHqOpC7sU6xfqD/8QqW4DL9VF9AYCUSHM4uXUFXYA9Cxl:ZM1Z0EAnxSKiVvCD/L29/9A84u5GCl
MD5:	F243C01924637A302878A1E5668841E1
SHA1:	83D5C45BF2B99F13CAF024D8E175912E36439491
SHA-256:	C9BA1C96EB22C786C0102D70B4D665AF1E2BEA1CDFD633DDC2A40795F9208D27
SHA-512:	B080F2E9A156EF3493168A49B8034F05F87DC9140F52E60CD32FE16D367349AA914A62D69DDAB45B72E31C7753FF635FC9E96ECD3787EE6678D50282EB04791F
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.e.d...Z.e.j.e.j.e.j.e.j.e.j.g.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.g.Z.d.S.)......N....Any..Dict..Optional..Set..Type..TypeVar....automation....lazybind....COMError..GUID..IUnknown..hresult.._is_object.._T_IUnknown....boundc....................C....^...t.\|.t...r.\|.S.t.\|.t...t.j.....r-z.\|...d...}.W.n...t.t.f.y&......t.\|.....Y.S.w.t...\|.\|...S.\|.S.)..kWrap an object in a Dispatch instance, exposing methods and properties. via fully dynamic dispatch.. r........isinstance.._Dispatch..ctypes..POINTERr......IDispatch..GetTypeInfor......WindowsErrorr......Dispatch....obj..tinfo..r%.....comtypes\client\dynamic.pyr!................................r!...c....................@....X...e.Z.d.Z.d.e.d.d.d.d.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.d.f.d.d...Z.d.S.)...MethodCaller.._id.._objr......returnNc....................C

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\client\lazybind.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6413
Entropy (8bit):	5.146574812144704
Encrypted:	false
SSDEEP:	96:uKskYkpqhMlOmv2AjaQ4uvDXlzZf1lM7b93o2wA2Jz9tBj6tDkLrb14YVcb:UhMQmOA7jvT1mNwVl97aDkPb2YVcb
MD5:	63BB47EF994A310842F093425471DA40
SHA1:	31D6FB8532F07125871399F8BEDCB8BC2DBFE552
SHA-256:	5BC22669A6084024D760E5E0988625E325EA5526A421B0AE3941AB339CB6D2BF
SHA-512:	F280D4F6C0CB36627A8B8B823B543E49AE329AE7E765A518B6EA997A8197F5EFEA966E42342AF5211F3A05CABE02ED04BFEC7A8B7F55725725B5CC904C7C1E4B
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.e.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N....IEnumVARIANT....DISPATCH_METHOD....DISPATCH_PROPERTYGET....DISPATCH_PROPERTYPUT....DISPATCH_PROPERTYPUTREF....DISPID_VALUE....DISPID_NEWENUM....FUNC_PUREVIRTUAL..FUNC_DISPATCHc....................@........e.Z.d.Z.d.Z.d.d...Z.d.S.)...FuncDesc.\Stores important FUNCDESC properties by copying them from a. real FUNCDESC instance.. c....................K........\|.j...\|.....d.S.).N....__dict__..update....self..kw..r......comtypes\client\lazybind.py..__init__.............FuncDesc.__init__N....__name__..__module__..__qualname__..__doc__r ...r....r....r....r....r...................r....c....................@....4...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...NamedPropertyc....................C........\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N....get..put

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\connectionpoints.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2724
Entropy (8bit):	5.3387320777339085
Encrypted:	false
SSDEEP:	48:gGCbTWuEyBiWOFO6LRgvXloogSXlfkffrUeXmbZowL5f/lkeMlGTplo3lfWl/vrP:zC1EyBiWODlClbgslfkfAeXtuplkeMlU
MD5:	F7A83D20CDAA1315A2C16C67DB525619
SHA1:	4E62FEE6CC8EC8DC82AA081D96E313CC64680AAF
SHA-256:	FF1A495C792DF679802FF9B8D7646B777220740886704B63E1050F126B0F0D13
SHA-512:	7E35189BF2F06AECD26BD180DE950EE936ADB9F21C6D34FEC6D7F327686AB8A64AB21258FD9996145CAC7D1D3B20677D74CB620EE24368E2173C2547F2833E06
Malicious:	false
Preview:	o....................................@....H...d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.g.e.d.d.g.e.e.e.....d.f...e.g.e.d.d.g.e.e...d.f.d.g.e.e.e.....d.f...g.e._.e.g.e.d.d.g.e.e...d.f...e.g.e.d.d.g.e.e.e.....d.f...e.g.e.d.d.g.e.e...d.f.d.g.e.e...d.f...e.g.e.d.d.g.e.d.f...e.g.e.d.d.g.e.e.e.....d.f...g.e._.e.g.e.d.d.g.e.d f.d.g.e.e...d!f.d.g.e.e...d"f...e.g.e.d#d.g.e.d f...e.g.e.d$..e.g.e.d%d.g.e.e.e.....d.f...g.e._.e.g.e.d.d.g.e.d f.d.g.e.e.e.....d.f.d.g.e.e...d"f...e.g.e.d#d.g.e.d f...e.g.e.d$..e.g.e.d%d.g.e.e.e.....d.f...g.e._.d.S.)&.....N....*....IUnknown..COMMETHOD..GUID..HRESULT..dispidc....................@.... ...e.Z.d.Z.d.e.e...f.d.e.f.g.Z.d.S.)...tagCONNECTDATA..pUnk..dwCookieN....__name__..__module__..__qualname__..POINTERr......c_ulong.._fields_..r....r......comtypes\connectionpoints.pyr.....................r....c....................@........e.Z.d.Z.e.d...Z.g.Z.d.S.)...IConnectionPoint

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\errorinfo.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3378
Entropy (8bit):	5.445894166898573
Encrypted:	false
SSDEEP:	96:dCDK1xezb4AG/uvqQGYcXAsO5U+MVLWg7j:dCu/ez0AG/uihYs+lMV7/
MD5:	8042D51C62E325964D38AA39A2F9DBE7
SHA1:	D4520E5D2A5AF184536FC4ACD67D4EFD1629567C
SHA-256:	65E9C1E598FE228F7DEDC04FF31752327CBE30B77C7F5CB5ECF9E3F604A8DABB
SHA-512:	4DF37CEADFCEF3E2240EE062D9A6A4B0FEA437B14DB7FE2112CB613195AFF1370A189FF3B3F66AAB69B83341A1B3C41C1068D42BF7DFCF0F57F9BEA0949C5276
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.T.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.d.d.d.e.f.d.d...Z...d.d.d...Z.g.d...Z.d.S.)......N....*....IUnknown..HRESULT..COMMETHOD..GUID..BSTRc....................@.......e.Z.d.Z.e.d...Z.e.g.e.d.d.g.e.e...d.f...e.g.e.d.d.g.e.d.f...e.g.e.d.d.g.e.d.f...e.g.e.d.d.g.e.d.f...e.g.e.d.d.g.e.d.f...g.Z.d.S.)...ICreateErrorInfo.&{22F03340-547D-101B-8E65-08002B2BD119}..SetGUID..in..rguid..SetSource..szSource..SetDescription..szDescription..SetHelpFile..szHelpFile..SetHelpContext..dwHelpContextN....__name__..__module__..__qualname__r......_iid_r....r......POINTER..LPCOLESTR..DWORD.._methods_..r"...r".....comtypes\errorinfo.pyr.............................r....c....................@.......e.Z.d.Z.e.d...Z.e.g.e.d.d.g.e.e...d.f...e.g.e.d.d.g.e.e...d.f...e.g.e.d.d.g.e.e...d.f...e.g.e.d.d.g.e.e...d.f...e.g.e.d.d.g.e.e...d.f...g.Z.d.S.)...IErrorInfo.&{1CF2B120-54

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\hresult.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	5.56680517745844
Encrypted:	false
SSDEEP:	48:gvWeTn7dbyVemwndCro/go6Bm5Kg5en7Z57ZxLn:UWeL748bd28goHPAn7/Ln
MD5:	6A13B60CEA09995C2E6BC61F6A518711
SHA1:	FE173E5BE81D0883C9AE4ED5D823D129F24A418A
SHA-256:	8591D372A6B8253FF520709212DD32A3EDE7A32AC9E43CF3C188C0CB7BAA715F
SHA-512:	32F8A9B4FD2D19E56EABC6CEACAE0C1042E46684CDD7AD9FA42006AD82D7E99890CDE4109F97B1F57123FF1E11C313032729DBBEBFD755CF6697D4B72A0D8F6B
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&d'..Z&d.Z'd.Z(d(Z)d)Zdd+..Z+d,S.)-.................@....@....@....@...W.................................................J.......................................................................................................c....................C....&...d.d.l.m.}...\|.\|.d.>.\|.d.>.B.\|.B...j.S.).Nr........c_long..............ctypesr.....value..Z.sevZ.fac..coder.....r2.....comtypes\hresult.py..MAKE_HRESULT;............r4.............c....................C....4...d.d.l.m.}...\|.\|...j.}.\|.d.k.r.\|.S.\|.d.\|.d.@.B...j.S.).Nr....r)...................r-.......xr*...r2...r2...r3.....HRESULT_FROM_WIN32I..................r=...N.,..S_OK..S_FALSE..E_UNEXPECTED..E_NOTIMPL..E_NOINTERFACE..E_POINTER..E_FAIL..E_INVALIDARG..E_OUTOFMEMORY..CLASS_E_NOAGGREGATION..CLASS_E_CLASSNOTAVAILABLE..CO_E_CLASSSTRING..CO

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\messageloop.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1794
Entropy (8bit):	4.9925480797463795
Encrypted:	false
SSDEEP:	24:gkaj8vxU1uTlokNltocFWurzpZvhkN+9jSfh3MWLYc7Wjc9fGJ7NWrlczTscckxJ:gaasTld3OiJXppKN+8pLsjEGRvc7o
MD5:	5FF4FD7827B21577FA9A7A0B2E8DDA92
SHA1:	33AC0D967A0038E4F2C6BDAF5CB27C26039E652B
SHA-256:	B8D65EC540BF22BE6E355C1F205A64CD5BC004DD204E6EAF843AE28E64C3746B
SHA-512:	808E2C78EA20516DE7E4C6244BFC716414EC594AD275B83B45F57376F3B17834EA1BA3CF16B1892910A7141469CC2F7948D18D283605D1CB3245828E76A2EDD0
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d...Z.e.j.Z.e.j.e.j.e.j.e.j.g.e._.e.j.Z.e.j.Z.G.d.d...d.e...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.g.d...Z.d.S.)......N....WinDLL..byref..WinError....MSG..user32c....................@....6...e.Z.d.Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._MessageLoopc....................C........g.\|._.d.S.).N...._filters....self..r......comtypes\messageloop.py..__init__............._MessageLoop.__init__.....c....................C........\|.j...\|.\|.....d.S.).N..r......insert..r......obj..indexr....r....r......insert_filter............._MessageLoop.insert_filterc....................C........\|.j...\|.....d.S.).N..r......remove..r....r....r....r....r......remove_filter............._MessageLoop.remove_filterc....................C....T...t...}.t.\|...}...t.\|.d.d.d...}.\|.d.k.r.t.....\|.d.k.r.d.S.\|...\|...s)t.\|.....t.\|.....q.).N.....r....r......r....r......GetMessager......filter_message..TranslateMessage..DispatchMessage..r......

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\patcher.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	5.015209520347607
Encrypted:	false
SSDEEP:	48:gtev8YJvu7lbyIPu589FJYSvr8LEwb6nSOYwuo/GUSOBPHg+HFACpUWafNVE4O0J:O48YJqRycu58vdrJweHYw7usdg+eCp0B
MD5:	1589D4E8CE4886095FBDDA437C8EA7EF
SHA1:	5D1A9CC7B99263FEE984B220E62CDD0032C76F89
SHA-256:	D7D9D0D05AB4AE60776C98A5B9BC8195BB58899017D6062B60EBA2E1A3B8D89B
SHA-512:	D74374C3FE659BFED5377592551E5D41975282C7E2B61CB59D4F84C3B94FBAA5D05F21B3BC549B99A2B1C1B328E443B31E3A0BD41872D46C9BD3692C1EA836F9
Malicious:	false
Preview:	o....................................@....,...G.d.d...d.e...Z.d.d...Z.G.d.d...d.e...Z.d.S.).c....................@.... ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...Patch..... Implements a class decorator suitable for patching an existing class with. a new namespace... For example, consider this trivial class (that your code doesn't own):.. >>> class MyClass:. ... def __init__(self, param):. ... self.param = param. ... def bar(self):. ... print("orig bar").. To add attributes to MyClass, you can use Patch:.. >>> @Patch(MyClass). ... class JustANamespace:. ... def print_param(self):. ... print(self.param). >>> ob = MyClass('foo'). >>> ob.print_param(). foo.. The namespace is assigned None, so there's no mistaking the purpose. >>> JustANamespace.. The patcher will replace the existing methods:.. >>> @Patch(MyClass). ... class SomeNamespace:. ... def bar(self):. ... print("replac

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\persist.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6093
Entropy (8bit):	5.6049095032125225
Encrypted:	false
SSDEEP:	96:ivjdE5rhMGB/A/FSH4FMUijxEqmKxPO1v+mzmLmi3L:ivjm5rCG5A9SHjjx9mKI1v+Qni3L
MD5:	B63A15DA1CF5CA17624B659EE4E497C1
SHA1:	3C0C066D9D0B28584568E98A60F85447CF8193AB
SHA-256:	E49EB6A4F97CFB6F678A8A10E4BD833063DCD69EE3692D7D98736036E06DD2A8
SHA-512:	2B79DDE916F6747083AD5F1F6BBFDED562D009D51F808C6F0B16D2C4AD013B2CCF6CC225934F39124540B38ECACE76F4E0B8C2ACCB531D51A469F49D89E15739
Malicious:	false
Preview:	o....................................@....l...d.Z.d.d.l.T.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(d.Z)d.Zd.Z+d.Z,d Z-d!Z.d"Z/d#Z0d$Z1d%Z2e...Z3Z4G.d&d'..d'e...Z5d.d(l.m6Z6..d.d.l7T.G.d)d..de6..Z8g.d+..Z9d,S.)-..This module defines the following interfaces:.. IErrorLog. IPropertyBag. IPersistPropertyBag. IPropertyBag2. IPersistPropertyBag2..The 'DictPropertyBag' class is a class implementing the IPropertyBag.interface, useful in client code...............WORD..DWORD..BOOL....GUID..IUnknown..COMMETHOD..HRESULT..dispid....IPersist....VARIANT..tagEXCEPINFOc....................@....>...e.Z.d.Z.e.d...Z.g.Z.e.g.e.d.d.g.e.d.f.d.g.e.e...d.f...g.Z.d.S.)...IErrorLog.&{3127CA40-446E-11CE-8135-00AA004BB851}..AddError..in..pszPropName..pExcepInfoN....__name__..__module__..__qualname__r......_ii

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\safearray.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11521
Entropy (8bit):	5.445039762468093
Encrypted:	false
SSDEEP:	192:ApBvyQDSPs76C6lRyOdEysN+2nCxRu68XnNIm:AnEPsf6lRyOdEysN+2n4QnWm
MD5:	ADBBF23BA4B7638E8B3C74E87D103C30
SHA1:	BA47C88954634C91BBA196FFB7E394CC323E1402
SHA-256:	A635313C5D8BB22D52B4EF5A3BF2A93159CDCD77D9F3FE67089E65CC22654FED
SHA-512:	6E02C621AEDDA5A60D2482640028CFBB7FEE8081A64892FFB244C0FDE289AEC375D451A478E885185B6C3F7613BB60F53F4BE5C2F232426A836C6CC284159C7D
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...i.Z.G.d.d...d.e...Z.e...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......N....POINTER..Structure..byref..cast..c_long..memmove..pointer..sizeof...._safearray..IUnknown..com_interface_registry....Patchc....................@....4...e.Z.d.Z.d.Z.e.....Z.d.d...Z.d.d...Z.d.d...Z.e.Z.d.S.)..!_SafeArrayAsNdArrayContextManager.....Context manager allowing safe arrays to be extracted as ndarrays... This is thread-safe... Example. -------.. This works in python >= 2.5. >>> with safearray_as_ndarray:. >>> my_arr = com_object.AsSafeArray. >>> type(my_arr). numpy.ndarray.. c....................C....>...t.j.......z.\|.j...j.d.7..._.W.d.S...t.y.......d.\|.j._.Y.d.S.w.).N.........comtypes..npsupport..enable..thread_local..count..AttributeError....self..r .....comtypes\safearray.py..__enter__......................+_SafeArrayAsNdArrayContex

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\server\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	5.467499042773453
Encrypted:	false
SSDEEP:	24:g8HNvO25PggR3j4pkkJLss7IA4GhEFhaoUNteAB9kdGaLhhrTx8RkLvCd1MXRCP+:g8425rwwZVFDU/x/qGqxDLGWRCDmxFbz
MD5:	BA97AD13ADCD5DD71A198C3B16F07477
SHA1:	EBC54D1FEF3974CE762CD9FB3301F8E4D95E8613
SHA-256:	F381D08D69783F4BC66621407E13E8054A748BD4033D5DF4E9195B62BEAEF464
SHA-512:	7DE27F320B3010BC7DE78C72B2D1F32C346002ABF66D7D648C3F655B4BF1C445D8EBAEC3997996496734212142AB985AB8DA1D831E826ED8FA97B56472A87223
Malicious:	false
Preview:	o....................................@....H...d.d.l.Z.d.d.l.Z.G.d.d...d.e.j...Z.d.Z.d.Z.e.j.j.Z.d.d.d...Z.d.d...Z.d.S.)......Nc....................@....b...e.Z.d.Z.e...d...Z.e...e.j.d.e...e.j...e...e.j...e...e.j...g...e...e.j.d.e.j.g...g.Z.d.d.d...Z.d.S.)...IClassFactory.&{00000001-0000-0000-C000-000000000046}..CreateInstance..LockServerNFc....................C....~...\|.r.\|.d.u.r.t.d.....t.j.j.}.n.\|.d.u.r.t.j.}.n.\|.}.t...\|.....}.\|...\|.\|.j.t...\|.......\|.r3t.j.j...\|...S.\|.d.u.r=t.j...\|...S.\|.S.).N.,interface and dynamic are mutually exclusive....ValueError..comtypes..automation..IDispatch..IUnknown..ctypes..POINTERZ"_IClassFactory__com_CreateInstance.._iid_..byref..client..dynamic..Dispatch..GetBestInterface....self..punkouter..interfacer....Z.realInterface..obj..r......comtypes\server\__init__.pyr...........................................IClassFactory.CreateInstance..NNF....__name__..__module__..__qualname__r......GUIDr......STDMETHOD..HRESULTr....r....r......c_void_p..c_int.._methods_

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\tools\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	119
Entropy (8bit):	3.641925328664078
Encrypted:	false
SSDEEP:	3:ztWlulehlra4lPlPl9PYKikcTg/lz:gqeho4VyMh
MD5:	12466FE56A0CC7D01649AA56B2A3667E
SHA1:	EE5526E2EAD9C93FE91DF003CC320D4537904E34
SHA-256:	CA2FA5033D35693871F841C85672DAF95364E880B3A6693DD7F4681304293EC2
SHA-512:	AF3350D1895DF0F43E11A465D47416C61BE19B554122118491239BCD673B3B2D628476DECEFC87DBEBDEC17B6A30107303D2D73CF6FF399B50156BE0AA9D691F
Malicious:	false
Preview:	o....................................@........d.S.).N..r....r....r....z.comtypes\tools\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\tools\codegenerator.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	42356
Entropy (8bit):	5.507084685256412
Encrypted:	false
SSDEEP:	768:XuS3wwifpMRSBcuzJlsISf0xg8RXc1XLjHYUTEcXD14+QYejwwzpbJQgkAhrF5sr:eIwPpMgBc2iD0e85cVLjH9TEcX5hQvZW
MD5:	4B3F3EF877B8B1880FA5FA860CA4B815
SHA1:	352CFCD2145B51F9876152090C1421E0BC15F88F
SHA-256:	C5A53C618888B87A8DF1F6842F5E93A1233E8A19D9D6D4EF83EEB25BE591E661
SHA-512:	CE3ACC77EB18C951F4DBD464E23C766ED2DB825A0018292C7112EA15AE224E3A7DB49D836084492B2BF010A91BF505F7F502612883058FE064CB56D547C10C45
Malicious:	false
Preview:	o....................................@....X...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...e.j.Z.e...e...Z.d.Z.G.d.d...d.e ..Z!e!..Z!G.d.d...d.e ..Z"G.d.d...d.e ..Z#i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..d$d%..d&d'..d(d)..dd+..Z$d,d-..Z%d.Z&d.d/..Z'd0d1..Z(G.d2d3..d3e)..Ze+d4d5g...Z,d6d7..Z-d8d9..Z.d:d;..Z/e.d.e.d.f...Z0e.e1e"e#f...Z2d<e1d=e1d>e.e1..d?e0d@e1f.dAdB..Z3G.dCdD..dDe ..Z4G.dEdF..dFe ..Z5G.dGdH..dHe ..Z6G.dIdJ..dJe ..Z7G.dKdL..dLe ..Z8G.dMdN..dNe ..Z9G.dOdP..dPe ..Z:G.dQdR..dRe ..Z;d.S.)S.........print_functionN....Any..Dict..Iterator..List..Optional..Sequence..Set..Tuple..Union....typeinfo....tlbparser..typedesc..typeannotatorTc....................@........e.Z.d.Z.d.d...Z.d.S.)...lcidc....................C........d.S.).N.._lcid......selfr....r......comtypes\tools\codegenerator.py..__repr__$............lcid.__repr__N....__name__..__m

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\tools\tlbparser.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	18490
Entropy (8bit):	5.75789868026758
Encrypted:	false
SSDEEP:	384:GQQ6th9BF0N1ZYzvONnErmiW9ZAvTzjGwpyJIhPjww:GIhw1REr29xwsidjww
MD5:	82AF53F1AB564D910719907CCC5C3E10
SHA1:	45612D0BD99A1EAACABF1F1EE491AA54667F1228
SHA-256:	2D7DED1A1C261D6491A8ED17EBFF63AE78909F79E079A0B2F04D8E43A3C0798D
SHA-512:	F7D1BD04D60EC9028B8B1D52CF305F13B28CD1E68F1809BF475CEDC6561CC3BBF78663043A5EB506B7036C3F1AEE55E01443E8CF0A2D8A34E7EDE2E4C04D20DD
Malicious:	false
Preview:	o....................................@....&...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.d.k.Z.d.d...Z e..!d.d.d...Z"e..!d.d.d...Z#e..!d.d.d...Z$e..!d.d.d...Z%e..!d.d.d...Z&e..!d.d.d...Z'e..!d.d.d...Z(e..!d.d.d...Z)e..!d.d.d...Ze..!d.d.d...Z+e..!d.d.d...Z,e..!d.d.d...Z-e..!d.d.d...Z.e../d.e e$....Z0e../d.e'..Z1e../d.e%..Z2e../d.e..Z3e.j4d e.e.j5..d...g.g.e.e.j5..d...d!..Z6e../d"d...Z7e../d#d...Z8e.j4d$e.e.j9..d...g.g.e.e.j9..d...d!..Z:d%d&..Z;e+Z<e.Z=i.e.j>e%..e.j?e'..e.j@e-..e.jAe...e.jBe<..e.jCe=..e.jDe0..e.jEe e7....e.jFe1..e.jGe2..e.jHe6..e.jIe e8....e.jJe:..e.jKe"..e.jLe#..e.jMe&..e.jNe..e.jOe+e.jPe,e.jQe'e.jRe(e.jSe..!d'd.d...e.jTe3e.jUe e"..e.jVe e$..i...ZWG.d(d)..d)eX..ZYG.dd+..d+eY..ZZG.d,d-..d-eY..Z[d.d/..Z\d0d1..Z]d.S.)2.........print_functionN....Any..Callable..Dict..List..Optional..Type..TypeVar..Tuple..Union....alignment..c_void_p.._Pointer..sizeof..windll....a

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\tools\typeannotator.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11191
Entropy (8bit):	5.162950204659468
Encrypted:	false
SSDEEP:	192:6ammNbVmbuk/sosHWsRuZjWqf1iP00WI7IUciQU3efODwipFmOB3fitJTDrFvWyb:6AbVmbuk/sRWMuZRiP00WI85ivefODwZ
MD5:	75D14359A1B12B7D1B12F129EEDB5D7F
SHA1:	9A8BEDEFC00C15C8198A6B79A1EC1FFC58620429
SHA-256:	6B5F1C90DD270763111922852D15BA7B11A40855B181BD37D938D90C74F741C1
SHA-512:	5CC0F13840CD7F04632F31F9E67880CA9142A8772FB7E5969EB474990D9E5908ADEFD69131C259D2B76A9948564A019918F64AFF5A5C06F22774697E84FA2416
Malicious:	false
Preview:	o....................................@....R...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.r4d.d.l.m.Z...e.r>e.d.e.j.d...Z.n.e.d...Z.G.d.d...d.e.j.e.e.....Z.e.e.e.e...e.e...e.e...e.e...f...Z.G.d.d...d.e.j.e.e.....Z.G.d.d...d.e.e.j.....Z.G.d.d...d.e.e.j.....Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.....Z G.d.d...d.e.e.j.....Z!G.d.d...d.e...Z"d.S.)......N....Any..Dict..Generic..Iterable..Iterator..List..Optional..Sequence..Tuple..TYPE_CHECKING..TypeVar....typedesc....hints.._T_MTD....boundc....................@....Z...e.Z.d.Z.d.e.d.d.f.d.d...Z.e.d.e.e.e.e.e.e...f.....f.d.d.....Z.e.j.d.e.d.e.f.d.d.....Z.d.S.)..._MethodAnnotator..method..returnNc....................C........\|.\|._.d.S.).N..r........selfr......r......comtypes\tools\typeannotator.py..__init__............._MethodAnnotator.__init__c....................C....d...d.}.g.}.\|.j.j.D.]'\.}.}.}.}.d.\|.v.r.d.\|.v.s.\|.s/\|.d.7.}.d.\|.v.r"d.}.\|...\|.\|.p+d.\|.....\|.f.....q.\|.S.).Nr......in..lcid.......optional

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\tools\typedesc.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7088
Entropy (8bit):	4.531887407114192
Encrypted:	false
SSDEEP:	192:hUwwf4y/2JlwwfmWfZDfw+Eigo5IfM4gMzjs:hUwwwA2rheWxDfw+Eigo5IfM4Lzjs
MD5:	563F4CFD19B027A375F50611D918F82D
SHA1:	ABCB6CE6C914113753BF151BAAC312787184375E
SHA-256:	67669F21996A766EC8D3990CC9249CDF2305B748ABE3394030243CF5A230C526
SHA-512:	6FF5AEA95F880B6DD519368F2D238204B4D96DB1C693C9F537B593D38E380999E493B1D1502135946B8C36EA574CE51F0A78F585D0EB7C4A8CD124239C8A905D
Malicious:	false
Preview:	o....................................@.... ...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.T.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.d.S.)!.....N....Any..List..Optional..Tuple..Union....ITypeLib..TLIBATTR....*c....................@....>...e.Z.d.Z...d.d.e.d.e.d.e.d.e.d.e.e...d.d.f.d.d...Z.d.d...Z.d.S.)...TypeLibN..name..guid..major..minor..doc..returnc....................C...."...\|.\|._.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N..r....r....r....r....r........selfr....r....r....r....r......r......comtypes\tools\typedesc.py..__init__.....................TypeLib.__init__c....................C........d.\|.j.\|.j.\|.j.\|.j.f...S.).N..<TypeLib(%s: %s, %s, %s)>..r....r....r....r......r....r....r....r......__repr__.......................TypeLib.__repr__..N....__name__..__module__..__qualname__..str..intr....r....r#..

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\tools\typedesc_base.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8895
Entropy (8bit):	4.403681693384337
Encrypted:	false
SSDEEP:	96:1gLUxxnze4CO02ok0qiUWbkfjLHp9R9HMsu3aH/XAT1JC+UAfd488qrJ1/P33mFD:1gLU/nzerOOsmbqL3w3aYLdzr/P33mt
MD5:	3DE118FEF6061BBEEF8B341EC500CAE2
SHA1:	045C0264251A29CD9C930E71381FB4CEFD4D2B50
SHA-256:	7AB569999E7105E7A5493C6AAA6E0E036BFB2E75311024892F9E766D63122A04
SHA-512:	7434989D8C9ACF568FDB2ED4F071A3112D06425DCA7AB87B2BC74C496A87D973E6E2344F7821AB77C67747DA235A4E44D216389566D7F8D5D06E3CA1FA4CD52E
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z d.S.)3.........Any..List..Optional..Tuple..Union..SupportsIntNc....................@........e.Z.d.Z.d.Z.d.d...Z.d.S.)...Argument.Fa Parameter in the argument list of a callable (Function, Method, ...)c....................C........\|.\|._.\|.\|._.d.S.).N....atype..name....selfr....r......r......comtypes\tools\typedesc_base.py..__init__...............Argument.__init__N....__name__..__module__..__qualname__..__doc__r....r....r....r....r....r...................r....c....................@....4...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...

C:\Users\user\AppData\Local\Temp\_MEI69562\comtypes\typeinfo.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	29544
Entropy (8bit):	5.729658092723496
Encrypted:	false
SSDEEP:	768:uFJMp9YNDo9BDHCB9nJypYlJdjgxLzDQ2qjX7iaSwOte1:uFSGAb2nJqY3mdQBj2m
MD5:	1B066129E001539F2D762138DBF9BFA3
SHA1:	8B723600593E352B846178C43C38F1599084EDEE
SHA-256:	94753CDF26F501ADB13416102DD8232AC55C6B4F51BED2A97E690311F582F061
SHA-512:	831C28966742E46EFD85D29B4764D3CDE9851A660420725AEF743F35161B5DA56C898F16634D8BCFFF147186BF9FA59598FEF6B28150BADC2314A86D4C0C9FA4
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'..d.d.l(m)Z)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..e.d.e d...Z2e.d.e%d...Z3e.j4d.k.Z5e.Z6e.Z7e.Z8e)Z9e.Z:e.Z;e.j<Z=e5r.e.j>n.e.j?Z@e.jAZBe.e:..ZCe.ZDd.ZEd.ZFd.ZGd.ZHeDZIe.ZJd.ZKd.ZLd.ZMeJZNe.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXeOZYe.ZZd.Z[d.Z\d.Z]d.Z^eZZ_e.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfe`Zge.Zhd.Zid.Zjd.Zkd.ZlehZme.Znd.Zod.Zpd.Zqd.Zrd.ZsenZte.Zud.Zvd.Zwd.Zxd.Zyd.Zzd.Z{d.Z\|d.Z}d.Z~d.Z.d.Z.euZ.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d d!e.d"e.f...d#e2f.d$d%..Z.G.d&d'..d'e%..Z.e...d&d)d....Z.e.d(e.d#e.f.d+d....Z.d,d*..Z.G.d-d...d.e%..Z.G.d/d0..d0e%..Z.G.d1d2..d2e%..Z.

C:\Users\user\AppData\Local\Temp\_MEI69562\concurrent\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	3.5316274446607214
Encrypted:	false
SSDEEP:	3:ztWlulehlra4lPlPlpLXuIikcTg/lz:gqeho4oMh
MD5:	77A9F333710F1A845D8E371D64CDB340
SHA1:	B598D6156855B19F95F344DDF279140439FE4FA2
SHA-256:	7B06E6A0C395D1E4AD1BE311CB9BBCC6470425CC49FB306674AB091AC41F2141
SHA-512:	C9BF5E0D1B39601BF263E0AE8E9DB5482390DCD13EE03A60D1085658B42DEBD632808C88E1C00296C7C78A4E750BB1300022718AE63A248F1D96ACEEAFDDC5A4
Malicious:	false
Preview:	o....................................@........d.S.).N..r....r....r....z.concurrent\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\concurrent\futures\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	5.14840426336966
Encrypted:	false
SSDEEP:	24:gWmV0rmMMcN/bM1aKsa7/dRjsNbAyF89Bd:gL4bMnsa7/vsmz9Bd
MD5:	0550FFE1392038C8B561E372EE2E25FD
SHA1:	D36459F8D02BDF569CE768198439EAED41794855
SHA-256:	9BA3356C7A1DC284409F53C47E6153E34B87D5417F2E9E68998C8E28A1E6A1D9
SHA-512:	DAF2CEEA28A0C643F145E42C9D9F3817839A8F67F1B577EDCAE50D2C456EFD96780071F53D5F2FA1B0CFBE59DBC9F3574DBCD7FAD3A9693949B039940F169809
Malicious:	false
Preview:	o....................................@....T...d.Z.d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.Z.d.d...Z.d.d...Z.d.S.)..?Execute computations asynchronously using threads or processes.."Brian Quinlan (brian@sweetapp.com).........FIRST_COMPLETED..FIRST_EXCEPTION..ALL_COMPLETED..CancelledError..TimeoutError..InvalidStateError..BrokenExecutor..Future..Executor..wait..as_completed..r....r....r....r....r....r....r....r....r....r......ProcessPoolExecutor..ThreadPoolExecutorc....................C........t.d...S.).N....__author__..__doc__....__all__..r....r......concurrent\futures\__init__.py..__dir__$..........r....c....................C....L...\|.d.k.r.d.d.l.m.}...\|.a.\|.S.\|.d.k.r.d.d.l.m.}...\|.a.\|.S.t.d.t...d.\|.........).Nr...........r....r......r......module .. has no attribute ....processr......threadr......AttributeError..__name__....name..pe..ter....r....r......__getattr__(..........................r-...N..r....r....Z.concurrent.futures._baser....r....r....r....r....r....r...

C:\Users\user\AppData\Local\Temp\_MEI69562\concurrent\futures\_base.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	22159
Entropy (8bit):	5.220431730959426
Encrypted:	false
SSDEEP:	384:M6L+z1xw//sMc8z1KBz2YBXRxOHApwpeKzfVMer2p/crelPUoxisFINc7MTA:M6LCxwnZBKBSYBXRwgxsf2p/crelPUo1
MD5:	58FF5FF9144E5174A777F44547637CA0
SHA1:	D2F935320B7AABF73AFF9DF74B4D7DD6F471FB2A
SHA-256:	BBC575A0A7341E70063C19330E385593D8D8069EFA3607FC12C44C49C72F7E50
SHA-512:	4FA1E600A7F2C65D61D0CBF263162B2BD5557A867451610503EFCEDA293F46F80DD4666BBF7C2691D3E186E7332551EEB93B2CB893282BD8477D4B4A55BB40F9
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.e.g.Z.e.d.e.d.e.d.e.d.e.d.i.Z.e...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.d#d$..Z.d%d&..Z.d5d'd(..Z e..!d)d*..Z"d.e.f.d+d,..Z#d5d-d...Z$G.d/d0..d0e...Z%G.d1d2..d2e...Z&G.d3d4..d4e'..Z(d.S.)6."Brian Quinlan (brian@sweetapp.com).....N..FIRST_COMPLETED..FIRST_EXCEPTION..ALL_COMPLETED.._AS_COMPLETED..PENDING..RUNNING..CANCELLED..CANCELLED_AND_NOTIFIED..FINISHED..pending..running..cancelled..finished..concurrent.futuresc....................@........e.Z.d.Z.d.Z.d.S.)...Error.-Base class for all future-related exceptions.N....__name__..__module__..__qualname__..__doc__..r....r......concurrent\futures\_base.pyr....-..............r....c....................@...r....)...CancelledError..The Future was cancelled.Nr....r....r....r....r....r....1...r....r....c.

C:\Users\user\AppData\Local\Temp\_MEI69562\concurrent\futures\process.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	21703
Entropy (8bit):	5.3613162631647855
Encrypted:	false
SSDEEP:	384:78ImR19AAsr+jWpVrPUlXaS38t9u5RAeI0y38D1HkQrm9Wn4Rd8q2K1Av2/FK:dcJsrYW7UFaS3Bm50y38D1HkAm9Wn+yj
MD5:	4376BAAA476A5CA2744F74F4909D4375
SHA1:	D1007CC5336A41E2F7B02D8D2F1AA1A786A097CE
SHA-256:	25195D0C087EED8B3CBBF878A1022033B59E7C434DC5CF847157E9AB3859E2BF
SHA-512:	06FEF9C6A59A48E8D8DA3AC951BCD9391209002C7B2CCDF4A81439D4221637B8FF6E96AFC7B6C0512AFDC98260385A6F1E6E2AA75BB680607248FEA661548F29
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.....Z.d.a.G.d.d...d...Z.d.d...Z.e...e.....d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d.e...Z!G.d.d...d.e...Z"d.d...Z#d.d...Z$d.d d!..Z%d"d#..Z&G.d$d%..d%e.j'..Z(d.a)d.ad&d'..Z+d(d)..Z,G.dd+..d+e.j-..Z.G.d,d-..d-e.j/..Z0d.S.)/.-...Implements ProcessPoolExecutor...The following diagram and text describe the data-flow through the system:..\|======================= In-process =====================\|== Out-of-process ==\|..+----------+ +----------+ +--------+ +-----------+ +---------+.\| \| => \| Work Ids \| \| \| \| Call Q \| \| Process \|.\| \| +----------+ \| \| +-----------+ \| Pool \|.\| \| \| ... \| \| \| \| ... \| +---------+.\| \| \| 6 \| => \| \| => \|

C:\Users\user\AppData\Local\Temp\_MEI69562\concurrent\futures\thread.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5940
Entropy (8bit):	5.364496110838258
Encrypted:	false
SSDEEP:	96:4vS2XV2A3DuLtMxvUL09sJRCozL+gvC9rIBYMmxHNAa0ySAJ7cQeZGUozQy:4vS2XVPDuBMxcL098RVLhvWkSMWWc7cA
MD5:	44FAC23B3B3F06FF3407E56EB9BD5C20
SHA1:	F662C735F8D0612433FE743EF0710B066F894711
SHA-256:	A34EE4ACEA1299A669E16FCE313F87438ED6AB261C148BD740CCEC6195EEFBB3
SHA-512:	86DF1582BBF719C8A86455CA38BA1C38392C791A0375F7331A7D85D3CD806E6260F09C02E210ED5DCC7B3A706B8EE8FDAE78C1D2FF3119027265779060EB86CA
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.....Z.d.a.e.....Z.d.d...Z.e...e.....e.e.d...rEe.j.e.j.e.j.e.j.d.....G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.)...Implements ThreadPoolExecutor.."Brian Quinlan (brian@sweetapp.com)........._baseNFc....................C....f...t.....d.a.W.d.........n.1.s.w.......Y...t.t.......}.\|.D.].\.}.}.\|...d.....q.\|.D.].\.}.}.\|.......q(d.S.).NT...._global_shutdown_lock.._shutdown..list.._threads_queues..items..put..join..r......t..q..r......concurrent\futures\thread.py.._python_exit...........................r......register_at_fork....before..after_in_child..after_in_parentc....................@....&...e.Z.d.Z.d.d...Z.d.d...Z.e.e.j...Z.d.S.)..._WorkItemc....................C........\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N....future..fn..args..kwargs....selfr ...r!...r"...r#...r....r....r......__init__/.................._WorkItem.__init__c....................C....n...\|.j...

C:\Users\user\AppData\Local\Temp\_MEI69562\contextlib.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	20822
Entropy (8bit):	5.108191398869505
Encrypted:	false
SSDEEP:	384:/rdg3xgjpX8UbC62VT92iLqN7VENxUCqgIN8KHaJ:jdg3QX8kcT9Hq8N/RKHQ
MD5:	F10F76E4AA08F7107C353ED5D7256054
SHA1:	569826BDB242287F086A517D645FAA24117D7B9B
SHA-256:	DE98FE3546614B65772548D67038F4F799000CBAD2367672530F3AC165B1AE50
SHA-512:	7CA962BF60AC1B22E2014AE90D17BB3BA921A012372CC89DB5760D13F631BCCB17E4D1BA422F723FE6F4F71A45A26A5B0337D60D8888896B29EC20B33F5EB79C
Malicious:	false
Preview:	o....................................@....~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z d.S.)-.4Utilities for with-statement contexts. See PEP 343......N....deque....wraps....MethodType..GenericAlias....asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r.....,An abstract base class for context managers.c....................C........\|.S.)..0Return `self` upon entering the runtime context.......selfr....r......co

C:\Users\user\AppData\Local\Temp\_MEI69562\contextvars.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.520999270328814
Encrypted:	false
SSDEEP:	6:gexsZv2e2equ9ypTSEATIF/El3ZlqzcIVtZId:geeA2lypvnFsRWjVcd
MD5:	62609BAA0490C03BF48884DACA865090
SHA1:	48A28B6F4643BFDF1323FF397C6E917EDFD8D579
SHA-256:	88DD9F4C211CFC25E964E2A11CD53DAFE4AF0115AD7EFD78E78951CC963BFB0C
SHA-512:	FBF70ED76DA60FB7DA43B17523A89EEECA8655503B98AD0DF685C7EDF65874F400026D565CB3F6383EE1A142A7A33B4EBD98B88DD3E52A9148C9B12EC9F98CD4
Malicious:	false
Preview:	o....................................@.... ...d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.d.S.)..........Context..ContextVar..Token..copy_contextN...._contextvarsr....r....r....r......__all__..r....r....z.contextvars.py..<module>.............

C:\Users\user\AppData\Local\Temp\_MEI69562\copy.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6963
Entropy (8bit):	5.438461030836543
Encrypted:	false
SSDEEP:	192:2xPakDZxS5GiVc3isTm2jbbOUyrmuh7Md+dqMMQkNRDq:Ua0/S5G4cRKQbrh4dkc
MD5:	F1C09EE419D22059F218336B72CFD767
SHA1:	02A143BA5195B10AC28AA47F7018C6684235E07A
SHA-256:	0ED2C70FEA770F0DB3881B34D9AC6E4CCCCBC2D5245D0ECD37329E7477FDEA74
SHA-512:	39DFF4101EFF9255E799C435C5C77C9F65A237AE60D2A5752F40C9A5D011002A830C76939C6B0F3BA93C8E7246DC7CD6D5F8723AB52D43B5479D870EE6509930
Malicious:	false
Preview:	o....................................@....V...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.Z.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.g.d...Z.d.d...Z.i...Z.Z.d.d...Z.e.d...e.e.e.e.e.e.e.e.e.e.e.e.e.j.e.e...e.e...e.j.e.j f.D.].Z!e.e.e!<.q[e"e.d.d...Z!e!d.u.rpe.e.e!<.e#j.e.e#<.e$j.e.e$<.e%j.e.e%<.e&j.e.e&<.e.d.u.r.e.j.e.e.<.[.[!d.g.f.d.d...Z'i...Z(Z.d.d...Z)e)e.e.d...<.e)e.e.e...<.e)e.e.e...<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.j*<.e)e.e.<.e)e.e.<.e)e.e.j.<.e)e.e.j.<.e)e.e.j <.e)e.e.<.e'f.d.d...Z+e+e.e#<.e'f.d.d...Z,e,e.e.<.e'f.d.d...Z-e-e.e$<.e.d.u...r.e-e.e.<.d.d...Z.e.e.e.j/<.[.d.d...Z0..d.e'd...d.d...Z1[.[.[.d.S.)......Generic (shallow and deep) copying operations...Interface summary:.. import copy.. x = copy.copy(y) # make a shallow copy of y. x = copy.deepcopy(y) # make a deep copy of y..For module specific errors, copy.Error is raised...The difference between shallow and deep copying is only relevant for.compound objects (object

C:\Users\user\AppData\Local\Temp\_MEI69562\csv.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11756
Entropy (8bit):	5.473410103904829
Encrypted:	false
SSDEEP:	192:VJq1+BvzXv6AomtdBs4DqwZQyrzKbydGA3LYPqO0GX8GWFoKzckOMsotMdD2C9q:VJqqzXv6AHq4GyWWQA0tghzJfCd9q
MD5:	01EBD51112A10F9399D1F081F9A0852C
SHA1:	3ECF4580C6959EB8BEDC2CF74F744426078F11B4
SHA-256:	7D2102B6268B7A04E8BEFD19351BB7F2BEA97E38918881327AB0B3647826E927
SHA-512:	C8E1C3A402CD3090CD8AFE34D0C2430CD483D997CBFF7712B69174DD1D446D39891C1F56590BFF495D91D20FC1600108EF4B518708ADF46D642F9F3D12392728
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d...Z.G.d.d...d...Z.z.e...W.n...e.y.......e.Z.Y.n.w.G.d.d...d...Z.d.S.)..+.csv.py - read/write/investigate CSV files......N....Error..__version__..writer..reader..register_dialect..unregister_dialect..get_dialect..list_dialects..field_size_limit..QUOTE_MINIMAL..QUOTE_ALL..QUOTE_NONNUMERIC..QUOTE_NONE..__doc__....Dialect....StringIO..r....r....r....r....r....r....r......excel..excel_tabr....r....r....r....r....r......Snifferr....r......DictReader..DictWriter..unix_dialectc....................@....D...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r......Describe a CSV dialect... This must be subclassed (see csv.excel). Valid attributes are:. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	15849
Entropy (8bit):	5.372822069358274
Encrypted:	false
SSDEEP:	384:JMRQLVaCugNEE+XBrhrvkqgiwQeXY5Tc4n:JMoV7YhAlbQQYCS
MD5:	79160E9E75230C9260BD2859A908C939
SHA1:	4DCD421E020960287BF4879CC88672F90D577FC3
SHA-256:	4481B454D0176EB8E05D9A9418E6E35C767FFBA359E68339C08BE490D962BFF6
SHA-512:	B75AB628A69AE5258E0D4F4FFE0803B8C51A6E2365B8FC3072C1A63E8324BD4F2C7C1943E4409BFDD7E80F58E05D57E002AFE5BE0FDAEB83165CEF93D1A48201
Malicious:	false
Preview:	o....................................@....(...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.k.rJe.d.e.e.....e.j.d.k.rUd.d.l.m.Z...e.Z.e.j.d.k.rqe.j.d.k.rqe.e.....j...d...d.....d.k.rqe.Z.d.d.l.m.Z m!Z"m#Z$m%Z&..d}d.d...Z'd}d.d...Z(i.Z)d.d...Ze.j.d.k.r.d.d.l.m+Z,..d.d.l.m-Z...i.Z/d.d...Z0e0j.r.ej..1d.d...e0_.n.e.j.d.k.r.d.d.l.m2Z,..d.d.l.m3Z3m4Z4m5Z5m6Z6m7Z7..d.d.l.m8Z8m9Z9..d.d l.m:Z:..d}d!d"..Z;G.d#d$..d$e:..Z<e;e<d%....G.d&d'..d'e:..Z=e;e=....G.d(d)..d)e:..Z>e;e>....G.d*d+..d+e:..Z?e;e?....G.d,d-..d-e:..Z@e;e@....e.d...e.d/..k...r'e?ZAe@ZBn.G.d0d1..d1e:..ZAe;eA....G.d2d3..d3e:..ZBe;eB....G.d4d5..d5e:..ZCe;eC....G.d6d7..d7e:..ZDe;eD....G.d8d9..d9e:..ZEe3eE..e3eD..k...rjeDZEe.d/..e.d:..k...rxe?ZFe@ZGn.G.d;d<..d<e:..ZFe;eF....G.d=d>..d>e:..ZGe;eG....G.d?d@..d@e:..ZHeH..eH_IeH_Je;eH....G.dAdB..dBe:..ZKeK..eK_IeK_Je;eK....G.dCdD..dDe:..ZLeL..eL_IeL_Je;eL....G.dEdF..dFe:..ZMe;eMd%....G.dGdH..dHe:..ZNeNZO

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\_aix.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9850
Entropy (8bit):	5.487407891962129
Encrypted:	false
SSDEEP:	192:Eu+9IuTRu2bpsEn+bwq6IGYDP/YRp9nlPm1sOWy6QTqcUq:Eu+Kuduef+bLDzQvu16y1dUq
MD5:	7053FFDAC617AD1C38E5E5A52176ED30
SHA1:	7EDAF91680C3BE366A52F9DE0B490EAF03636A51
SHA-256:	D3A17C97C398939E30D90D0BC46035B3BC227517C42175868F1272AED33F8EA7
SHA-512:	7F34F6C54B875AB2D867F99CEF0D642083472B36EFA4D0FA41F53A5FEA045F480E992E9FC1788036E44FB45EA2F54E940F1583E2A881F059F0420B83C649040F
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...e.e...d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d.S.)"......Lib/ctypes.util.find_library() support for AIX.Similar approach as done for Darwin support by using separate files.but unlike Darwin - no extension such as ctypes.macholib.*..dlopen() is an interface to AIX initAndLoad() - primary documentation at:.https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/dlopen.htm.https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/load.htm..AIX supports two styles for dlopen(): svr4 (System V Release 4) which is common on posix.platforms, but also a BSD style - aka SVR3...From AIX 5.3 Difference Addendum (December 2004).2.9 SVR4 linking affinity.Nowadays, there are two major object file formats used by the operating systems:.XCOFF: The COFF enhanced

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\_endian.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	5.176799692166741
Encrypted:	false
SSDEEP:	48:g27p6PBJ0tfP45Lrn4r5M3rurEVBlhA1qq:r6r0WhcE40vK1B
MD5:	3B4E8F2FFA6AE791F695D9BD02476152
SHA1:	E0A21D2DCAF78A5560B8B63AAD4130042022F8D4
SHA-256:	535D04653F9790D374CB69844814B7E57DBEBC562FAE92B6785A1BCD6F45B0AD
SHA-512:	D4BF1FDDB475ACBE660C34FB6C67CEFE24C1830CC99B4F69FD4212719F435827855607A0854904E75479ACB811F1CFBC987989AA7CC1E4603039B6819CC47546
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.T.e.e...Z.d.d...Z.G.d.d...d.e.e.....Z.e.j.d.k.r/d.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.j.d.k.rDd.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.d.....)......N....*c....................C....H...t.\|.t...r.t.\|.t...S.t.\|.t...r.t.\|.j...\|.j...S.t.\|.t...r.\|.S.t.d.\|.......)...Return the type with the 'other' byte order. Simple types like. c_int and so on already have __ctype_be__ and __ctype_le__. attributes which contain the types, for more complicated types. arrays and structures are supported.. .+This type does not support other endian: %s....hasattr.._OTHER_ENDIAN..getattr..isinstance.._array_type.._other_endian.._type_.._length_..issubclass..Structure..TypeError....typ..r......ctypes\_endian.pyr...........................r....c.............................e.Z.d.Z...f.d.d...Z.....Z.S.)..._swapped_metac.........................^...\|.d.k.r&g.}.\|.D.].}.\|.d...}.\|.d...}.\|.d.d.....}.\|...\|.t.\|...f.\|.......q.\|.}.t.....\|.\|.....d.S.).N.._fields_r.

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\macholib\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.014044330816271
Encrypted:	false
SSDEEP:	6:gqepzqswnDJ6V3m5WQbceAJmTKOvouo2ofREBuK:gqeIs4Ak4Q3AJywEo5OuK
MD5:	713785E2A6DEF324F90774A8EBBB4B52
SHA1:	36A383E592F47AA458043C242B6C2035C4250310
SHA-256:	6EFD09F4CFB27998D5BC8E1566A53BE6196FE6460E9FA12714F1C72DAEA0F9FF
SHA-512:	F33CAD0F0EA18D0669037B490082E51258B2134A745123F375E3F569B44F1A14B8CE729814DE47B35853A781272BB8A5603E0679E5472850E70B342CE1D21EAD
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.d.S.)..~.Enough Mach-O to make your head spin...See the relevant header files in /usr/include/mach-o..And also Apple's documentation....1.0N....__doc__..__version__..r....r....z.ctypes\macholib\__init__.py..<module>.............

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\macholib\dyld.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4603
Entropy (8bit):	5.394293815928249
Encrypted:	false
SSDEEP:	96:msP5cPTYsDQr5fnO4DRyWOS1gycUTvBGr6:m6nPyO1guJs6
MD5:	BE13FC67A8941994AC5D8F8FFA283FA0
SHA1:	0B5FDCE0EF701A980B6D0E930E0C279F2A74F7D9
SHA-256:	964FB3EBA22236014116D4495B4540ACBD06AB857221221D9DBAD40B477E9525
SHA-512:	A46C5E3A21BB307FB90C692DF23EBC6A2940FE58856DC7486E49F80AC4E149F967E62D262BD64C34A84DAA1876D6A91E916A538EF0FDDB303A1C7031B3489354
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.T.z.d.d.l.m.Z...W.n...e.y+......d.d...Z.Y.n.w.g.d...Z.e.j...d...d.d.d.g.Z.e.j...d...d.d.d.g.Z.d.d...Z.d-d.d...Z.d-d.d...Z.d-d.d...Z.d-d.d...Z.d-d.d...Z.d-d.d...Z.d-d d!..Z.d-d"d#..Z.d-d$d%..Z.d.d&d'..Z.d.d(d)..Z.dd+..Z.e.d,k.r.e.....d.S.d.S.)/...dyld emulation......N....framework_info....dylib_info....... _dyld_shared_cache_contains_pathc....................G........t...).N....NotImplementedError....args..r......ctypes\macholib\dyld.pyr...............r........dyld_find..framework_findr....r......~/Library/Frameworks../Library/Frameworks../Network/Library/Frameworks../System/Library/Frameworks..~/lib../usr/local/lib../lib../usr/libc....................C........\|.d.u.r.t.j.}.\|...\|...}.\|.d.u.r.g.S.\|...d...S.).N..:....os..environ..get..split....env..var..rvalr....r....r......dyld_env$....................r*...c....................C........\|.d.u.r.t.j.}.\|...d...S.).N..DYLD_IMAGE_SUFFIX..r"...r#...r$....

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\macholib\dylib.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1889
Entropy (8bit):	5.528760006316827
Encrypted:	false
SSDEEP:	48:gyQNMwbF4Y3BsP/bjBpqke0Xt0YFXZlsitgi:Hm+AsP5pqWd06ZGi5
MD5:	8965EB5896BFBD08A08D7D0B566C2C96
SHA1:	0F6C533B04FF09FC1276772CDD3DE06EE40A4FB7
SHA-256:	9CBCA84CA437E79B7F185761C428681EAB0BA20A8E177D280E6C103FD2BCD5B6
SHA-512:	52F6FFD6EC8081C0858A42684E4BB7E06301119FFC61FB15E575DAE86993E2D1081DE823BB79B6832908C33891DE01EFB4C938D6505100C9621A8B0D36A5BDDF
Malicious:	false
Preview:	o....................................@....B...d.Z.d.d.l.Z.d.g.Z.e...d...Z.d.d...Z.d.d...Z.e.d.k.r.e.....d.S.d.S.)..!.Generic dylib path manipulation......N..dylib_info..(?x).(?P<location>^.*)(?:^\|/).(?P<name>. (?P<shortname>\w+?). (?:\.(?P<version>[^._]+))?. (?:_(?P<suffix>[^._]+))?. \.dylib$.).c....................C........t...\|...}.\|.s.d.S.\|.....S.)..1.... A dylib name can take one of the following four forms:. Location/Name.SomeVersion_Suffix.dylib. Location/Name.SomeVersion.dylib. Location/Name_Suffix.dylib. Location/Name.dylib.. returns None if not found or a mapping equivalent to:. dict(. location='Location',. name='Name.SomeVersion_Suffix.dylib',. shortname='Name',. version='SomeVersion',. suffix='Suffix',. ).. Note that SomeVersion and Suffix are optional and may be None. if not present.. N....DYLIB_RE..match..groupdict....filenameZ.is_dylib..r......ctypes

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\macholib\framework.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	5.5516478733304515
Encrypted:	false
SSDEEP:	48:gysQAoMBTpj5noS3hP/boXPe0PaYFXvn/QIwit1HM:IBBT1ZoeP8X1y6dwiPM
MD5:	61DF94459BB9915E47746E8971489C1A
SHA1:	1FD8DC73882D4CC6B0067EAB747A581CCAFC6036
SHA-256:	B8A23F89EAAB7FCB39F18186BB1CB90201709E7200D0EE1515BCF76E17B14930
SHA-512:	AD2269113B0C135ECADFC1B86596C9A0243BB783DB8A73D90872AD04F31AFCBB1BDFF7CB20480C589197B82A0A63C48B78F5D70D6FA2AD2936FB1EEDA05DE18A
Malicious:	false
Preview:	o....................................@....B...d.Z.d.d.l.Z.d.g.Z.e...d...Z.d.d...Z.d.d...Z.e.d.k.r.e.....d.S.d.S.)..%.Generic framework path manipulation......N..framework_info..(?x).(?P<location>^.*)(?:^\|/).(?P<name>. (?P<shortname>\w+).framework/. (?:Versions/(?P<version>[^/]+)/)?. (?P=shortname). (?:_(?P<suffix>[^_]+))?.)$.c....................C........t...\|...}.\|.s.d.S.\|.....S.)..}.... A framework name can take one of the following four forms:. Location/Name.framework/Versions/SomeVersion/Name_Suffix. Location/Name.framework/Versions/SomeVersion/Name. Location/Name.framework/Name_Suffix. Location/Name.framework/Name.. returns None if not found, or a mapping equivalent to:. dict(. location='Location',. name='Name.framework/Versions/SomeVersion/Name_Suffix',. shortname='Name',. version='SomeVersion',. suffix='Suffix',. ).. Note that SomeVersion and Suffix are optional

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\util.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8290
Entropy (8bit):	5.498997821339348
Encrypted:	false
SSDEEP:	192:NAcGd1lEB/Di73PsMqG3om0Ga7Im+R9dODRilzq:NA3d16Di7fB+GEH+R9diizq
MD5:	99B1BDBC6B03F96ECC039C2F9AB860EB
SHA1:	D1A304BC0B73DEF2582FC8D01E0676BE8E872BDD
SHA-256:	67AE9DBB94C70110997D32281C883744A72AA88AF783A34C42353ED55F3A0E53
SHA-512:	35BFE49ACCC2537163060D6950438A8A7B18569B94A700942DB34B1A8136494C1055FBD34740FA825CDE31DD544A9854905E403529506422992B509823387A42
Malicious:	false
Preview:	o....................................@....@...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.r"d.d...Z.d.d...Z.d.d...Z.noe.j.d.k.r7e.j.d.k.r7d.d.l.m.Z...d.d...Z.nZe.j...d...rDd.d.l.m.Z...nMe.j.d.k.r.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.e.j.d.k.rcd.d...Z.n.d.d...Z.e.j...d...rvd.d...Z.d.d...Z.n.e.j.d.k.r.d.d...Z.d'd.d...Z.n.d.d ..Z.d!d"..Z.d#d...Z.d$d%..Z.e.d&k.r.e.....d.S.d.S.)(.....N..ntc....................C.......d.}.t.j...\|...}.\|.d.k.r.d.S.\|.t.\|.....}.t.j.\|.d.......d.d...\.}.}.t.\|.d.d.......d...}.\|.d.k.r3\|.d.7.}.t.\|.d.d.......d...}.\|.d.k.rCd.}.\|.d.k.rK\|.\|...S.d.S.)...Return the version of MSVC that was used to build Python... For Python 2.3 and up, the version number is included in. sys.version. For earlier versions, assume the compiler is MSVC 6.. ..MSC v...........N.. ................................$@r........sys..version..find..len..split..int....prefix..i..s..rest..majorVersion..minorVersion..r......ctypes\util.py.._get_build_version..................................

C:\Users\user\AppData\Local\Temp\_MEI69562\ctypes\wintypes.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4838
Entropy (8bit):	5.540694317523936
Encrypted:	false
SSDEEP:	96:Rn7SgQvVTrUElHTXbVIbRTy3feyGPUPrKrrQgl:Rn6VTAElHz5Idm3feEwQG
MD5:	AFF5E35347A779AA0F6773EF2EBD7EA6
SHA1:	481271606BCD8CB993B61346C3D8F6F59F3C1B49
SHA-256:	73F5028A6F87D883053FFB5F0A76C041432BF1AF343248187A5EEFF8B3EADA5D
SHA-512:	7A25E6809EE2E08425F44C3389B29590B8DEE9ECC3CCEC7DC5FC22ED4CE4D3296DF9DA6B247CA2467E0CDF61A19A050122AC615AB5C0D8C3A62B8682B8B94A8F
Malicious:	false
Preview:	o....................................@........d.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j...Z.Z.e.j ..Z!Z"e.j#..Z$..Z%Z&e.j#..Z'Z(e.j)..Z*Z+e.j,..Z-Z.e../e.j...e../e.j,..k.rle.j.Z0e.j.Z1n.e../e.j...e../e.j,..k.r~e.j Z0e.j.Z1e.Z2e.Z3e.Z4e.Z5e.Z6e.Z7e.j,Z8e8Z9e8Z:e8Z;e8Z<e8Z=e8Z>e8Z?e8Z@e8ZAe8ZBe8ZCe8ZDe8ZEe8ZFe8ZGe8ZHe8ZIe8ZJe8ZKe8ZLe8ZMe8ZNe8ZOe8ZPe8ZQe8ZRe8ZSe8ZTe8ZUe8ZVe8ZWG.d.d...d.e.jX..ZYeY..ZZ..Z[Z\G.d.d...d.e.jX..Z]e]Z^G.d.d...d.e.jX..Z_G.d.d...d.e.jX..Z`e`..Za..ZbZcG.d.d...d.e.jX..Zded..ZeZfd.d...ZgG.d.d...d.e.jX..ZhehZiG.d.d...d.e.jX..ZjejZkd.ZlG.d.d...d.e.jX..ZmG.d.d...d.e.jX..Zne..oe.....ZpZqe..oe...Zre..oe.....ZsZte..oe...Zue..oe4..Zve..oe.....ZwZxe..oeh....ZyZze..oe...Z{e..oe8....Z\|Z}e..oeG..Z~e..oeH..Z.e..oe.....Z.Z.e..oe...Z.e..oe7..Z.e..oe.....Z.Z.e..oej....Z.Z.e..oe`....Z.Z.e..oec..Z.e..oeY....Z.Z.e..oe\....Z.Z.e..oeV..Z.e..oe...Z.e..oed....Z.Z.e..oef....Z.Z.e..oe^..Z.e..oe.....Z.Z.e..oe"..Z.e..o

C:\Users\user\AppData\Local\Temp\_MEI69562\dataclasses.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	26480
Entropy (8bit):	5.409121759857592
Encrypted:	false
SSDEEP:	768:PmB3+fSRd6t4QqKFS9jsZTHzSyw5RDHh0unW3kff5g:PmB3+SRd3QqKUVsZ/Syw5RDHh2kff5g
MD5:	9E1FD5EFA92A1639341BA5D928E54408
SHA1:	3E22917854B49BD1EA3D5EC8D44B03FA783660C0
SHA-256:	5354E09FE3C8377D118D83065E81C1EE8A5BB1D02BA0EFD5A2E17EF01B28C691
SHA-512:	BB13E51F9BA2BF2C460B6E22BC8A7ED2AE8EB41F4ED27631094307444254F70FDEE25CD199C32296CDC2C329EEFAD76CEFFD33FBED6329B6211C43218929525B
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d...Z.e...Z.G.d.d...d...Z.e...Z.G.d.d...d...Z.e...Z.e...i...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.d.Z.d.Z.d.Z.e...d...Z.d.d...Z G.d.d...d...Z!G.d.d...d...Z"G.d.d...d...Z#e.e.d.d.d.d.d.e.d...d.d ..Z$d!d"..Z%d#d$..Z&d.d.e.d%..d&d'..Z'd(d)..Z(dd+..Z)d,d-..Zd.d/..Z+d0d1..Z,d2d3..Z-d4d5..Z.d6d7..Z/d8d9..Z0d:d;..Z1d<d=..Z2d>d?..Z3d@dA..Z4dBdC..Z5dDdE..Z6dFdG..Z7dHdI..Z8dJdK..Z9i.dLd...dMd...dNd...dOd...dPe7..dQd...dRe8..dSd...dTe8..dUe9..dVe8..dWe9..dXe8..dYe9..dZe8..d[e9..Z:d\d]..Z;d^d_..Z<d`da..Z=dbdc..Z>d~d.d.d.ddddddd.ddddde..dfdg..Z?dhdi..Z@djdk..ZAdldm..ZBeCdn..dodp..ZDdqdr..ZEeFds..dtdu..ZGdvdw..ZHdxd.d.d.d.ddddddd.dddddy..dzd{..ZId\|d}..ZJd.S.)......N....FunctionType..GenericAlias....dataclass..field..Field..FrozenInstanceError..InitVar..KW_ONLY..MISSING..fields..asdict..astuple..make_dataclass..replace..is_da

C:\Users\user\AppData\Local\Temp\_MEI69562\datetime.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	56605
Entropy (8bit):	5.305031144785569
Encrypted:	false
SSDEEP:	1536:0oPVWeEp4kIe83VF3GLq8L1fhDhnR7stF:0WsHoNCq8ZN7sH
MD5:	85EDB9E15DE2E1CC72E91BB340763078
SHA1:	371BAA6199D5EF80D7580164259AD5925CC52A18
SHA-256:	2B395208738C74CB0CF4D4E8EB46C2CAC115BF28F1528466120C6E9763861B30
SHA-512:	6FCE0984D907465BD35A5597A7CEF0F50D135F1ADCFA258D443AE0B12E093B1C45CD0B3C326E072C0CB110C3B4AD9914EF0E3E2F047E45C175F2A6316845FC4F
Malicious:	false
Preview:	o....................................@....r...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Zd;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]..Concrete date/time and related types...See http://www.iana.org/time-

C:\Users\user\AppData\Local\Temp\_MEI69562\decimal.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	4.557545897065008
Encrypted:	false
SSDEEP:	6:gUR/WbkbVvkqXEG1OghzwNkHE9VlJrEXNJMoC2sgQIPIb:gU5WAZJJhhz8kk9Vll+NCoDcIPk
MD5:	AEB78EDB5C7DA307531BCF8C3736CE16
SHA1:	4D43A839CA5633ED18F8C20C05588D6F4B5B640E
SHA-256:	06C0506327ABFCBF2821FD5C6447DE84D0BC84D483CAF4A423C69F38BA27791C
SHA-512:	03CB9501DE17A8BA5F3F7C4EDB2431DD8489949F8C04AF66F14515BEBC985507058957AB655A04B47915A3F18ACBC3B6721E463BD841F00B983631CEF80698D3
Malicious:	false
Preview:	o....................................@....t...z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.y9......d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...Y.d.S.w.)..........*....__doc__....__version__....__libmpdec_version__N...._decimalr....r....r......ImportError.._pydecimal..r....r....z.decimal.py..<module>...............................

C:\Users\user\AppData\Local\Temp\_MEI69562\difflib.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	58893
Entropy (8bit):	5.464340771903818
Encrypted:	false
SSDEEP:	1536:aGTDfHzzoN8Quy2eF6ISx2jJIlHHmPCPswzklwlonO6:Nf3a91JIlHHmPCPuoop
MD5:	02344979684410D5D0EFB1F360A3A259
SHA1:	9F0D7A2077278ACA87C6F2301B13C611198758EA
SHA-256:	9A6E0225F3236305D5ECBBD8D652C6DC2B19FEAD6A4E7C3142B996A6D9F495FA
SHA-512:	0DD8723B6FD3FDE0DE6522C52810B9A586D9B0B5E8EA32F2EF8C9E468E6A73043D29FC0B79C76CEE545DEC64942E915191BB2D40B8EFB148A1B1FCA99CA2DDA3
Malicious:	false
Preview:	o....................................@....>...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.d.d...Z.d.d...Z.G.d.d...d...Z.d:d.d...Z.d.d...Z.G.d.d...d...Z.d.d.l.Z.e...d...j.f.d.d...Z.d;d.d...Z.d.d...Z.....d<d.d ..Z.d!d"..Z.....d<d#d$..Z.d%d&..Z..'.(d=d)d*..Z.d.e.f.d+d,..Z.d.d.e.f.d-d...Z.d/Z.d0Z.d1Z.d2Z G.d3d4..d4e!..Z"[.d5d6..Z#d7d8..Z$e%d9k.r.e$....d.S.d.S.)>.e....Module difflib -- helpers for computing deltas between objects...Function get_close_matches(word, possibilities, n=3, cutoff=0.6):. Use SequenceMatcher to return list of the best "good enough" matches...Function context_diff(a, b):. For two lists of strings, return a delta in context diff format...Function ndiff(a, b):. Return a delta: the difference between `a` and `b` (lists of strings)...Function restore(delta, which):. Return one of the two sequences that generated an ndiff delta...Function unified_diff(a, b):. For two lists of strings, return a delta in unified diff format...Class SequenceMatcher:.

C:\Users\user\AppData\Local\Temp\_MEI69562\dis.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	15636
Entropy (8bit):	5.496861983103317
Encrypted:	false
SSDEEP:	384:xDdPwGD0g888L7sDBPhMoIDfl2mTq6SxtsTdFdx2tv:xDdR4iuplInxKTdFatv
MD5:	6B466EA646ACB5C8CE5D3DA303C481BC
SHA1:	9C102B1182AC62E2B6B30D9093B019C610BCE016
SHA-256:	632246E845E8741C16A6333F19096086619B5CB4BEF417BC7192AD626AF56208
SHA-512:	E897B8279093FA00B57EEF8A422097F3717BCB04BE24D8FC55626EC9B7D62FC1C6795BA4161B0A24ED7F60E71B63DA6776EEDFE1C624154394AC0427C2580B66
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...g.d...e...Z.[.e.j.e.j.e.j.e.e.e.f.Z.e.d...Z.d.e.d.f.e.d.f.e.d.f.f.Z.e.d...Z.d.Z.d.d...Z.dVd.d.d...d.d...Z.dVd.d...d.d...Z.d.d.d.d.d.d.d.d.d.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d.d...d(d)..Z.e.. dd+..Z!d,e!j"_.d-e!j._.d.e!j#_.d/e!j$_.d0e!j%_.d1e!j&_.d2e!j'_.d3e!j(_.d4Z)d5ZG.d6d7..d7e!..Z+d.d8..d9d:..Z,d;d<..Z-d=d>..Z.....dWd?d@..Z/dXd.d...dBdC..Z0d.d.d...dDdE..Z1....dYd.d.dF..dGdH..Z2dIdJ..Z3e0Z4dKdL..Z5dMdN..Z6dOdP..Z7G.dQdR..dR..Z8dSdT..Z9e:dUk...r.e9....d.S.d.S.)Z.0Disassembler of Python byte code into mnemonics......N....*....__all__....code_info..dis..disassemble..distb..disco..findlinestarts..findlabels..show_code..get_instructions..Instruction..Bytecode..FORMAT_VALUE..N....str..repr..ascii..MAKE_FUNCTION....defaults..kwdefaults..annotations..closurec....................C....4...z.t.\|.\|.d...}.W.\|.S...t.y.......t.\|.\|.d...}.Y.\|.S.w.)...Attempts to compile the given source, fir

C:\Users\user\AppData\Local\Temp\_MEI69562\doctest.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	76091
Entropy (8bit):	5.394955837795528
Encrypted:	false
SSDEEP:	1536:ZpgMCsFCzmex/YJfE7eVoM+8mvYlCuVpg0ANEe8cppY0u+UPpYVvJurFKqLjtu/F:ZpgbsFCzmeidE7eVoM+8mvYlCuVi05eV
MD5:	F0D5094D88316629E8927AB59D99CB4A
SHA1:	8F609CB772F51A525D033A98930EE67441A2BB36
SHA-256:	856769579E718B73CAC7C83A79626F8A4B2F4482F26C58D413EFF63F20A2477F
SHA-512:	7BD4872BB53D88D5D7B501A9B13879B27E75C02DE0E7F029D16E837A06CD7352A1C4054958C8D50ADE31E7153CDCFED1FACAB2359CB149AFC0DCAFCE53F8BDA4
Malicious:	false
Preview:	o....................................@....H...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.i.Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.B.e.B.e.B.e.B.e.B.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z e.e.B.e.B.e.B.e B.Z!d.Z"d.Z#d.d...Z$drd.d...Z%d.d...Z&d.d ..Z'dsd"d#..Z(d$d%..Z)G.d&d'..d'e...Zd(d)..Z+dd+..Z,d,d-..Z-G.d.d/..d/e.j...Z/d0d1..Z0G.d2d3..d3..Z1G.d4d5..d5..Z2G.d6d7..d7..Z3G.d8d9..d9..Z4G.d:d;..d;..Z5G.d<d=..d=..Z6G.d>d?..d?e7..Z8G.d@dA..dAe7..Z9G.dBdC..dCe5..Z:d.a;.....EdtdFdG..Z<dDd.d.d.d.dDd.d.dEe3..d.f.dHdI..Z=.J..dudKdL..Z>d.a?dMdN..Z@G.dOdP..dPe.jA..ZBG.dQdR..dReB..ZCG.dSdT..dTe.jD..ZEdvdUdV..ZFG.dWdX..dXeB..ZGdDd.d.e3..d.f.dYdZ..ZHd[d\..ZId]d^..ZJd_d`..ZKdwdadb..ZLdwdcdd..ZMdxdedf..ZNG.dgdh..dh..ZOeOdidjdkdldmdn..ZPdodp..ZQeRdqk...r.e..SeQ......d.S.d.S.)y.....Module doctest -- a framework for running examples in docstrings...In simplest use, end each module M to be

C:\Users\user\AppData\Local\Temp\_MEI69562\email\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1540
Entropy (8bit):	4.829104347753114
Encrypted:	false
SSDEEP:	48:gaiwQTrfch6OD9UULNo7fH6fNB4NgqNQY:riprfch6Olorw+gWQY
MD5:	7F86EA377A15AF20EFF991C4DA31336F
SHA1:	359E4EFE753E8EA8221B65A2F8622F132A334193
SHA-256:	7E81800D915AC24E331F4B5DE01D508E68F2FA4E235EFBB5A98B1410338C5F9B
SHA-512:	8BD58379E21769D8ADA4201543A4B083EB55E876BBE38BAF22CFE6D0B0B0D38C30F28E5FC167A7CA6D66B0B517CAEEBFDBC82FF1A3267F98AAD591DA9E0919CD
Malicious:	false
Preview:	o....................................@....0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..?A package for parsing, handling, and generating email messages.....base64mime..charset..encoders..errors..feedparser..generator..header..iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytes..mime..parser..quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.)..vParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser....email.parserr......parsestr....s..args..kwsr......r!.....email\__init__.pyr.... ............r....c....................O...r....)..\|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser..r....r&.....parsebytes..r....r....r ...r&...r!...r!...r"...r....(...r#...r....c....................O...r....)...Read a file and parse its contents i

C:\Users\user\AppData\Local\Temp\_MEI69562\email\_encoded_words.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5718
Entropy (8bit):	5.438341704589463
Encrypted:	false
SSDEEP:	96:lOU9w0nDwRCpgTTu2Q+cqsqTta3T8qCpjjRtPk6eXLvHLnrg8NNOGbM/Qfe:FDvCuRDYRy8h7PUL/gGN6Yfe
MD5:	F11DB3FCFDFDDC66D5B8876753ABD314
SHA1:	C6920B536CD564215D2826385417ED71C4433E14
SHA-256:	87753655845D8FEE48B62E19B672622319B812CA585C90E14AC31B6FFEA6C60F
SHA-512:	F0E9BCD9C8750A02714F16017BF71C6F6F29684F4713BD52DF5650C3B743A9B3183C62887BD3B6EE43042DED510B2095ADFD973204563524943642B227044AC8
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!.. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N....ascii_letters..digits....errors....decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encode.....=([a-fA-F0-9]{2})c....................C........t...\|...d.........S.).N.........bytes..fromhex..groupr........m..r......email\_encoded_words.py..<lambda>A..........r....c....................C........\|...d.d...}.t.\|...g.f.S.).N....._..... ....replace.._q_byte_subber....encodedr....r....r....r....C............r....c....................@....,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._QByteMap.....-!*+/..asciic..................

C:\Users\user\AppData\Local\Temp\_MEI69562\email\_header_value_parser.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	77829
Entropy (8bit):	5.4136595276810064
Encrypted:	false
SSDEEP:	1536:SBIcwfUUSzOscCvpOy6SS4N02IXMxBiw09+Q5O5YmTBPRwQYyEHMrc3ukJVvymIK:eFwq9N3XfY1aC
MD5:	C825100DA7F885022B1F0A08C5DB6AE3
SHA1:	62FB9018E1AADF69F3826CDD0A90C2FF7AB0005E
SHA-256:	56D95DD6A73F660929FC7B9FBB43508198AA8C943DF7DBCDAD527F550FDF3DFC
SHA-512:	0A5179827543350B96729A46210FC5FFBDCA958F6F3A4824AD5EE9A3733EAD030D4626DF55006E2DFB9F500D7B845AEE819E4E58C114E063643D53E8E2413185
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.d...Z.e.e.d...B.Z.e.d...Z.e.e.B.Z.e.e.d.....Z.e.e.d.....Z.e.e.d...B.e.d.....Z.e.e.B.Z.e.e.d...B.Z.e.e.B.Z.e.e.d.....Z.d.d...Z.e...d.e.j.e.j.B...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d.e...Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d...d.e ..Z$G.d.d ..d e...Z%G.d!d"..d"e...Z&G.d#d$..d$e...Z'G.d%d&..d&e...Z(G.d'd(..d(e(..Z)G.d)d..de ..Z*G.d+d,..d,e...Z+G.d-d...d.e...Z,G.d/d0..d0e...Z-G.d1d2..d2e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e...Z3G.d=d>..d>e...Z4G.d?d@..d@e...Z5G.dAdB..dBe...Z6G.dCdD..dDe...Z7G.dEdF..dFe...Z8G.dGdH..dHe...Z9G.dIdJ..dJe...Z:G.dKdL..dLe"..Z;G.dMdN..dNe...Z<G.dOdP..dPe...Z=G.dQdR..dRe...Z>G.dSdT..dTe...Z?G.dUdV..dVe?..Z@G.dWdX..dXe...ZAG.dYdZ..dZe...ZBG.d[d\..d\e...ZCG.d]d^..d^e...ZDG.d_d`..d`e...ZEG.dadb..dbeE..ZFG.dcdd..ddeE..ZGG.dedf..dfe...ZHG.dgdh..dhe...ZIG.didj..dje...ZJG.dkdl..dleJ..

C:\Users\user\AppData\Local\Temp\_MEI69562\email\_parseaddr.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12478
Entropy (8bit):	5.428357601712171
Encrypted:	false
SSDEEP:	192:k8hkBPanIUuAmAN6gBaPiqv44Vununaar5mwj7mF47PitYCqgHtgZSHwcaZFube:jKMuBXPuutKK3EwL
MD5:	0D8BC598EE399F6E73AE8988DF2B29D9
SHA1:	5B999978E5562775200A64EB124A0AC15038B044
SHA-256:	A9BAA9B18D250AB8759655B29FBE98B3C95628A72815BD31BB41B3BF7233914A
SHA-512:	2535AF6DEAF18BB5FFA6BDDDBC309843617E06648B50CBB70E6AA14A005501BF826B7FC189F6E2733E46B655A9A4CE1B56B48A3CC71CC51F35482A438E9B2A9C
Malicious:	false
Preview:	o....................................@.......d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.)..cEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten......mktime_tz..parsedate..parsedate_tz..quote.....N.. ...., ....jan..feb..mar..apr..may..jun..jul..aug..sep..oct..nov..dec..january..february..march..aprilr......june..july..august..september..october..november..december....mon..tue..wed..thu..fri..sat..sun.p..................D............UT..UTC..GMT..Z..AST..ADT..EST..EDT..CST..CDT..MST..MDT..PST..PDTc....................C....,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.)..QConvert a date string to a time tuple... Accounts for military timezones.. N.....r........_parsedate_tz..tuple....data..res..rJ.....email\_parseaddr.pyr....-....................r....c....................C........\|.s.d.S.\|.....}.\|.s.d.S.\|.d.....d..

C:\Users\user\AppData\Local\Temp\_MEI69562\email\_policybase.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	14762
Entropy (8bit):	5.0843223593228055
Encrypted:	false
SSDEEP:	192:/b3dx+wPI6I2CaFNAyJAebMqnZbFkIJWAysMNmJd/GazkdZOIv+d/zfz90ArK5L6:/bt1g6IBiTAiZPWApMUjeazMZOsu1ra6
MD5:	315D6914F0509D4FABC2DB5BE7D579FC
SHA1:	F5398AA9AD1BE4782F8B6609AE2AF4621357396A
SHA-256:	3AF1E55ACD0EC5E8862EB59FF8DB9CD53A78E109802C6AB7CA5AD867E9B8111C
SHA-512:	78A5A240916ACD4CD0038A9AAAE9EC30B91918D461642F14D50617517DAB4A0DBB1768159F82CE56610AA16585883715B237DBF72291AC0F4B023707ECB57C7A
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.)..wPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N....header....charset...._has_surrogates....Policy..Compat32..compat32c.........................@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBase....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

C:\Users\user\AppData\Local\Temp\_MEI69562\email\base64mime.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	5.3601785846025125
Encrypted:	false
SSDEEP:	48:gInFLYxoMN59tl3kWReNFOsrQC/sMGQHb9uxJZtEtINnig2b41+M78ozxtEho:vFLsbReNFxrn2QcxftEiig2mV78oFtEu
MD5:	5B6C91BEEBCC1CCB65BD99FD0B1FFD57
SHA1:	993D363AC05E98ECD4E8E54C7F5548D0406535C0
SHA-256:	5E34BB28F4481406DD4F587B7D7034F1F2F7F96B10793A71C1801025D3D507EE
SHA-512:	7463DD1D587B2E02E9D6BE0DC2016AC0365646C967D4ECD1A9EE7DAA590A188C0BDC06A6F0D24FDDF265A80615A2BF5497B39439822BA6961776F211172ADA6E
Malicious:	false
Preview:	o....................................@....l...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

C:\Users\user\AppData\Local\Temp\_MEI69562\email\charset.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11551
Entropy (8bit):	5.35249710360486
Encrypted:	false
SSDEEP:	192:jZq2eQFtz+wYzF8cGmchcQx6Pk/pOHoU7uOb9XJ//abe8+opjno54Cw:dZeQFh+ZRVGfz/pA7uOb6by5Rw
MD5:	3CCF8AC0D7014D6973CE7A0D8E77AB77
SHA1:	54F50EE0A942DD61C569D39348B497BD4036BB43
SHA-256:	7013B04455A43698152BE12CBA476AA36CD61CAB038AAC853D12F18C687D20AD
SHA-512:	0543F3F9B57D1676882ECA96052D5D649246EE30123DA9C21B6DCCC76C6B4C3BBE9B1ED67E2D0859FB903DA211D01EA26CEADFD066CEEA7E8FAE42493C53521E
Malicious:	false
Preview:	o....................................@........g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B....Charset..add_alias..add_charset..add_codec.........partialN....errors....encode_7or8bit......................us-ascii..unknown-8bit....iso-8859-1..iso-8859-2..iso-8859-3..iso-8859-4..iso-8859-9..iso-8859-10..iso-8859-13..iso-8859-14..iso-8859-15..iso-8859-16..windows-1252..viscii..NNN..big5..gb2312..euc-jp..iso-2022-jp..shift_jis..utf-8..r%...z.koi8-rr'.....latin_1..latin-1..latin_2..latin-2..latin_3..latin-3..latin_4..latin-4..latin_

C:\Users\user\AppData\Local\Temp\_MEI69562\email\contentmanager.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7361
Entropy (8bit):	5.299982717427386
Encrypted:	false
SSDEEP:	192:FFuZuYEHBgeIRrFuxQPerERXQc8P5O+21:TmuY6INFuxQPBXZ8P5q1
MD5:	831DCB4CCE9B72865EDAD3473E6F0178
SHA1:	4A5032D0F8D41CEE394C7FD4084DCC4681429830
SHA-256:	9E9D2D2179B5ABBD277FBA74F4A77823365B6D11BD433FA11C47B5A89996885F
SHA-512:	3E686940A20B01D37E80577B4AEB5FAB69BEBC6C1C3100567463CC49AB9A4E13D77A9F0F4E55A8BD43D8E3B7F5E71E930123FE98F41A2A66676FD5B7CBC073F8
Malicious:	false
Preview:	o....................................@....>...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.e...Z.d%d.d...Z.e...d.e.....d.d...Z.d.....D.].Z.e...e.e.....q3d.d...Z.d.....D.].Z.e...d.e...e.....qDd.d...Z.e...d.e.....d.d...Z.d.d...Z.d.d...Z.d.d...Z.......d&d.d...Z.e...e.e...........d'd d!..Z.e...e.j.j.e......"....d(d#d$..Z.e.e.e.f.D.].Z.e...e.e.....q.d.S.)).....N....quoprimimec....................@....<...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...ContentManagerc....................C........i.\|._.i.\|._.d.S.).N....get_handlers..set_handlers....self..r......email\contentmanager.py..__init__...............ContentManager.__init__c....................C........\|.\|.j.\|.<.d.S.).N..r......r......key..handlerr....r....r......add_get_handler.............ContentManager.add_get_handlerc....................O.......\|.....}.\|.\|.j.v.r.\|.j.\|...\|.g.\|...R.i.\|.....S.\|.....}.\|.\|.j.v.r.\|.j.\|...\|.g.\|...R.i.\|.....S.d.\|.j.v.rA\|.j.d...\|.g.\|...R.i.\|.....S.t.\|.....).N......get_content_

C:\Users\user\AppData\Local\Temp\_MEI69562\email\encoders.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	5.050932192600656
Encrypted:	false
SSDEEP:	24:g5y7gaT9r3CrNNTxw7WXT7dq6BFDEK10ZYSaXFVJ4DZoT3kOCDwOjB:g5/sWlW7WX9qQFYKaYSkhEDwOt
MD5:	65242D873C85F444E5BB3D08DC19B0E6
SHA1:	D13736330B8612639C1EA365E959CDA62BFF64B3
SHA-256:	4826318BA5D4519E1EDB7BEFC4DDD450332EE2E612DD5BA8FBC3FD57415F4127
SHA-512:	732C613A7D477E492F1B71C7BF3B3A8BF58470B5663D47A1C87B38692FDFD53370560D2BF9E0FF28E1B05E244DB963EE0D1F8FC25886F6E97B6B0ED37DE18B9A
Malicious:	false
Preview:	o....................................@....P...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).. Encodings and related functions.....encode_7or8bit..encode_base64..encode_noop..encode_quopri.........encodebytes....encodestringc....................C........t.\|.d.d...}.\|...d.d...S.).NT....quotetabs..... .....=20...._encodestring..replace....s..enc..r......email\encoders.py.._qencode.............r....c....................C....0...\|.j.d.d...}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.)..lEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN....get_payload..str.._bencode..set_payload....msg..orig..encdatar....r....r....r.....................r....c....................C....*...\|.j.d.d...}.t.\|...}.\|...\|.....d.\|.d.<.d.S.)..vEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer-Encoding header.. Tr......quoted-printa

C:\Users\user\AppData\Local\Temp\_MEI69562\email\errors.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5676
Entropy (8bit):	4.742287667772295
Encrypted:	false
SSDEEP:	96:aYI+E7YT1ZoHqqBqqfqquqquqqiXIyJ87aqq+qqOqqW1bqq9qq0sqqwJEqq5Fqqt:aYTEO+HqqBqqfqquqquqqByJ87aqq+q4
MD5:	2ADB0AEDCEB94F916B874EFEF9BDFC3E
SHA1:	F0599E7A2FD6DCF4F175B34C658EE07447F61D51
SHA-256:	D2CB7644A80B5C7879EBB3816E3B73BC3A0A42A6943D6856AD25248B409500DD
SHA-512:	3F69E9E21BCF352F8F1FF06252BF702D34A420299BC889A360D8D913839937ED552FEFD15AB9A16C98CF2241B8E00D18B589F9AA287C9A8A49F920AE18A986D3
Malicious:	false
Preview:	o....................................@.......d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6. email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageError.+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r......email\errors.pyr.................r....c....................@...r....)...MessageParseError.&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseError..Error while parsing headers.Nr....r....r....r....r....r........r....r....c...................

C:\Users\user\AppData\Local\Temp\_MEI69562\email\feedparser.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	10549
Entropy (8bit):	5.475890918893798
Encrypted:	false
SSDEEP:	192:CQt3ufpui5ERmXZvdZDd6ZCwKTbefqMU04c3H2hjD8g4B:9t+Bui5ZlZDcCwSbeiM/H29D8xB
MD5:	3030FB5B261CF98F8EE5EB5639C8A589
SHA1:	3D701257029AF3C770BF080B481F4716E130BD12
SHA-256:	143A79BAE215BC3F85CF08561DBE4AA0D87BF6E6F9ACD60E1AC713CE2C08407E
SHA-512:	83B71605EE28AB424D26E66161F45C089228F2B703A3B6529513C9F995BBA78B5D871048B74BDCB152E6505DF91212A61DF5EE7470912DBB5F9E788331E59E73
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.)......FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

C:\Users\user\AppData\Local\Temp\_MEI69562\email\generator.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12570
Entropy (8bit):	5.366112491185556
Encrypted:	false
SSDEEP:	192:9jni4Wf6dOGOMLqmnnM4VNcn53eMN+QcwntAgH/cearZ57pvimcu:97fWwOGjWeHVeh9N+QcwntXYX3
MD5:	1F4832FAFF0998679AC287006DE97434
SHA1:	2B8B07EBE8E3B79458C7011AB225F21EAE519C56
SHA-256:	D1578FF8562D5EF3EC4AA0B2ED9FAB2E3997AF3929B6E2520BA64C2E986CAFCC
SHA-512:	2C41FF4B90C47CFBE3C0999594678C71B716C0ADAA8FD6C4036A2C940F90BA1149732BBB56E781EB25423CB0540A3BD9B95842A94B69FA6A59E4F42C0E8CDAAE
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.e...d...Z.e...d.e.j...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.e.e.e.j.d.......Z.d.e...Z.e.j.Z.d.S.)..:Classes to generate plain text from a message object tree.....Generator..DecodedGenerator..BytesGenerator.....N....deepcopy....StringIO..BytesIO...._has_surrogates.._.....\r\n\|\r\|\n..^From c....................@.......e.Z.d.Z.d.Z.d'd.d...d.d...Z.d.d...Z.d(d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.e.d)d#d$....Z.e.d%d&....Z.d.S.)*r......Generates output from a Message object tree... This basic generator writes the message to the given file object as plain. text.. N....policyc....................C....6...\|.d.u.r.\|.d.u.r.d.n.\|.j.}.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.)......Create the generator for message flattening... outfp is the output file-like object for writing t

C:\Users\user\AppData\Local\Temp\_MEI69562\email\header.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	16421
Entropy (8bit):	5.408195412547922
Encrypted:	false
SSDEEP:	384:WEojVdCuwA8tzfSNlwn8w4EElPb/bl0rSXAc7uqKjQNWnPXbOidChI18DkVh:WE28tjS3wn8w4vhbcAguW9Vh
MD5:	AA1B628F56E4FF40585807C072336F6B
SHA1:	78E36D6DD448BEA2B2092596F76875C01F29FFC1
SHA-256:	21DCCE4C51903F5789636ABEF46C7DC99E6597ECD0DE45BC0570579CEBFE3370
SHA-512:	B1ABA136B253DBA2228BFF63268AE5C56D40A2949F4001732B41A92498134472042E2598B88C5AC90B2D753CC5CAB65902F39AEA2650CA3388603B96AF3C848E
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.)..+Header encoding and decoding functionality.....Header..decode_header..make_header.....N....HeaderParseError....charset..... ..... .. ...N..... ...us-ascii..utf-8.i.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. ..[\041-\176]+:$..\n[^ \t]+:c....................C.......t.\|.d...r.d.d...\|.j.D...S.t...\|...s.\|.d.f.g.S.g.}.\|.....D.]A}.t...\|...}.d.}.\|.r^\|...d...}.\|.r5\|.....}.d.}.\|.r?\|...\|.d.d.f.

C:\Users\user\AppData\Local\Temp\_MEI69562\email\headerregistry.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	21838
Entropy (8bit):	5.160948854123433
Encrypted:	false
SSDEEP:	384:stn16ElmJgvtMCFMlJj2voTpzzH3ON0MbfP3uY1oaWXf95yHF:stn1tO0FMvqvoNH3ONZbSml
MD5:	6B7B638CA42B9D71EBED9FED7EE28823
SHA1:	6A866E869E39CF24298A426FD3F5719EFAAE89E6
SHA-256:	FE620999075F4C874B007293452CB3F81AD102782BAAE0A9459B9BC8AA45E9B5
SHA-512:	7254CB00A9F51553D94B7D066D10A47F2C120FB8A80647344E06B9BA5EFD96DBEA06454564904C1D4B6F9559A02488B67469CAD5BCE0D245462EDC20E3C15A82
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d d!..d!..Z.G.d"d#..d#e...Z.G.d$d%..d%e...Z.G.d&d'..d'..Z.G.d(d)..d)..Z.i.d*e...d+e...d,e...d-e...d.e...d/e...d0e...d1e...d2e...d3e...d4e...d5e...d6e...d7e...d8e...d9e...d:e...e.e.e.d;....Z.G.d<d=..d=..Z.d>S.)?..Representing and manipulating email headers via custom objects...This module provides an implementation of the HeaderRegistry API..The implementation is designed to flexibly follow RFC5322 rules...........MappingProxyType....utils....errors...._header_value_parserc....................@....^...e.Z.d.Z.d.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Address..Nc....................C.......d...t.d.\|.\|.\|.\|.f.....}.d.\|.v.s.d.\|.v.r.t.d.....\|.d.u.rC\|.s \|.r$t.d.

C:\Users\user\AppData\Local\Temp\_MEI69562\email\iterators.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1948
Entropy (8bit):	5.320183547419749
Encrypted:	false
SSDEEP:	48:gahA49ILWjxazvfuDpoSQLfMbhTGogy1eLUhz/CIi:prIWdi+DPsMbhPg82
MD5:	0476633308A180C6747EE321B8E378C6
SHA1:	E8321A6E1A8F50C93107EADDA64CEF16B69FA4F7
SHA-256:	3E9565D45AD26A172DBA43910263F8CC7A24DB52F1EAB78967C16C36B23AE911
SHA-512:	0141FD8B71E1B0E8009C6583644C4CC32D2384BC0981A3F71EC33D3A0A3FBA9DA8A9363C9F8315842F82C9E181CA94ADC72F5BE27AB1756269D9625DBE9E3FF7
Malicious:	false
Preview:	o....................................@....J...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..1Various types of useful iterators and generators.....body_line_iterator..typed_subpart_iterator..walk.....N....StringIOc....................c....4.....\|.V...\|.....r.\|.....D.].}.\|.....E.d.H...q.d.S.d.S.)...Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N....is_multipart..get_payloadr........self..subpart..r......email\iterators.pyr...........................r....Fc....................c....8.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...E.d.H...q.d.S.)...Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. ....decodeN..r....r......isinstance..strr........msgr....r......payloadr....r....r....r...."......................r......textc....................c....:.....\|.....D.].}.\|.....\|.k.r.\|.d.u.s.

C:\Users\user\AppData\Local\Temp\_MEI69562\email\message.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	37754
Entropy (8bit):	5.321669694122612
Encrypted:	false
SSDEEP:	768:mUGhq3cffG9nAn2Rmzq0Y8kcol91IyggNhN:mtBffG9xehTTA92IN
MD5:	68474A509D518965CA8DC97558B4EBC6
SHA1:	E0662372CF2E75FD8D80723FA042413A76A374D4
SHA-256:	580E09C4562A2A2F0B1E39C485EA19D4324824AFDE82C7C45734A0A8DAE4CA8C
SHA-512:	2008A13F467E9D6601511BAAF981F618FA11A00B1F20880122A93FF0C233D2EE531F6E96A142897B81B9208B9B6F5E2F8F130713087E4A54FB310A2647985AFE
Malicious:	false
Preview:	o....................................@........d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)..8Basic message object for the email package object model...Message..EmailMessage.....N....BytesIO..StringIO....utils....errors....Policy..compat32....charset....decode_b..; ..[ <>@,;:\\"/\[\]\?=]c....................C....4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;....str..partition..strip....param..a..sep..b..r!.....email\message.py.._splitparam.................r#...Tc....................C........\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|.\|.f.....Y.S.w.\|.sOt...\|...rXd.\|.t...\|...f...S.d.\|.\|.f...S.\|.S.)..~...Convenience function to format and return a key=value pair... This will quote the value if needed or if qu

C:\Users\user\AppData\Local\Temp\_MEI69562\email\parser.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5656
Entropy (8bit):	4.935115598818016
Encrypted:	false
SSDEEP:	48:g7O7L2QFUCnoK4b7TGPerSZUWyT9Bzug4DcCTDQFlhnoKL2pG6kTy+erSIoVgTns:84LQtB7ue5PlWToe3oF++eto2FZSVk6b
MD5:	441304A5F9E2971955CE423AF65A73CC
SHA1:	457B51D876A5C24488B168BCF0568954A6C13185
SHA-256:	6D5279E7E4AA776449F132E09F881525EE5F9B4CCED9F782DA05D36B3CAAC523
SHA-512:	7D86CE54BDAF01B55D521FEE488B4512B4BD55B00A96578F5FC5B2A1FC03797B37503EBD75CA88700557CDB91827952DB21663F16F5C1C10741BD9A0922FA7E0
Malicious:	false
Preview:	o....................................@....x...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.)..-A parser of RFC 2822 and MIME email messages.....Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.........StringIO..TextIOWrapper..r....r........compat32c....................@....0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C........\|.\|._.\|.\|._.d.S.).....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

C:\Users\user\AppData\Local\Temp\_MEI69562\email\policy.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9633
Entropy (8bit):	4.931258605408404
Encrypted:	false
SSDEEP:	192:oXlDAHhSVVbT6AGKJU/LYMp1Btoozt8FcQ+evaaLb2ec8v:oXlsHhQZT6SJUNDBWoztHevaM
MD5:	4CC32D9DC22FECB43DC2665C49C0E6DF
SHA1:	F64AA150A478D3C01FA7697A9CB4C772009CC72C
SHA-256:	A2E972DA28F1D082E21FE48A94D54948EA07FABD9461580CD06B59EB5DDB4AC7
SHA-512:	91820248B18204CD92DA6805ADBC54799EDB86567DCF55721BA2C2810AD5E81068C9B3167C2906FD1285B97F5ADEDC6F94923D1B34FA39E7C130627B49006958
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e...d...Z.e.G.d.d...d.e.....Z.e...Z.e.`.e.j.d.d...Z.e.j.d.d...Z.e.j.d.d.d...Z.e.j.d.d...Z.d.S.)..cThis will be the home for the policy that hooks in the new.code that adds all the email6 features.......N....Policy..Compat32..compat32.._extend_docstrings...._has_surrogates....HeaderRegistry....raw_data_manager....EmailMessage..r....r....r......EmailPolicy..default..strict..SMTP..HTTP..\n\|\rc.........................p...e.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e...Z.e.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.....Z.S.).r.....Q...+. PROVISIONAL.. The API extensions enabled by this policy are currently provisional.. Refer to the documentation for details... This policy adds new header parsing and folding algorithms. Instead of. simple strings, headers are custom objects with custom attributes. depending on the type

C:\Users\user\AppData\Local\Temp\_MEI69562\email\quoprimime.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7599
Entropy (8bit):	5.51186480963117
Encrypted:	false
SSDEEP:	96:DLJLyjCY2rlgeRk/SE8HiIf3HH94gxyV7pmZ5ZftOcF/NkFUyq2n1/RY9XDr7d7V:fJYUGQ2SEeagoV7pzyyFhRKTrPPMmlL
MD5:	2A2AC2D91A781D816AA570B3D7B274A8
SHA1:	E3B62D74AF0D18764C964CF46930900ADEC80CD1
SHA-256:	C5E78AD3FF81BE188BA1876D505F7394C07BF4F55B38E1B4B23C6F7D8A6FE4A2
SHA-512:	B638DF6C89013315D75DBD7179D57D03FF153DC1D12682F7556B5091B78A59F7FCE3FBA605BA88FCF227F3F1C2F9751E4F49974F9C76B333C3453101D06FC43B
Malicious:	false
Preview:	o....................................@....F...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-.F...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

C:\Users\user\AppData\Local\Temp\_MEI69562\email\utils.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9666
Entropy (8bit):	5.5630765218102995
Encrypted:	false
SSDEEP:	192:7bGMhTYU1ba/bcRIpnc8PNMw1gBQl7EdE1J/mezcA5aJCSStw3TG/3Q48mt8U:mQTQTcqFSwaBQl7ogVVvAfGyGfft8U
MD5:	B573D5BD8B7562F42D39411D50A09D28
SHA1:	9B70CF2621A611B86C3888C284E2D331E69470FA
SHA-256:	C9EBAF9F1E9F19F2C492DB9C2BA066D6EAB844EF4BE241F160D6613A0C47160B
SHA-512:	5EFE8F8F33D660DCBA373E14953B53C9B492D57D6B7362715D6DE6981443CEE8766BEDC745B43779675315689C9388E4185F8B641F9CFCFBAFF45755E4940CE4
Malicious:	false
Preview:	o....................................@....T...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d..Z(e...d+e.j)..Zd,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);..Miscellaneous utilities.....collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N....quote....AddressList..r......r....r......_parsedate_tz....Charset.., ........'..[][\\()<>@,:;".]..[\\"]c....................C....$...z.\|.......W.d.S...t.y.......Y.d.S.w.)..8Return True if s contains surrogate-escaped binary data.FT....encode..UnicodeEncodeError....s..r*.....email\utils.py.._has_surrogates3....................r,...c....................C...

C:\Users\user\AppData\Local\Temp\_MEI69562\fnmatch.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4224
Entropy (8bit):	5.672816850634758
Encrypted:	false
SSDEEP:	96:tZ1NvFl7gPHnfnTdD7RykUATq7Y1qYmWVzHRJwLaL1F3rGz6:t1vFl7g/fnTF7gkDzTRFxm6
MD5:	E75B05D9847E69F881417036910CF144
SHA1:	BDD6B3B95B7A97DF99519A6DEFCE8BEE711595BF
SHA-256:	38E88B1607E9CAE72DAD8E232949F85DBE3F4A3A09028601A9D42A8B49340ED8
SHA-512:	5E10410232012FE00C4F1B2D99B1AA36A4496A2CACB561C5769663F350A60A3C3CFF0BBCEB0FEBE4804F567FEFFA0EDC758A16AA43156DBCF9718F05EB1DA2E4
Malicious:	false
Preview:	o....................................@....\|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N....filter..fnmatch..fnmatchcase..translate....countc....................C...."...t.j...\|...}.t.j...\|...}.t.\|.\|...S.).....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

C:\Users\user\AppData\Local\Temp\_MEI69562\fractions.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	18566
Entropy (8bit):	5.349021303034702
Encrypted:	false
SSDEEP:	192:v1jzJpzcUkpJB6LLfG54tORCX5keju1Q3rAVYKlKigpWDaIbsCaUSYWHObaAMH6h:RJBclktpX5k+xGPgcHszUSNHOuQs+7T
MD5:	6B447F6140DE4983B7B9DF94AACDE123
SHA1:	EFF50E2F4BF90AFC40701B6CF7BEFA117580CA23
SHA-256:	7BAB50340197F0E94332D9C564DB979FAE4EFA7B3077458A3EDAE99ECB6FECFE
SHA-512:	0549D606C0E2940D2E1EBBA4DC172A09E94CE63EB9DB12B8FCF8124A8A1950E9FF00533158DEB3A684CB129EC33B9F699D381441A833ACFFC19F9477C455DE36
Malicious:	false
Preview:	o....................................@....x...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.g.Z.e.j.j.Z.e.j.j.Z.e...d.e.j.e.j.B...Z.G.d.d...d.e.j...Z.d.S.)..+Fraction, infinite-precision, real numbers..........DecimalN..Fraction.C.... \A\s* # optional whitespace at the start, then. (?P<sign>[-+]?) # an optional sign, then. (?=\d\|\.\d) # lookahead for digit or .digit. (?P<num>\d) # numerator (possibly empty). (?: # followed by. (?:/(?P<denom>\d+))? # an optional denominator. \| # or. (?:\.(?P<decimal>\d))? # an optional fractional part. (?:E(?P<exp>[-+]?\d+))? # and optional exponent. ). \s*\Z # and optional whitespace to finish.c.............................e.Z.d.Z.d.Z.d.Z.dRd.d.....f.d.d...Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.dSd.d...Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.e.j...\.

C:\Users\user\AppData\Local\Temp\_MEI69562\ftplib.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	28951
Entropy (8bit):	5.466606742510636
Encrypted:	false
SSDEEP:	768:7OEb74dadPSivaTi6cdJaroKmw8bO8+XvzQG9jc2yAE1su:7OE34dyKsDdQroKmjbZUbzTyAE1su
MD5:	100BB0044CA494E10887B78381541996
SHA1:	061A1BD44F1B572AF2E3AC1AB162DAFC6CDE353B
SHA-256:	CB44F0C4C18E8201DCF6C3F081BFC0012C5F2B8BCE25152034B5DF157C641D35
SHA-512:	354D3005B7FE0879DB3DA66834F18AA0F9B1A5F3A9F249945E149BADEFAC10BD46607A2CC0AAA3955097D2149061FBDF2B176EBA170EF71A273F4819045F6804
Malicious:	false
Preview:	o....................................@....N...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.f.Z.d.Z.d.Z.G.d.d...d...Z.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.e.j.Z.G.d.d...d.e...Z.e...d.....e.e.e.e.j.f.Z.d.a.d.d...Z.d.a.d.d...Z.d.d...Z.d.d...Z d d!..Z!d)d$d%..Z"d&d'..Z#e$d(k.r.e#....d.S.d.S.)*.S...An FTP client class and some helper functions...Based on RFC 959: File Transfer Protocol (FTP), by J. Postel and J. Reynolds..Example:..>>> from ftplib import FTP.>>> ftp = FTP('ftp.python.org') # connect to host, default port.>>> ftp.login() # default, i.e.: user anonymous, passwd anonymous@.'230 Guest login ok, access restrictions apply.'.>>> ftp.retrlines('LIST') # list directory contents.total 9.drwxr-xr-x 8 root wheel 1024 Jan 3 1994 ..drwxr-xr-x 8 root wheel 1024 Jan 3 1994 ...drwxr-xr-x 2 root wheel 1024 Jan 3 1994 bin.drwxr-xr-x 2 root wheel

C:\Users\user\AppData\Local\Temp\_MEI69562\g.datura

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	883136
Entropy (8bit):	7.9892066057938935
Encrypted:	false
SSDEEP:	24576:0Vm7RrohzsF7bcljiHFDI1jhHW12nhVg1jK5NCp:0k7oqTHtI1jhHlhVg1+o
MD5:	5038FF3072F5F594D14B75D937E9F7F2
SHA1:	3746446CC599B2977920BB89C40F13CAB3225956
SHA-256:	4CCCDAAFD54746FEB2FF200DC2EEA01D3E9CF59AC4E241A4395721447FD2B731
SHA-512:	5255669DB728FB20A21C97BDB284881E5C995380CFFBAF8EFB691071C60A1206FE7D25B68F08A22DF126614A0BE541B3431E7A553610332C22B76AFCA217C18B
Malicious:	false
Preview:	3nd......... .Pi.&..S.J1....+.s.v..j..@..M...........@..<V......u..[rmV`.@$.....0/}...X...%y;.4..Y.Q..._xD3E$ZJt...Hy....\=..B.#...1.4R..>..52;`......eS.D..y%..j..y...D..'...T..r.....L.l.....:O...i...1..F.t...$EN..S.]...g....AS...k..zB..r...s.v..j..@..M...E?z+.3Z....g...Q5S3.....p...(..f..}......#..a._[X...$.Nt.....e...`....S.z_.%.q...a.......aY.r..v@I.O.:.$.aY.r..v@I.O.:.$...........0.v....:C..:.."h"..Q..,-$\|.x.i^g5Ax....e.l..b..(Ki.s.v..j..@..M79~..y1.VJ7...-..TK..W.......%.s.v..j..@..M.{`VS.i....{..N.z..@P..yU.5...O.....Qn......x...v..%...q~.`......!...K=..`.i.,.w......weQ.%d..=0...4[...5e........?...8.;rF..zf....rk.%8.H....c.U.MG.P.D.H#+Hh._....`.j.3mS..i^.Y....y.....\.5..b....L._wR..o......"....6...B..w7q.f....D..9.r$....U...KJ......M.v>..6.Gn7eh..X.{.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v..j..@..M.s.v.*.j

C:\Users\user\AppData\Local\Temp\_MEI69562\getopt.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6312
Entropy (8bit):	5.373000608350679
Encrypted:	false
SSDEEP:	96:uCPlmIY7rcBjX2GaiNnbKc3HQZsab8Qo2uGfQzWV1J/CePFoA/ouduWcRTaazV:hHZBNJ5KWHQZsnUuwQSbCGJEYazV
MD5:	97D13F52094FB7F615D2ABEA4BA03F20
SHA1:	9237BD08ACF6123DEDBF070B3413D430F7117F63
SHA-256:	B375CD9A0E207DF7349E4FFC544B28F73A5E7CF7FE2005B04B2E36CB63060D51
SHA-512:	47CFCB9A3E6A1B5CFFD7FE70A2865F4A3F59AD8A80F84C6C69F947EB58B0AAE667E5AFEB14DECBF4657545736DF7722D00BBDE8860D34B29ED5C2820BD1F212E
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.d...Z.Y.n.w.G.d.d...d.e...Z.e.Z.g.f.d.d...Z.g.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.r_d.d.l.Z.e.e.e.j.d.d.....d.d.d.g.......d.S.d.S.).....Parser for command line options...This module helps scripts to parse the command line arguments in.sys.argv. It supports the same conventions as the Unix getopt().function (including the special meanings of arguments of the form `-'.and `--'). Long options similar to those supported by GNU software.may be used as well via an optional third argument. This module.provides two functions and an exception:..getopt() -- Parse command line options.gnu_getopt() -- Like getopt(), but allow option and non-option arguments.to be intermixed..GetoptError -- exception (class) raised with 'opt' attribute, which is the.option involved with the exception......GetoptError..error..getopt..gnu_getopt.....N....gettextc....................C........\|.S.).N......s

C:\Users\user\AppData\Local\Temp\_MEI69562\getpass.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4190
Entropy (8bit):	5.538738773611812
Encrypted:	false
SSDEEP:	96:3htoLt8NVIes4JDxwlNz3eCkMsRtiRKYZvV70A:0t/es4AHeCbsOvF0A
MD5:	955E8E0BEC5A9D869E9BDEA9252828B1
SHA1:	BCD61F4A47A7A5D399BDC317BA1E326C678BAB22
SHA-256:	8D296FC0E9B532A125EBC02D8B82D53EFB31168A7401962CD791AC763C96CAD3
SHA-512:	628901E28F4458DFA1016E24AFEE53CED50B1B605D5355B35E137880B4279290DA50BF6B55D5097F3AC17E58B2CA4B8EAC4FB42B741548F56C58602FEA816B92
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.z.d.d.l.Z.e.j.e.j.f...W.n"..e.e.f.yh......z.d.d.l.Z.W.n...e.yb......e.Z.Y.Y.d.S.w.e.Z.Y.d.S.w.e.Z.d.S.).....Utilities to get a password and/or the current user name...getpass(prompt[, stream]) - Prompt for a password, with echo turned off..getuser() - Get the user name from the environment or password database...GetPassWarning - This UserWarning is issued when getpass() cannot prevent. echoing of the password contents while reading...On Windows, the msvcrt module will be used........N....getpass..getuser..GetPassWarningc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qualname__..r....r......getpass.pyr...............r......Password: c....................C........d.}.t.......}.z%t...d.t.j.t.j.B...}.t...\|.d...}.\|...\|.....t...\|...}.\|...\|.....\|.s+\|.}.W.n/..t.y[......\|.......z.t.j.....}

C:\Users\user\AppData\Local\Temp\_MEI69562\gettext.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	18071
Entropy (8bit):	5.36387216099781
Encrypted:	false
SSDEEP:	384:j+2IDZ0NeEcNlofU/yiK7MYXCmdmMHLbfNzUM3eclHiv5PXZafE3sZ53:j+200NeEfc/yTRrRAM3NivFZ2VZp
MD5:	CAB1118ED29F315C02A4FC9E7665F402
SHA1:	7724867C57FA0C28C4D829E5795B2FA752DCE28F
SHA-256:	E2F060C92BB8C5CD29E6CE480BFFDE0B6F838A8249BD368A645296609D27770B
SHA-512:	DDFDCDC87674AC8055722F85C054B07EA1F10019EEA6AF9C364CC4C4872E1B9624E7FED4944B4C6A271F8F7E97B702BA27273F11CB1460AB82C142C2071CB578
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.j...e.j.d.d...Z.e...d.e.j.e.j.B...Z.d.d...Z.d.d...Z.d.Z.d.d...e.e.d...D...Z.d.d.d.d...Z.dGd.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.dHd!d"..Z.i.Z.d#g.Z.d.d.d.d e.f.d$d%..Z.d.e.d.f.d&d'..Z.i.a.i.a.d(a.dId)d..Z dId+d,..Z!dId-d...Z"d/d0..Z#d1d2..Z$d3d4..Z%d5d6..Z&d7d8..Z'd9d:..Z(d;d<..Z)d=d>..Zd?d@..Z+dAdB..Z,dCdD..Z-dEdF..Z.e.Z/d.S.)J....Internationalization and localization support...This module provides internationalization (I18N) and localization (L10N).support for your Python programs by providing an interface to the GNU gettext.message catalog library...I18N refers to the operation by which a program is made aware of multiple.languages. L10N refers to the adaptation of your program, once.internationalized, to the local language and cultural habits........N....NullTranslations..GNUTranslations..Catalog..find..translation..install..textdomain..bindtextdomain..bind_textdomain_cod

C:\Users\user\AppData\Local\Temp\_MEI69562\glob.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5821
Entropy (8bit):	5.170611174800075
Encrypted:	false
SSDEEP:	96:Q77f2UQQ4yZsKAnYQ4yZstIn9BGO2A33mC764I3ypB7zHzDCEncnpsM9ztt:vXQ7ZknYQ7ZQM7GO2kWC7VzjzDCEncOc
MD5:	2F7EC6F1B72721F192804372493931F4
SHA1:	C0B37556D80C2587424424A379FB6E54636C08FD
SHA-256:	1CE09720BBB2C89FC5243FD3F9B3ED939BBDE6B129CC29D4A1F7894665A002A6
SHA-512:	EEFFAAC0A7ACA43CD8BF666F83DD57385C2A240D911AC821F2DB6A5F9F49C4C6B927460DE726E1C32469FFAFD28A253ADF3B98896E24A5F90A29B28ECBFDA8B7
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.d.d...d.d...Z.d.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e...d"..Z.e...d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.e.j.e.e.d,d...B.Z d.S.)-..Filename globbing utility......N....glob..iglob..escapeF....root_dir..dir_fd..recursivec....................C........t.t.\|.\|.\|.\|.d.....S.)..y...Return a list of paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that are not matched by '' and '?'. patterns... If recursive is true, the pattern '**' will match any files and. zero or more directories and subdirectories.. r........listr........pathnamer....r....r......r......glob.pyr...............r....c....................C.......t...d.\|.\|.....t...d.\|.\|.\|.\|.....\|.d.u.r.t..

C:\Users\user\AppData\Local\Temp\_MEI69562\gzip.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	18521
Entropy (8bit):	5.240691857496878
Encrypted:	false
SSDEEP:	384:BsmCjJfnpibiHKZZtLkBDub7+o+OdG3X1JVArSgh5MDi/:vwpUihqcmG3lQV7D/
MD5:	62FE75509EDDC628E06F41D3C8243C06
SHA1:	00A4470494DC999B02F6B292F062D1DCD5F0D096
SHA-256:	0143AB14F32586879652F5982074D217DC164211D56FF55FC6DA5E1C06DCA191
SHA-512:	EF16641C502753F3743977FA808213A18EEBD31E0F025B4942AA7DB62E83A140D61ADF1A983F1E4162B9D7558D0C858F9139C61E5A159388491F500263EB5C12
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.\.Z.Z.Z.Z.Z.d.\.Z.Z.d.Z.d.Z.d.Z.d.e.d.d.d.f.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.f.d.d...d.d...Z.d.d...Z.d.d...Z.e d.k.r.e.....d.S.d.S.)...Functions that read and write gzipped files...The user of the file doesn't have to worry about the compression,.but random access is not allowed......N....BadGzipFile..GzipFile..open..compress..decompress.............................r....r....r................rbc....................C........d.\|.v.r.d.\|.v.r.t.d.\|.f.......n.\|.d.u.r.t.d.....\|.d.u.r t.d.....\|.d.u.r(t.d.....\|...d.d...}.t.\|.t.t.t.j.f...r>t.\|.\|.\|...}.n.t.\|.d...sHt.\|.d...rPt.d.\|.\|.\|...}.n.t.d.....d.\|.v.ret...\|...}.t...\|.\|.\|.\|...S.\|.S.)......Open a gzip-compressed file in binary or text mode... The filename argument can be an actual filename (a str or bytes object), or. an existing file object to read from or write to

C:\Users\user\AppData\Local\Temp\_MEI69562\hashlib.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6823
Entropy (8bit):	5.613564320974916
Encrypted:	false
SSDEEP:	192:uRmE5+odQizuTmkq0LtsX0lk/4Xs4+G00:uRHQiz0mkq0LtsXybXs4T
MD5:	16CD0387B875EE98F995F0AAEA40BED8
SHA1:	C88ACFB31295FD244FFA3F168548C2F85F9F34D7
SHA-256:	39D95EA48D162A25999E85A85BA2E24CB04511479F87C8589609410AD417D89D
SHA-512:	20F5344559DB460D121E2B00AEA41DEF960643E5BC5E00E4180F2D19F90D2FD9BFF6D7B59C996D99E736A6EC8F2929F8BFAFECFB7D8B894177C9B6AEE3105CC2
Malicious:	false
Preview:	o....................................@....l...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.)..3...hashlib module - A common interface to many hash functions...new(name, data=b'', *kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

C:\Users\user\AppData\Local\Temp\_MEI69562\hmac.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6947
Entropy (8bit):	5.300318154800611
Encrypted:	false
SSDEEP:	96:zKe0rL5tTGbGEh2aWCMdwpDY0s5x/ln8krrxUaUCefyXOfASOUR2syEjFeHW0VYM:B2TSdeCMdyQ/9XrrxUagT1nLc20JgC
MD5:	64FCBE8632A5A4F46AB057DAEF9BF289
SHA1:	AECE5CECAA9290F29C82F76E310E8CF079B5708D
SHA-256:	317DEBB945D94B1805AF271ED4DA47A8B2D169F11CF51B6140B48B6AEB5F5C9C
SHA-512:	816BDB51FACA52AF0286A0D6A13DC478B112985E89C1825BB194908D776F6EA54FC787103BF196E01D498A539A390BFF16E56B69820C3BA4C00424AD25553886
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.)..qHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N...._compare_digestc....................c..........\|.].}.\|.d.A.V...q.d.S.)..\...N.......0..xr....r......hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@....f...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMAC.~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@......._hmac.._inner.._outer..block_size..digest_sizeN..c....................C.......t.\|.t.t.f...s.t.d.t.\|...j.......\|.s.t.d.....t.r<t.\|.t.t.f...r<z.\|...\|.\|.\|.....W.d

C:\Users\user\AppData\Local\Temp\_MEI69562\hrwp.jpg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 3840x2160, components 3
Category:	dropped
Size (bytes):	856227
Entropy (8bit):	7.9628820066706965
Encrypted:	false
SSDEEP:	24576:pjoHsKbs9uXfPO7nE6I8yrBAf7lx8tBWyLPyue:py6AmG2fpCnWyWue
MD5:	C6B36F030ACC8696245F32BFB817F5F6
SHA1:	C17D21C9CF2B55F5A4362FCF20C528715981540F
SHA-256:	27BB1DF2AA5F2A11534A848DBF9C3A5287EF7B2F6F621648ACB34E7A4C744C25
SHA-512:	DB43999C577BD65B5267FD6C7908BE1956398BE71C5360BA4BFD6E6251E8863CFFE80F4FCE37DD238961C7021DEB7A67A435D4304AF0C63C3BEDF20B5AFFA05C
Malicious:	false
Preview:	......JFIF.....,.,.....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......p...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.....Z(...-%...:......L.c.QIE0.Fp).-...J(.h....c..Q@.....:..(......=i(...(...3@..Q@.i(...(...(...(...QIE .E .E ..J(.h.....J(.4....-...4.;..w..BQ.(....(...J(.h..@.i)h...(4....SiE....).QE..QE..QE....IE........A....)i(..QH.)h...(.)i(4.}.....KM...Q...@.J)(..p......(...u:.K.Lc.i......zRf..GzAA.@.R.j....IE.:...C.R.N....S.4S.IC.(....@..p..p.1.8v....Hhu(..p..-%-%!.E(..R...S

C:\Users\user\AppData\Local\Temp\_MEI69562\html\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3303
Entropy (8bit):	5.599081845403618
Encrypted:	false
SSDEEP:	96:HLuvDoUKUrNYy6x36pY787oK+Y0BKjGPRav/KY:rGDJSFEpi88KvcaCY
MD5:	CF327CCF8782640E545FA0BF323D58FC
SHA1:	87731D3293C0211B0FBA669D5340C6C7606820CA
SHA-256:	9314D9A9A2644EA8DEE084BF7F8BB5C15C19BD096BCDBA154F62C689C18FA912
SHA-512:	2D13795C7091EE4EB37AA3BFA5ECC9410D8A42C397F0C3E3A185E7D427F6391414CBDF70D6F2FE298AE774DBA42374DA3D92740DB7FECCAF9DA5E008559C72F6
Malicious:	false
Preview:	o....................................@....$...d.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.dPd.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..i.d)d..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF..dGdH..dIdJ....Z.h.dK..Z.dLdM..Z.e...dN..Z.dOd...Z.d.S.)Q..General functions for HTML manipulation.......N....html5..escape..unescapeTc....................C....D...\|...d.d...}.\|...d.d...}.\|...d.d...}.\|.r \|...d.d...}.\|...d.d...}.\|.S.).... Replace special characters "&", "<" and ">" to HTML-safe sequences.. If the optional flag quote is true (the default), the quotation mark. characters, both double quote (") and single quote (') characters are also. translated.. ..&..&..<..<..>..>..".."..'..'....replace....s..quote..r......html\__init__.pyr..................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\html\entities.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	144410
Entropy (8bit):	4.594464799734583
Encrypted:	false
SSDEEP:	3072:8i3e0uztoDNuMa85igwmGyc6+ae4Gc4caM6eQ:s0ZwMt5ixmGyc6+ae4Gc4caM6eQ
MD5:	E6FFA4CAFBF243467BF5893F035FD700
SHA1:	2E6E9CFA847C25CA6FCEBBFA67A56C523DC50A09
SHA-256:	B74386AF5F5AB6A9594E69FB0E82360954242006E8FD608BBB8DD1045335C8AE
SHA-512:	DD2FD42B9B49CC8B9DBA69EE4C58E06A574C006E3E9917472EA4D4E82BDDFEF1C6D21CEA96009CF85E1DE947025EF1DA8A15921D1855C636B42F91AB81FC5B36
Malicious:	false
Preview:	o....................................@....`..d.Z.g.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..i.d$d%..d&d'..d(d)..d*d+..d,d-..d.d/..d0d1..d2d3..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE....i.dFdG..dHdI..dJdK..dLdM..dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\d]..d^d_..d`da..dbdc..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtdu..dvdw..dxdy..dzd{..d\|d}..d~d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d...d.d...d.d...d.d...d.d...d.d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....i...d...d.....d...d.....d...d.....d...d.....d...d.....d...d.

C:\Users\user\AppData\Local\Temp\_MEI69562\http\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6396
Entropy (8bit):	5.8170951908995665
Encrypted:	false
SSDEEP:	96:1WW60tDxA8eC2UVKfSBaB2JLUIwCc8HyHNZnRzTYWrgq392RJc6sPK8Gk4kzNovg:1WzsdAEDkaBasJBDcxHN/8O2wHb4kp
MD5:	4F90303688E2156D114D29CBC605DFDD
SHA1:	8AAC3CFC88AD4605ADDA3FAFE6DA7C7DE9EE47D8
SHA-256:	EF20A72CCA47E520F0D2F281CCF9C6AD3B44FCD1B75CC6D566D3DEF005B6BD66
SHA-512:	045054A2C51B957CC2315379BFE6F2E13B15E57F17A71FBAC7DB04CB3F263537B06A55C50AB9AE903B6576156FD86F65AB9C514743DB6EAFDF35694FA770CEAC
Malicious:	false
Preview:	o....................................@....&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)..........IntEnum..HTTPStatusc....................@........e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er.....G...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

C:\Users\user\AppData\Local\Temp\_MEI69562\http\client.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	35133
Entropy (8bit):	5.425817138455597
Encrypted:	false
SSDEEP:	768:QoG3q+gfU03YBTCrq7rk3HpL/KJBzlTBK9WW+RWGR4:bG35gf33YBWSk3HpDglTBK9F+b4
MD5:	C4B04D69297236E2F4B9140C962FE56B
SHA1:	9823B5FCEB7F0B12554BD33DCD8B877814CAC296
SHA-256:	7ECBA0C6BDB16E91877CFD0568974E73884FCA1D5928732004A2FB7D7998C2A7
SHA-512:	78A313D312C3C9F434A32206BECA46D67DC2B3656F988CFC2C9334CA30C47F9D74008BB6219DEC2CB1531BA660AD9298202EA2BBB4373B61CAEB4973B2ABB848
Malicious:	false
Preview:	o....................................@....P...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...ZG.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putr

C:\Users\user\AppData\Local\Temp\_MEI69562\http\cookiejar.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	53423
Entropy (8bit):	5.611877946752058
Encrypted:	false
SSDEEP:	768:aBeaRRGCE0wM19nyXIRHtOQTXKr8WOOg4fAsrMLBL6wqgInOAkvknwGAiHlJo5kh:0Kg19yXsHoQurvOMYcw1jGamprT
MD5:	9BCCE176927A2A607089851178C996DD
SHA1:	915E708FFB03507EB2F799F642B569C32F73EF80
SHA-256:	ABC07C4656D13CB5AB9BBE3E04CF7BB2B6FD7A44789009D09CB046B9BD084289
SHA-512:	5C04F33E476888FD85E0872E4D4A6C610EDD04CFAE294239D5927D260C14AE91A3DBF87DAD70361A8E224FC53629C42AAB742A4FE5577BB8AA7B6F88A80FD483
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)j....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\Users\user\AppData\Local\Temp\_MEI69562\http\cookies.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	15306
Entropy (8bit):	5.524396535764822
Encrypted:	false
SSDEEP:	384:YBxp5SiXPtUTTnkFadj4GmLp5Zjh3j/lszSd:MpPtUvkUdj4Gm5hTNsz2
MD5:	0E1046ACC768A93796C7187C8740BD36
SHA1:	17B4A28B84869C839C057681DEB07260082EF78D
SHA-256:	C27760D19E8C560F05ACCA1C2E4E4522F5C3F4EB97DDD816051446F5EC147B5B
SHA-512:	D83372265BE43B504DFC49162FD0925780915E420F5A1C85E8E282EC4F84E7348F3EAEFABF0E584A8B97AB1EFADB72A4AE4C7AF4C4FC5BCEAAC9466E0BB79F97
Malicious:	false
Preview:	o....................................@....Z...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(......Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\Users\user\AppData\Local\Temp\_MEI69562\http\server.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	35163
Entropy (8bit):	5.700154412771834
Encrypted:	false
SSDEEP:	768:2MoRE1vmE9k7QIME2pD9C4rz/fWa7dBq5gevhD:FoRE1O/cdAOWaOpD
MD5:	C04035CFA34305F329FB8780AD27C814
SHA1:	E2257F8D76C5FA2C77525C7E0807401D4E477556
SHA-256:	827FF56FC355723AADE9AA359548615C8F168F0CEE82E0BAA6FAFC7B9B72F30A
SHA-512:	77FAAED90C2B2ED4914D40A70FA2B25A2183639AA7023B0D1C380991D4573B1DF1E017032C2F01AD947A6556B0084238381710D1A0F5EA737E14CADF3A1B3506
Malicious:	false
Preview:	o....................................@........d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z d.d...Z!d.a"d.d...Z#d.d...Z$G.d.d...d.e ..Z%d.d...Z&e.e.d.d.d.f.d.d...Z'e(d.k.r.d.d.l)Z)d.d.lZe).+..Z,e,j-d.d d!d"....e,j-d#d$d%d&d'....e,j-d(d)e.....d*d+....e,j-d,d-d.e/d.d/d0....e,.0..Z1e1j2r.e%Z3n.e Z3G.d1d2..d2e...Z4e'e3e4e1j5e1j6d3....d.S.d.S.)4.@...HTTP server classes...Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see.SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,.and CGIHTTPRequestHandler for CGI scripts...It does, however, optionally implement HTTP/1.1 persistent connections,.as of version 0.3...Notes on CGIHTTPRequestHandler.------------------------------..This class implements GET and POST requests to cgi-bin scripts...If the os.fork() functi

C:\Users\user\AppData\Local\Temp\_MEI69562\idna\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	768
Entropy (8bit):	4.960167104345667
Encrypted:	false
SSDEEP:	12:ge5Q/VJB1jeAr9xLGmdChEYOcAMME28ssqly4S+28ssqUy4Uq9RxWs/:g+AVZjeeL/whvOcA1T893/p89KD2
MD5:	31DD2A8EC6C613D37B5DA0A8C8C81256
SHA1:	F45DA4AB2001E001412108ABDA549D4A987617E6
SHA-256:	F7CAB7FF203658DB15E3510D21C831487D3FDF6ABB7A692291E69B16324D6A68
SHA-512:	3F73AE4417DD9F6D55E25A0D5094DA45D269AD8436A44CC64A12C46B760CAD6EB928E96D589DBBABE4113173B5A9A160FD4BE2250B1CBD47A1E9E5AC00611152
Malicious:	false
Preview:	o....................................@....t...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.S.)..........__version__....IDNABidiError..IDNAError..InvalidCodepoint..InvalidCodepointContext..alabel..check_bidi..check_hyphen_ok..check_initial_combiner..check_label..check_nfc..decode..encode..ulabel..uts46_remap..valid_contextj..valid_contexto..valid_label_length..valid_string_length....intranges_contain..r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N....package_datar......corer....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r......intrangesr......__all__..r ...r ...z.idna\__init__.py..<module>...........P.....

C:\Users\user\AppData\Local\Temp\_MEI69562\idna\core.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9399
Entropy (8bit):	5.442635745157584
Encrypted:	false
SSDEEP:	192:4aGkse4MqKSfYXUzCpzXh7zXCQEwC8VwO6eIiF:4vkszMq9f+UYhXXXIMwO7
MD5:	7D1DFCEEDF1A2CA186E1BBC6244AC90C
SHA1:	9ECC40328270836E7AC5B0B8AB5BFCCEB032F514
SHA-256:	72185075843E0FFB205A62C6BA3DF8502605D197D5432C02D833D9E785B6F738
SHA-512:	24D2242CCCD73FA63605765C6EB7FE80B7053800632154B108D4198F3E3C263203E8ED9AFB38DB905F556E001544C76880A9DC757BC470D6A0BB236B4250F88B
Malicious:	false
Preview:	o....................................@....X...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.e...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.e.e.f...d e.d.e.f.d!d"..Z.dEd.e.d$e.d.e.f.d%d&..Z.d.e.d.e.f.d'd(..Z.d.e.d.e.f.d)d*..Z.d.e.d.d.f.d+d,..Z d.e.d-e.d.e.f.d.d/..Z!dEd.e.d-e.d0e.d.e.f.d1d2..Z"d.e.e.e.e#f...d.d.f.d3d4..Z$d.e.d.e.f.d5d6..Z%d.e.e.e.e#f...d.e.f.d7d8..Z&dFd:e.d;e.d<e.d.e.f.d=d>..Z'dGd.e.e.e.e#f...d?e.d@e.d;e.d<e.d.e.f.dAdB..Z(dHd.e.e.e.e#f...d?e.d@e.d;e.d.e.f.dCdD..Z)d.S.)I.........idnadata.....N....Union..Optional....intranges_contain..........xn--.....[....]c....................@........e.Z.d.Z.d.Z.d.S.)...IDNAError.7 Base exception for all IDNA-encoding related problems N....__name__..__module__..__qualname__..__doc__..r....r......idna\core.pyr...................r....c....................@...r....)...IDNABidiE

C:\Users\user\AppData\Local\Temp\_MEI69562\idna\idnadata.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	194369
Entropy (8bit):	3.5310331748993904
Encrypted:	false
SSDEEP:	1536:bISwp+QvEzfvw67AMlhwNODfUl/UXRD4RoC2Mo+4S+s8ecqmUM2UK+QQeky2uImd:bO+gErvw6rEEfUlT
MD5:	3D449981B56A483A40F7D1C1E4BA052D
SHA1:	C18AF5A09CF5A47A660FD393C05D479EE289AA5F
SHA-256:	18831714312BB425AE24B876CCBEAF6A99443F117EAC0F54C65E2C5BC027F8B8
SHA-512:	DCB1E8390092B71710D04F1021271265B5C4094E341A1AF055A6CA7A85A86A6F9B8BB510783C5A2877B062F98AEDA4927E6A2236D166C51093A510247E3008DC
Malicious:	false
Preview:	o....................................@....^\..d.Z.d.d.d.d.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d.....i.d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d2d...d3d...d4d...d5d...d6d...d7d...d8d...d9d...d:d.....i.d;d...d<d...d=d...d>d...d?d...d@d...dAd...dBd...dCd...dDd...dEd...dFd...dGd...dHd...dId...dJd...dKd.....i.dLd...dMd...dNd...dOd...dPd...dQd...dRd...dSd...dTd...dUd...dVd...dWd...dXd...dYd...dZd...d[d...d\d.....i.d]d...d^d...d_d...d`d...dad...dbd...dcd...ddd...ded...dfd...dgd...dhd...did...djd...dkd...dld...dmd.....i.dnd...dod...dpd...dqd...drd...dsd...dtd...dud...dvd...dwd...dxd...dyd...dzd...d{d...d\|d...d}d...d~d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.

C:\Users\user\AppData\Local\Temp\_MEI69562\idna\intranges.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1905
Entropy (8bit):	5.27322437942882
Encrypted:	false
SSDEEP:	48:gBrDo6ikRy/ORh77c2Nbzujn7iEs82GCE4:irc7kRA2NWz7jsw74
MD5:	14E57C95DF725B7E2A0C03EA133C617E
SHA1:	DB2D2A0656B367B0A6AFCE72B875011FFB2D9E87
SHA-256:	2B609289BC0EC849741F1426E646C555C8AA8B68A7C55C96A3C5F02508F4DC1A
SHA-512:	55B081CBCC86613CCCD7C3934221B5FA8DB5DE4E10AABB1FA0555BC6AF672935297155386D13628BA5EBC7042CE270C61C40205401B6C4248CC4D9E848EE0F2B
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.e.e...d.e.e.d.f...f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.d.e.e.d.f...d.e.f.d.d...Z.d.S.).......Given a list of integers, made up of (hopefully) a small number of long runs.of consecutive integers, compute a representation of the form.((start1, end1), (start2, end2) ...). Then answer the question "was x present.in the original list?" in time O(log(# runs)).......N....List..Tuple..list_..return.c....................C.......t.\|...}.g.}.d.}.t.t.\|.....D.]1}.\|.d...t.\|...k.r%\|.\|...\|.\|.d.....d...k.r%q.\|.\|.d...\|.d.......}.\|...t.\|.d...\|.d...d.........\|.}.q.t.\|...S.)......Represent a list of integers as a sequence of ranges:. ((start_0, end_0), (start_1, end_1), ...), such that the original. integers are exactly those x such that start_i <= x < end_i for some i... Ranges are encoded as single integers (start << 32 \| end), not as tuples.. ..........r........sorted..range..len..append.._e

C:\Users\user\AppData\Local\Temp\_MEI69562\idna\package_data.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.0971373314929185
Encrypted:	false
SSDEEP:	3:ztWluletlllzbkCohLYlDq/lQllZOmIOt2Tg/lX:gqet/OCof/lQ/wmpt2MV
MD5:	13BAC2F72EB90300A56739CC0AAD5DC3
SHA1:	F2EE674E34C54FA45131C725F0622CC33441A291
SHA-256:	10BE47459747CE44F132452A4451A5BE5C1282CA4524143BD028F47986934E64
SHA-512:	1E30D36A9C051E1D1DD6303F97B7046A0E5CB7EBF55FADCD9B16EECC93E06E20738CA99E3335AEB832ECD3DFDE46EC4EFE44F901A456C6EDD6E9CFD910E81F82
Malicious:	false
Preview:	o....................................@........d.Z.d.S.)...3.7N....__version__..r....r....z.idna\package_data.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\idna\uts46data.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	152297
Entropy (8bit):	4.538764427863341
Encrypted:	false
SSDEEP:	3072:u9UPwB58UYr7vSgVAYZRdSeWyqwSJVwf2gvEJdanqoK+:u9UPuY/vSIAIdvNSQfFM3aqc
MD5:	4B38FC16873001A3D1F5D0AD75B8821D
SHA1:	1F4DED5CE9CB77F5C3E5C4874D5F3E2B8DF72B51
SHA-256:	1F70EA6E10343D5BB774FAF6F61835C2D3A741532F49A1F52C8EAE2707B9873C
SHA-512:	D60E8A3FA80CF3C1DC2610FEE8EAF3B49373F0133C1167AC271EDFD9B4CFEAC0E0941E57BA6528D68F2B4FE50E486BD6C1DAFCBCD075ED52EE7187C3298BCCBD
Malicious:	false
Preview:	o....................................@....&...d.d.l.m.Z.m.Z.m.Z.....d.Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d.d...Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d d!..Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d"d#..Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d$d%..Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d&d'..Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d(d)..Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d*d+..Z.d.e.e.e.e.e.f...e.e.e.e.f...f.....f.d,d-..Z.d.e.

C:\Users\user\AppData\Local\Temp\_MEI69562\imp.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9766
Entropy (8bit):	5.475222149033371
Encrypted:	false
SSDEEP:	192:xRv7eT8ycSkV6hyhV0p+YVR7m/fbFHwRy26/2jSrhqSzcTF+jmBoWxpLN:xRvA8ycSkV6hyhV0Fd4f9wR76/5YSzs/
MD5:	894697409ED380488D5062C96AAAABC7
SHA1:	C77CA75B8456CF21F39F8CDFB2E812181AF5A49F
SHA-256:	947420C600526325DD0960362C0B0492EA303B9EFB050692826CEBEF83BFE352
SHA-512:	1B39E3D73B7EA3456FF2B479DC3212E4BB9CB46D6CDAA1644C2A27FE4C8B3313F65B9EDAE0534AAC217D700E2D1A58D02CDF801E3F35850FD78EC4840503A565
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y+......d.Z.Y.n.w.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.e.d.d.....d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.d...Z(d.d...Z)d.d...Zd8d.d...Z+d.d...Z,d.d...Z-G.d d!..d!..Z.G.d"d#..d#..Z/G.d$d%..d%e/e.j0..Z1d8d&d'..Z2G.d(d)..d)e/e...Z3d8dd+..Z4d,d-..Z5d.d/..Z6d8d0d1..Z7d2d3..Z8d4d5..Z9e.r.d8d6d7..Z:d.S.d.Z:d.S.)9..This module provides the components needed to build your own __import__.function. Undocumented functions are obsolete...In most cases it is preferred you consider using the importlib module's.functionality over this module............lock_held..acquire_lock..release_lock..get_frozen_object..is_frozen_package..init_frozen..is_builtin..is_frozen.._fix_co_filename....create_dynamicN...._ERR_MSG.._exec.._load.._builtin_from_name....SourcelessFileLoader....machinery....util..the imp module is

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3785
Entropy (8bit):	5.554601249604387
Encrypted:	false
SSDEEP:	96:JKEn4Gs1owkBni0MI4iEz6MfSxK1qWgme+eKZzmMcb8JHnO0:6/kolxTOK1/gme+DmMcbCHr
MD5:	AC454669E8F58E17481AD87E94F9C9D5
SHA1:	2CC8B76DC62269220D2737A752FCA036FCC8610A
SHA-256:	E05A163A71324BFFA044B2438EB95936230F35AE135D493BDD5520EF32BB88A3
SHA-512:	A8A020A906640FD736FC597D8C0C6D9D212B1B6FAE3FC5415FCC6C0B777E4AC2AE4EB78B2A5E8CCE2EE7B4B61E8F78551AB4C7E10E36EC9875FE3E588F592ADE
Malicious:	false
Preview:	o....................................@....T...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y)......d.d.l.m.Z...e...e.e.....Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.yB......Y.n.w.e.e.j.d.<.z.d.d.l.Z.W.n...e.ye......d.d.l.m.Z...e...e.....e.e._.Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.y~......Y.n.w.e.e.j.d.<.e.j.Z.e.j.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.i.Z.d.d...Z.d.S.)..'A pure Python implementation of import.....__import__..import_module..invalidate_caches..reload.....N........._bootstrap..importlib._bootstrap..importlib..__init__.py.._bootstrap.py...._bootstrap_external..importlib._bootstrap_external.._bootstrap_external.py..r....c....................C...."...t.j.D.].}.t.\|.d...r.\|.......q.d.S.)..mCall the invalidate_caches() method on all meta path finders stored in. sys.meta_path (where implemented).r....N....sys..meta_path..hasattrr........finder..r......importlib\__init__.pyr....A..................r....c....................C.......t.j.d.t.d.d.....z.t.j.\|...j.}.

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_abc.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1951
Entropy (8bit):	5.007132787657766
Encrypted:	false
SSDEEP:	48:gqJ7KXEXs7Xrqj9FwtLSVRiby/6FFongP:WEXcXrqhF+NFFsgP
MD5:	C480BC550B301471D9494A0B712D9ED0
SHA1:	B9355A8C3E51052FFA37101D88717375F7EE5F69
SHA-256:	F06D673E76D63926BDAD984BE5ADDCFC36416BEEEEC0E07181EE35E3A3234C69
SHA-512:	407EF37FB7B68242F24F9DBEEBED27CD8AA8817A866C0F852EEC9630E8921D2F5EC6382DED9F47FB53AC0658D942E9E2464C86CAFA5A644E97D624DE861698EA
Malicious:	false
Preview:	o....................................@....8...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.G.d.d...d.e.j.d...Z.d.S.)..>Subset of importlib.abc used to reduce importlib.util imports.........._bootstrap.....Nc....................@....(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Loader.'Abstract base class for import loaders.c....................C........d.S.)...Return a module to initialize and into which to load... This method should raise ImportError if anything prevents it. from creating a new module. It may return None to indicate. that the spec should create the new module.. N......self..specr....r......importlib\_abc.py..create_module.............Loader.create_modulec....................C........t.\|.d...s.t...t...\|.\|...S.).....Return the loaded module... The module must be added to sys.modules and have import-related. attributes set properly. The fullname is a str... ImportError is raised on failure... This method is deprecated in fa

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_adapters.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3663
Entropy (8bit):	4.687889515440956
Encrypted:	false
SSDEEP:	96:zdicL1cpDpGgN59yTEBW7nKo0fBPOjYMLq2:XLwDv9yaaOfklt
MD5:	E0A8DA7AC97B5303F518612BC7CE1DFF
SHA1:	B696F5F6F32056F6DABAEE8E30237BDC57453A59
SHA-256:	0958021A6C9B75DCCF7702DEE83E9A0F1FFFBBC9C4661E5AA00D8C9FEAE4F581
SHA-512:	774626058CAFAF15E47300F37E656F81492F4A22DB62EBBC10AEC8BD570D2A11812594B003F17D99345C6FEC3256C99C0C031837F8E93983AE4ED103110CDF5C
Malicious:	false
Preview:	o....................................@....N...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.S.)..........suppress.........abcc....................@....(...e.Z.d.Z.d.Z.d.d...f.d.d...Z.d.d...Z.d.S.)...SpecLoaderAdapter.>. Adapt a package spec to adapt the underlying loader.. c....................C........\|.j.S.).N....loader....spec..r......importlib\_adapters.py..<lambda>.............SpecLoaderAdapter.<lambda>c....................C........\|.\|._.\|.\|...\|._.d.S.).N..r....r........selfr......adapterr....r....r......__init__...............SpecLoaderAdapter.__init__c....................C........t.\|.j.\|...S.).N....getattrr......r......namer....r....r......__getattr__.............SpecLoaderAdapter.__getattr__N....__name__..__module__..__qualname__..__doc__r....r"...r....r....r....r....r.....................r....c....................@.... ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...TraversableResourcesLoader.9. Adapt a loader to provide TraversableResources..

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_bootstrap.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	30103
Entropy (8bit):	5.324774287211486
Encrypted:	false
SSDEEP:	768:Leidpi0Zj1GyOhZDKCICqI4sKCcm84thRVhG5ffbO8SoacSVAxpfPGdoDEPJb3qg:LeiHi0Zj1GbhZDKCpqI4sKCcm84thRVN
MD5:	68A70831F65F71A8D0C5F9094C1F4A9C
SHA1:	E87E71E719481D0538EFBD7D4713186CFEDD6113
SHA-256:	956A00159E63EC96950486804607CC86B0663BD968B0B725500DF65A07A01EEF
SHA-512:	2A40F96604CC87B1EFE299D180B3D025E2353239F91E946B7895202501A770C9A1769A526D3FBD67FD167970CDDB7C2F1C2D6D9278520A46610D5BC9FC367C37
Malicious:	false
Preview:	o....................................@........d.Z.d.d...Z.d.Z.d.Z.d.Z.d.a.d.d...Z.d.d...Z.i.Z.i.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.G.d"d#..d#..Z.d.d.d$..d%d&..Z.d`d'd(..Z.d)d..d+d,..Z.d-d...Z.d/d0..Z.d1d2..Z.d3d4..Z.d5d6..Z.d7d8..Z G.d9d:..d:..Z!G.d;d<..d<..Z"G.d=d>..d>..Z#d?d@..Z$dAdB..Z%dadCdD..Z&dEdF..Z'dGZ(e(dH..Z)dIdJ..Ze+..Z,dKdL..Z-dbdNdO..Z.d)dP..dQdR..Z/dSdT..Z0dcdVdW..Z1dXdY..Z2dZd[..Z3d\d]..Z4d^d_..Z5d.S.)d.S...Core implementation of import...This module is NOT meant to be directly imported! It has been designed such.that it can be bootstrapped into Python as the implementation of import. As.such it requires the injection of specific modules and attributes in order to.work. One should use importlib as the public-facing version of this module...c....................C....&...z.\|.j.W.S...t.y.......t.\|...j...Y.S.w.).N....__qualname__..AttributeError..type....obj..r......importlib\_bo

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_bootstrap_external.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	44247
Entropy (8bit):	5.4046731722430845
Encrypted:	false
SSDEEP:	768:+nGpGZAgJKhfXNf2HgfXBgNtsTruAqX2yRQyCQOqpOJVeLZBM6T:V4Z7AXNiOXB0sTruf2yCPmpOebh
MD5:	0BED73251F01DF9B6D17B589251EF476
SHA1:	DE7B72F4EFD7661212B8D0A2C3B1D06EC89E4C83
SHA-256:	65A616C19C279E97796A1A00C23C1A5481F200EB14702703F3CBE20ED26CAF75
SHA-512:	E81DC5D3A0496B45E294521BCC8D12439D6AB8C08283FECA1BF4117FD45C2FD54F4930FCB1A027C1CE5CFB46508D8761A1665573B5463F978AA9671542AC9DAE
Malicious:	false
Preview:	o....................................@........d.Z.d.a.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.Z.e.r(d.d.l.Z.d.d.l.Z.n.d.d.l.Z.e.r3d.d.g.Z.n.d.g.Z.e.d.d...e.D.....sAJ...e.d...Z.e.e...Z.d...e...Z.d.d...e.D...Z.d.Z.d.Z.e.e...Z.d.d...Z.e...Z.d.d...Z.d.d...Z.d.d...Z.e.rwd.d...Z.n.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d d!..Z!e.r.d"d#..Z"n.d$d#..Z"dpd&d'..Z#e$e#j%..Z&d(.'d)d..d+..Z(e).e(d*..Z+d,Z,d-Z-d.g.Z.e.r.e../d/....e..0..Z1d0g.Z2e2..Z3Z4dqd.d1..d2d3..Z5d4d5..Z6d6d7..Z7d8d9..Z8d:d;..Z9d<d=..Z:d>d?..Z;d@dA..Z<dBdC..Z=dDdE..Z>drdFdG..Z?dsdHdI..Z@dtdKdL..ZAdMdN..ZBeC..ZDdqd.eDdO..dPdQ..ZEG.dRdS..dS..ZFG.dTdU..dU..ZGG.dVdW..dWeG..ZHG.dXdY..dY..ZIG.dZd[..d[eIeH..ZJG.d\d]..d]eIeG..ZKG.d^d_..d_eIeG..ZLG.d`da..da..ZMG.dbdc..dc..ZNG.ddde..de..ZOG.dfdg..dg..ZPdqdhdi..ZQdjdk..ZRdldm..ZSdndo..ZTd.S.)u.^...Core implementation of path-based import...This module is NOT meant to be directly imported! It has been designed such.that it can be bootstrapped into Python as the implementation of i

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\_common.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.189550294114825
Encrypted:	false
SSDEEP:	48:gRfiZ38jH+kP4PY+IaYal2BG0ZLmISO4HftLblY2Dmy04COdjBkJIit3XJYOrb:ofipsH3AfYaliPZLzdy1lY2Sy04COdjy
MD5:	C6D9D06A58167F58E3D0B9D7D8C11C9D
SHA1:	2D84246377985EFBFA9672C3FB5B55E2304BE4D8
SHA-256:	8F3961C4928FE159ADDE3C588D99AAB12CB115E32FE8A6E419A4D63D6A77C259
SHA-512:	43E2DAB4363969FDC11A1F9734E645497B73A048F2DF8B9005E3519B7246123121F9166031D9D659A4A733082F6D71EE1F3789CC863E530C01E7CA08A4EFF4FD
Malicious:	false
Preview:	o....................................@........d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.e.j.e.f...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.d.e.j.d...d.d.....Z.e.j.d.d.....Z.e...e.j...e.j.d.d.......Z d.S.)......N....Union..Any..Optional.........ResourceReader..Traversable....wrap_specc....................C........t.t.\|.....S.)..3. Get a Traversable resource from a package. ....from_package..get_package....package..r......importlib\_common.py..files...........r....c....................C........t.\|...}.t.j...\|...\.}.}.\|.r.t.\|...d.......\|.S.)...Normalize a path by ensuring it is a string... If the resulting string contains path separators, an exception is raised.. .. must be only a file name....str..os..path..split..ValueError..r......str_path..parent..file_namer....r....r......normalize_path...................r%...c....................C....*...\|.j.}.t.\|.j.d.d...}.\|.d.u.r.d.S.\|.\|.j...S.)..?. Return

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\abc.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	15863
Entropy (8bit):	5.138957118323271
Encrypted:	false
SSDEEP:	384:SuXVbc37f/SM7n2JT3HxCuh51N3VRcaNaJlF3:Su7ldPaJlF3
MD5:	0F4003786E89A40F958407B1D49BC2C2
SHA1:	3EBAC11E3F5923F55190B65A1321728FE6A69901
SHA-256:	15B0053AF1B357080B9AF59C33CF1899B561B68339FEC093C2795130F91137D9
SHA-512:	67A6F0C8320A59FCA84BB280422BF5742B420159DD9D31339BA33A8EBBA14CFA5D55BA2B1076A6CD9F063264FCE195A286EE63EF62CC898EF6339FEE8BEBC893
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.y...Z...z.e.j.d.k.r"..d.Z.W.Y.d.Z.[.n.d.Z.[.w.w.z.d.d.l.Z.W.n...e.y@......e.Z.Y.n.w.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j.d...Z.G.d.d...d.e.j.d...Z.e.e.e.j.e.j.e.j.e.j.....G.d.d...d.e.j.d...Z.e.e.e.j.....G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.j.e.j.....G.d.d...d.e...Z.e.e.e.j ....G.d.d...d.e.j!e.e...Z!e.e!e.j"e.j#....G.d.d...d.e.j$e.e...Z$e.e$e.j"....G.d.d...d.e.j.d...Z%e.G.d.d ..d e.....Z&G.d!d"..d"e%..Z'd.S.)#.(Abstract base classes related to import.........._bootstrap_external....machinery.....N.._frozen_importlib....Loader....BinaryIO..Iterable..Text....Protocol..runtime_checkablec....................G....Z...\|.D.](}.\|...\|.....t.d.u.r*z.t.t.\|.j...}.W.n...t.y$......t.t.\|.j...}.Y.n.w.\|...\|.....q.d.S.).N....registerr......getattr..__name__..AttributeError.._frozen_importlib_external....abstract_cls..classes..cls..frozen_cls..r......importlib\abc.p

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\machinery.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.359548883449624
Encrypted:	false
SSDEEP:	12:geFOBAzUYcjBNEXHmE16MrGMNnGigQp/M4u0LIX7OujMvG94dS4UXwoaMX2emJWq:gyAjoXT16iGMJgQp/pAquYGXpXOjemT
MD5:	78019ADD00AAD6F338442037B213CDC2
SHA1:	E198C3DE39EC9B67727819ECBEC15E1A253158F3
SHA-256:	DA6568A758B870E82CD9B803F150C35F23435D5BD8A94389B67358CE33B96D1A
SHA-512:	14DB864A8C57F9FF079EC2A3014EA4EDC5BFD15B0FAFA6AC42BB2B84FE2602E85145CB7214C4BE7D52D41636839EB25DE7A0AB6196D4ED07B36C572770148BF3
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.S.)..9The machinery of importlib: finders, loaders, hooks, etc..........ModuleSpec....BuiltinImporter....FrozenImporter....SOURCE_SUFFIXES..DEBUG_BYTECODE_SUFFIXES..OPTIMIZED_BYTECODE_SUFFIXES..BYTECODE_SUFFIXES..EXTENSION_SUFFIXES....WindowsRegistryFinder....PathFinder....FileFinder....SourceFileLoader....SourcelessFileLoader....ExtensionFileLoaderc....................C........t.t...t...S.)..AReturns a list of all recognized module suffixes for this process..r....r....r......r....r......importlib\machinery.py..all_suffixes...........r!...N....__doc__.._bootstrapr....r....r......_bootstrap_externalr....r....r....r....r....r....r....r....r....r....r....r!...r....r....r....r .....<module>.................................

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\metadata\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	36989
Entropy (8bit):	5.282045392257558
Encrypted:	false
SSDEEP:	768:ShMiVxoBdnenUw5DJuV3Rc1F6apGtQo3N:ShzieUMDQaX6Qo3N
MD5:	CC7DC165ADFC8C49BAF8A5507B73BBF4
SHA1:	6FCDDDCF864B4153E95954C6D3E5A3BBDF109F51
SHA-256:	ED50161E9220C2D849CDBE7E4DDFCAAEDBA28B13236B67BFBE59713C50D17124
SHA-512:	08092498D61FC826A9BEA2662850E97EFE8A888F98972DFA00E7DDF9C0A4422AD8627DD0AADA9E4A0E40FFC13977BF48C4F185AD9838DA852F6450076F95FA36
Malicious:	false
Preview:	o....................................@.......d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N........._adapters.._meta....PackageMetadata....FreezableDefaultDict..Pair....method_cache..pass_none....unique_everseen..r......SimplePath....suppress....import_module....MetaPathFinder....starmap....List..Mapping..Optional..Union....Distribution..DistributionFinderr......PackageNotFoundError..

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\metadata\_adapters.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	5.173085518081959
Encrypted:	false
SSDEEP:	24:gU27mHvHJQK2QWSLAXNuU6/B2cR+mhPq5UHR+B0Uk5Cp2hbekeoJH2EmlU4vdyHo:gNuvHOKf0XzuDdq5UHsktB+ltERJ6yyP
MD5:	1484AC2570B5FE32C3FA947B6E63430E
SHA1:	8C630787D213DB2EC86ED4D957568B9AFCE33E2E
SHA-256:	ED6D71479464BF84B664C2776F6FD51F16D0C7E30224B0840943713DA43BB0EC
SHA-512:	874FD591BF013D7EDD64C37AF90AC37F83E51E72CB66AC2FC6920E0E70AC41F509E5ECDD7875BB966317AA5776BB84D8DB7408B8B8E4C1DE8A5C540E3FCDB5FE
Malicious:	false
Preview:	o....................................@....<...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j.j...Z.d.S.)......N.........FoldedCasec.........................b...e.Z.d.Z.e.e.e.g.d.......Z...d.e.j.j.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e.d.d.....Z.....Z.S.)...Message..Z.Classifierz.Obsoletes-DistZ.Platformz.Project-URLz.Provides-Distz.Provides-Extraz.Requires-Distz.Requires-Externalz.Supported-PlatformZ.Dynamic..origc........................."...t.....\|...}.t.\|.....t.\|.......\|.S.).N....super..__new__..vars..update....clsr......res....__class__....importlib\metadata\_adapters.pyr.....................Message.__new__c....................O........\|.....\|._.d.S.).N...._repair_headers.._headers....self..args..kwargsr....r....r......__init__#............Message.__init__c.............................t.......S.).N..r......__iter__..r....r....r....r....r&...'............Message.__iter__c.........................>...d.d.......f.d.d...t.\|...d...D...}.\|.j.r.\|...d.\|.....f.....\|.S.).Nc..........

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\metadata\_collections.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1499
Entropy (8bit):	5.003325690202918
Encrypted:	false
SSDEEP:	24:gJBf0kCRIJlLM8ZOSIJZUmh63uSpkTV1SPm0gIERV6kP8khkChHwjXo35:gJBf0XIJl4KOSI4mh6pmfSiI25RfhHwa
MD5:	5B51474A94E505A921C138E07113CB09
SHA1:	A539A8EBD1B9D4402101FE29ADAC93E8F1D07B99
SHA-256:	113AB19FE2392D74B61739991FCEFD98FE2B85637CA583FC64839ECE5E44688C
SHA-512:	C7C04FD3C2BCF430040FB5316A7C3A33007FB1B7CEA3269DF0857845E380E5F1A453E48B703075D8CC808413F6BE06F49CAD7411472956FAD438613145A257DB
Malicious:	false
Preview:	o....................................@....6...d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e...d.d.....Z.d.S.)......Nc.........................(...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.....Z.S.)...FreezableDefaultDict.!.... Often it is desirable to prevent the mutation of. a default dict after its initial construction, such. as to prevent mutation during iteration... >>> dd = FreezableDefaultDict(list). >>> dd[0].append('1'). >>> dd.freeze(). >>> dd[1]. []. >>> len(dd). 1. c.............................t.\|.d.t...j...\|...S.).N.._frozen....getattr..super..__missing__....self..key....__class__..."importlib\metadata\_collections.pyr................ FreezableDefaultDict.__missing__c...............................f.d.d....._.d.S.).Nc...................................S.).N....default_factory..r......r....r....r......<lambda>............-FreezableDefaultDict.freeze.<locals>.<lambda>..r....r....r....r....r......freeze.............FreezableDefaultDict.freeze....__name__..__mod

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\metadata\_functools.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3083
Entropy (8bit):	5.0948929952130255
Encrypted:	false
SSDEEP:	48:gTHbuTGKoOIXlUsSUUEQ1lGIGX5G5GurSYwBpHPdG7lfsJdSOTK/J/SarXN0le/B:poOCDUX4sXwjvMXNpaaAdzsOIN+Y
MD5:	6518164743DCE978B570667EC95D46F1
SHA1:	AF611765A96FDB20F6D4B7517B346A4AB2546460
SHA-256:	34548FAEEF3C7C002A595E1BD8FCAAEBE9226CDDC3EC79C569BAED7F675E94F3
SHA-512:	374F550D3F96077ECCB7CE8C92DAE961C7166C039EF5AE4366097BA0551A10603A409EE4B35CABB9C674177D8A142C95D19137B8368AA3FD707E859E1C7237EF
Malicious:	false
Preview:	o....................................@....&...d.d.l.Z.d.d.l.Z.d.d.d...Z.d.d...Z.d.S.)......Nc.........................(.....p.t...........f.d.d...}.d.d...\|._.\|.S.)..V.... Wrap lru_cache to support storing the cache data in the object instances... Abstracts the common paradigm where the method explicitly saves an. underscore-prefixed protected property on first call and returns that. subsequently... >>> class MyClass:. ... calls = 0. .... ... @method_cache. ... def method(self, value):. ... self.calls += 1. ... return value.. >>> a = MyClass(). >>> a.method(3). 3. >>> for x in range(75):. ... res = a.method(x). >>> a.calls. 75.. Note that the apparent behavior will be exactly like that of lru_cache. except that the cache is stored on each instance, so values in one. instance will not flush values from another, and when an instance is. deleted, so are the cached values for that instance...

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\metadata\_itertools.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	551
Entropy (8bit):	5.006679030903381
Encrypted:	false
SSDEEP:	12:g///Q8ZPVMOHRgD4gvwv3JLV0jysberVsoVzouf8Uxk:g3DPy+k4v3JgysbMyODJe
MD5:	05EC9E6F51C10721D8BFBE4BE8D1A375
SHA1:	04E420738E804C790D5D56CCE582E15F1140BDF5
SHA-256:	49624CFDF144526A77C8C66BAAC9ED0D3AA2FD2D3711EDC7DF7D996FE4A7150F
SHA-512:	F2CEAB9CC0E3334C5A9B92B3AD1A34688B65E9BAAC2FE363241AAE3CC34588B1904F564B5513F9DE2CBA5715A837AEEB45DCC4C9EB9EFDCFC2EFA2C685AAFE79
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.d.d...Z.d.S.)..........filterfalseNc....................c....f.....t...}.\|.j.}.\|.d.u.r.t.\|.j.\|...D.].}.\|.\|.....\|.V...q.d.S.\|.D.].}.\|.\|...}.\|.\|.v.r0\|.\|.....\|.V...q.d.S.)..HList unique elements, preserving order. Remember all elements ever seen.N....set..addr......__contains__....iterable..key..seen..seen_add..element..k..r..... importlib\metadata\_itertools.py..unique_everseen.......................................r......N....itertoolsr....r....r....r....r....r......<module>.............

C:\Users\user\AppData\Local\Temp\_MEI69562\importlib\metadata\_meta.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	4.71801737812113
Encrypted:	false
SSDEEP:	48:grgnzBuSdaPjUFvpujrJEZPmIMKeNJREz9dAEF0Vcc:MgNuaa7UBpujrJEhmIMKeNJCxdwN
MD5:	9E6F7972C0268DDDE21DCA9F49E4E1D5
SHA1:	5A141E1C2721C899DC4CE5C5CDBFE8A56F78709D
SHA-256:	D0783B243D0E76AB761966F4083F6FF15340FDDF2867007B10DA5DEE9213217F
SHA-512:	6E426B126866C0D39BC34AB030475482AD636C6999DA4D0403797371178A2FFEF0972B0A27F552BB38959EA0EA69B5192FFC986D57BA7DF3D84401D09E5B98F3
Malicious:	false
Preview:	o....................................@....P...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)..........Any..Dict..Iterator..List..Protocol..TypeVar..Union.._Tc....................@.......e.Z.d.Z.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e...f.d.d...Z.d.d.e.d.e.d.e.e.e...e.f...f.d.d...Z.e.d.e.e.e.e.e.e...f...f...f.d.d.....Z.d.S.)...PackageMetadata..returnc....................C........d.S.).N......selfr....r......importlib\metadata\_meta.py..__len__.............PackageMetadata.__len__..itemc....................C...r....).Nr......r....r....r....r....r......__contains__....r......PackageMetadata.__contains__..keyc....................C...r....).Nr......r....r....r....r....r......__getitem__....r......PackageMetadata.__getitem__c....................C...r....).Nr....r....r....r....r......__iter__....r......PackageMetadata.__iter__...name..failobjc....................C........d.S.)..P. Return all values associated with a possibly multi-valu

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1251.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.358948900439905
Encrypted:	false
SSDEEP:	24:CTHVBUlJvRj7SOVbusZhAMiZyi77qpREwKsF/+++SAJlz9aRme3cJI:wMlBVnrAMiwMmpKwKm/EYnsJI
MD5:	83DAF47FD1F87B7B1E9E086F14C39E5B
SHA1:	77AE330512EBFEF430A02213644BD1CFCE174298
SHA-256:	0AA66DFF8A7AE570FEE83A803F8F5391D9F0C9BD6311796592D9B6E8E36BE6FC
SHA-512:	D7CE2F44EDFE1DA6D3E07E9A41BB08AD42430BAAFADD09FD217F4B524323A01A1F4913B640C552D38AAEBFF75B0D50ED7A813A2A57C4019311158890C0162DF9
Malicious:	false
Preview:	# Encoding file: cp1251, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..04020403201A0453201E20262020202120AC203004092039040A040C040B040F..045220182019201C201D202220132014009821220459203A045A045C045B045F..00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407..00B000B104060456049100B500B600B704512116045400BB0458040504550457..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..043004310432043304340

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1252.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.292994562910468
Encrypted:	false
SSDEEP:	24:C4HVBUlJvRj7SOVbusZhAMiZyi77qdmV/rcwvGNNlkL+rSMH+tKv:rMlBVnrAMiwMmd2r/okLz0
MD5:	E9117326C06FEE02C478027CB625C7D8
SHA1:	2ED4092D573289925A5B71625CF43CC82B901DAF
SHA-256:	741859CF238C3A63BBB20EC6ED51E46451372BB221CFFF438297D261D0561C2E
SHA-512:	D0A39BC41ADC32F2F20B1A0EBAD33BF48DFA6ED5CC1D8F92700CDD431DB6C794C09D9F08BB5709B394ACF54116C3A1E060E2ABCC6B503E1501F8364D3EEBCD52
Malicious:	false
Preview:	# Encoding file: cp1252, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030016020390152008D017D008F..009020182019201C201D20222013201402DC21220161203A0153009D017E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300E40

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1253.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.422723556981327
Encrypted:	false
SSDEEP:	24:CRHVBUlJvRj7SOVbusZhAMiZyi77qduWn4T5K9QQSqiWeIDDdn:CMlBVnrAMiwMmduWnSKyQSqiWeIVn
MD5:	441B86A0DE77F25C91DF1CD4685F651D
SHA1:	D1E429916BC9423F55EEC8F17941521E9FE9D32B
SHA-256:	5B8D47451F847C1BDE12CACA3739CA29860553C0B6399EE990D51B26F9A69722
SHA-512:	35DF342DDA4E8790C6D53762465DF8B93B49B7B7E211D7A5753078EF559C9C9383EFF7285A90FF5C0020FBB16AF380EE3C8643F4CEB1E41917E72021079D722F
Malicious:	false
Preview:	# Encoding file: cp1253, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F..009020182019201C201D20222013201400982122009A203A009C009D009E009F..00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015..00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303B40

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1254.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.307590929679485
Encrypted:	false
SSDEEP:	24:CWHVBUlJvRj7SOVbusZhAMiZyi77qdjrcFvGNNlkBSMH+tA/b:lMlBVnrAMiwMmdjriokgzAD
MD5:	5FA9162BEC5A4DEA97B5EA2840CFB065
SHA1:	F26858E3D2FB928F39CA87CBB8446AF099570CAD
SHA-256:	31639CA96A4D3602D59BD012540FE179917E0561CB11A0D0B61F1B950EB76911
SHA-512:	3CE7BEABBE1A0CB946149D263D3317A8B791F6D72C49DEC4621E27F50CC359D8FA3EE97C03FF05D44E47DAA59DB87F219386467614B8B3FF8CC21AB3E3BED5E6
Malicious:	false
Preview:	# Encoding file: cp1254, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030016020390152008D008E008F..009020182019201C201D20222013201402DC21220161203A0153009D009E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300E40

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1255.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.3385880810272774
Encrypted:	false
SSDEEP:	24:CfHVBUlJvRj7SOVbusZhAMiZyi77qdIn2hEeGlRhv6Mw6Kcv:MMlBVnrAMiwMmdInSEdhvrj7
MD5:	6DEA4179969D6C81C66C3B0F91B39769
SHA1:	7E2722576BFFABC3258C5EDB2D99FA2468D6A4B0
SHA-256:	47576CAE321C80E69C7F35205639680BF28010111E86E228ED191B084FAC6B91
SHA-512:	91CC626B6454517F06FB3616E9ED623D1A2A4BFE74AFA9885F00F6AEC835D8825A5587091B9D9AB0E5ABDA291FA3FE7CE87E2618E21EB2974D9118AE27B8A2FF
Malicious:	false
Preview:	# Encoding file: cp1255, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F..009020182019201C201D20222013201402DC2122009A203A009C009D009E009F..00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF..05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF..05C005C105C205C305F005F105F205F305F40000000000000000000000000000..05D005D105D205D305D40

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1256.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.4033510023542655
Encrypted:	false
SSDEEP:	24:C0HVBUlJvRj7SOVbusZhAMiZyi77q30pPE7Lym4cwGm+AMZjyG/JQIG/Y:XMlBVnrAMiwMm30FQLym4ys6Jg/Y
MD5:	D50DFAFEE5C605C5C00A25A9EEE4D4CF
SHA1:	7D51BC17931D3D809716C06E7F07C6011286A144
SHA-256:	29340EA8E5AD3532BF67FA77CC852F055081B1238925CB109908AA72804CCC04
SHA-512:	D0A9B422A1061D6239E442767069B987E33239FCBA9BACE677923888F5F8BD1DCAABC71B83A985A0A86A15DCC44316781665BBFBF24558FCB94FDA6783285BCB
Malicious:	false
Preview:	# Encoding file: cp1256, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC067E201A0192201E20262020202102C62030067920390152068606980688..06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA..00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F..06C1062106220623062406250626062706280629062A062B062C062D062E062F..063006310632063306340635063600D7063706380639063A0640064106420643..00E0064400E2064506460

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1257.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.344584404753015
Encrypted:	false
SSDEEP:	24:CNHVBUlJvRj7SOVbusZhAMiZyi77q8uWTfNL4wIBUioGndt:uMlBVnrAMiwMm8uWJDNIt
MD5:	CC3D24543FDD4644BBBD4AAB30CA71BC
SHA1:	8E2658E7F782F005411BCB8423BDFC3C68BDED14
SHA-256:	C15AB85438728BF2C60D72B1A66AF80E8B1CE3CF5EB08BA6421FF1B2F73ACDF4
SHA-512:	5ECABF820098F7D24AB806ADD9CA3E1087C29914FB2DE6BA3DC656234202DE3FDF80A7E9ED433CCB2149FF07184F74884CEB37A1B689E9E0C1402916F3E13AFE
Malicious:	false
Preview:	# Encoding file: cp1257, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8..009020182019201C201D20222013201400982122009A203A009C00AF02DB009F..00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F0101010700E40

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp1258.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.2984943182702593
Encrypted:	false
SSDEEP:	24:CKlHVBUlJvRj7SOVbusZhAMiZyi77qdIQ2jFvGNNykoxWi3/i:xMlBVnrAMiwMmdIQufkoxn3q
MD5:	12BCEAE6B6A5FAE5AE9C42F5998BA485
SHA1:	C9620DA0C763D2C3770386E69EE7E421BD1BA965
SHA-256:	29D93DEE7C01B2264778BC6B75F6EF76EA6AC53E9F4A334D83707229E7F482D2
SHA-512:	714BAF58462FB0E84A32D82C8FC2D63EDF78DF8CCE578391E2521737F94F860B5CCFE41B481E1D09879A6811FCFD8B98A2724DB1D15749BD5293A9B33BCAD071
Malicious:	false
Preview:	# Encoding file: cp1258, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F..009020182019201C201D20222013201402DC2122009A203A0153009D009E0178..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF..011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF..00E000E100E2010300E40

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp437.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.515546664597914
Encrypted:	false
SSDEEP:	24:CFyHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBIqE18wDyV8mK:wyMlBVnrAMiwMm+VhE1LmK
MD5:	CE6D8A6542DC12D1783084FA4B2B63EA
SHA1:	5039A350C8E3E2C6F353B438B41BD0B6A7AB8069
SHA-256:	E5613C04D3D2EE44CCAD85AE53A37C257674491C540836E5D942BBCC4E4A8DB4
SHA-512:	E8C5CFB747486BBE0E567B6E87B59D5246D749A80C8F64F6669227C7FD849886F98A1F94451922AC099409AC14890F1A8B1E5F25EA584FDB1522ACE3AD0BE6A6
Malicious:	false
Preview:	# Encoding file: cp437, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp737.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.6177058818384693
Encrypted:	false
SSDEEP:	24:CjHVBUlJvRj7SOVbusZhAMiZyi77qSKOQFhWehDrq18wDyVKockoiH:WMlBVnrAMiwMmSKOQFhWeh3q1odH
MD5:	8EF3CBCA101F5777846D12D3C96A0A7D
SHA1:	5EC5418B861894E0F18EA15AA4414019815E2EA2
SHA-256:	A0415F14F5D72AD24E9C3A5C91517A0E3D22E1ADBC3505C0C6E918B961F7A07D
SHA-512:	FB14C88E61E5459B4A8706751D88D0A261AC6B4171F72912D87CE78A2BC97A821CCF5B53676FB229C08F9E557BE624F4DC649B722A906B9B7944ED2D5E7F9065
Malicious:	false
Preview:	# Encoding file: cp737, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..039103920393039403950396039703980399039A039B039C039D039E039F03A0..03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8..03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03C903AC03AD03AE03CA03

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp775.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.451057608106102
Encrypted:	false
SSDEEP:	24:CsOHVBUlJvRj7SOVbusZhAMiZyi77qoo9ecL067J4ZNUPVw3PfA:AMlBVnrAMiwMm59T067KDLPo
MD5:	9656761FA02EA24773EAD3E5C4BDB975
SHA1:	366228F25392708FA799E9CC0830CE9917EF6CA7
SHA-256:	C3C6542E902DEC2C44DDCFD8B5CB7ABF309B0413A7CED1614DC0B20CF7C5E35F
SHA-512:	A6A44B9A2193D75764DC284BE53264E57BFEB2A221FD54B4577DD90752F69A45E6B9D293108A7AB895F347A24FD10AAE84954A043AB1F466F485D707D7412380
Malicious:	false
Preview:	# Encoding file: cp775, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..010600FC00E9010100E4012300E501070142011301560157012B017900C400C5..00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4..0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB..259125922593250225240104010C01180116256325512557255D012E01602510..25142534252C251C2500253C0172016A255A25542569256625602550256C017D..0105010D01190117012F01610173016B017E2518250C25882584258C25902580..00D300DF014C014300F500

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp850.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.3718781469586827
Encrypted:	false
SSDEEP:	24:C9HVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBc+myS5LeQDTVwA:EMlBVnrAMiwMm+VeyS5SQn/
MD5:	2169EE726DCC011E6C3505D586C88FC3
SHA1:	094252AD0634787E2D7F0D28A448437054D359C7
SHA-256:	13DF611F429A9B331DA1B34F3C718CCCAF0BD4AB44F71A9C632197987B4D643B
SHA-512:	BC5831EF1C131095A22C76FFCB5C4217081AF796B60455BE2DE2E2689CFE1033F07E8B45449F77E7804A7D52CBCFB916B0B4639828E65B14475BB3367F47C8EE
Malicious:	false
Preview:	# Encoding file: cp850, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192..00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp852.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.4509005787389877
Encrypted:	false
SSDEEP:	24:CPHVBUlJvRj7SOVbusZhAMiZyi77q7EUsOtycwQIc+922V:mMlBVnrAMiwMmwvOtycwQIc+9R
MD5:	48402B424B5101BDEEB0192BBA96DB7D
SHA1:	C9EB93A37AF70F4134AA9CF05D914A30FB3201DD
SHA-256:	F3A18A8C7934F6586F023477E08D3F9D5EAD9A45E9E58A3F8D018AF9BB13F868
SHA-512:	4EE615605BFF3D94A7FC4FE23D8288F0F20F6792C8C69ECACABAE82F1A334D8417C5DFFC0DA3702E2DB09B7BE1E5FF19C6A0F460C9A5EC84D1856BB9C8061CA5
Malicious:	false
Preview:	# Encoding file: cp852, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106..00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D..00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB..2591259225932502252400C100C2011A015E256325512557255D017B017C2510..25142534252C251C2500253C01020103255A25542569256625602550256C00A4..01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580..00D300DF00D40143014401

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp855.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.4277025591531864
Encrypted:	false
SSDEEP:	24:CoHVBUlJvRj7SOVbusZhAMiZyi77qLHVWjwk/rMZC032SLnD2JbD:hMlBVnrAMiwMmx8whM03VLDy
MD5:	8B8AA56F83BA750EB73FAE542E76FF1A
SHA1:	2F3C3BA4B854A7D6B0A3D27BC519EE66A042E05A
SHA-256:	E64FD2E639DA6F654D9BFBB2266F9432259A6A55941622F5CDDC3797E382EB0A
SHA-512:	8B4061176663F7AC01B3969D25F680B5870A8EAD864CFAD897F18E75409CE721E6CC367A88EBABAF72E77D4542EE1894F2A6EE47A43FB3D4C650CFA18DFD3D71
Malicious:	false
Preview:	# Encoding file: cp855, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0452040204530403045104010454040404550405045604060457040704580408..04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A..0430041004310411044604260434041404350415044404240433041300AB00BB..259125922593250225240445042504380418256325512557255D043904192510..25142534252C251C2500253C043A041A255A25542569256625602550256C00A4..043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580..042F044004200441042104

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp857.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.364496856690505
Encrypted:	false
SSDEEP:	24:CaHVBUlJvRj7SOVbusZhAMiZyi77qZpu6uUV5Dw5LeBCVHjzA:jMlBVnrAMiwMmyUVFw5SYdI
MD5:	BA52A031DE1B1A6ED1C41BED8946750C
SHA1:	BD54C0E2F62FD36675892A61FD8B340A56845D20
SHA-256:	B6CD5C6F2B54D89142679D599ED0A5DEE6955A3B3F6B6673E46AFE7A5A303CDC
SHA-512:	5F915AABE39F31CE9337B4B9B0239DF8ADA898D2D9F111DD09D97689DB89CF45B093AC187FC28484CFB213D14B0D8F58C5668D0A59726282D6F52D5D24697816
Malicious:	false
Preview:	# Encoding file: cp857, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5..00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F..00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp860.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.506813480871637
Encrypted:	false
SSDEEP:	24:CMHVBUlJvRj7SOVbusZhAMiZyi77qij4Axlt49Y18wDyV8mK:VMlBVnrAMiwMm/g+9Y1LmK
MD5:	C416471B57FB894DC45D30C31B4BD2E2
SHA1:	BA378F8122280992AE51245A06814D8155564220
SHA-256:	804EFA345C5BBBAD2449C318A7A3F5B31F4234712AAD23DC49B3FB5AA33B7A57
SHA-512:	E7CDE706CFE573525C2DE319AD5783AE9D97C4F6D28B14A77A729F281540B0DAFAD4C14879EF76473BFDEBC38499C65CA228470983F2D1BC31938A91A2486522
Malicious:	false
Preview:	# Encoding file: cp860, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2..00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3..00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp861.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5174672833207183
Encrypted:	false
SSDEEP:	24:ClHVBUlJvRj7SOVbusZhAMiZyi77qZpORVPnA2Gm18wDyV8mK:8MlBVnrAMiwMmiVPAA1LmK
MD5:	4997979FD1692063E2B9AA9870E0BE4C
SHA1:	919012354B99BBEF4C85517E89A2C9CD340FCE49
SHA-256:	4B7E76AEB75289FACA76434EA6E9874E9504AD2BC3D8D47550EADBCC8294857E
SHA-512:	C122A1AE2DE79CB97E5989535B7478A76D905CDE60B01F80F5B84EDB9DF08BE6829E1811AF19608971DA048B8DA24F40DE0217A8054AC612EC2D8B3560500FBE
Malicious:	false
Preview:	# Encoding file: cp861, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5..00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192..00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp862.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5573268031592717
Encrypted:	false
SSDEEP:	24:CdMHVBUlJvRj7SOVbusZhAMiZyi77q36AqE18wDyV8mK:iMMlBVnrAMiwMmq3E1LmK
MD5:	9B4D1B95B20BD67555517DCC3007B22A
SHA1:	2C0D6121DB49CDAB6FBAA81398BE2E44BE4E1110
SHA-256:	6C15CB256B1C22170292589C6F589E64E164EB36EC7E84F0BD48149BABB7C5FC
SHA-512:	34C3E401364D579E8AC7A4E1F1F7A29A84C62E1D5146D7664832639EA3997227DC4BAF1B64DC605E6574D680E61B55D0C69C329E35B1BEC41501FC68C5B634B7
Malicious:	false
Preview:	# Encoding file: cp862, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF..05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp863.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.518080906819747
Encrypted:	false
SSDEEP:	24:CXHVBUlJvRj7SOVbusZhAMiZyi77qwGuXVFq5EC18wDyV8mK:eMlBVnrAMiwMmw3VFu1LmK
MD5:	C93CCDF65F7F349F22855745660F02AE
SHA1:	604888B1FB3C57DF47277CDD1153597BA89E8C36
SHA-256:	232D6FE34D7151920232EAAE9C515F36400AB64136DCC5B802D6245AC6F5D56B
SHA-512:	D5B65AE7353F694A37AF29177BF1A95477918FC5A002C2FE199624BD5B391698807BAECF54225BC40F62B3CA7912C7066A4AAF01B9E3E399133831CAA342BF4F
Malicious:	false
Preview:	# Encoding file: cp863, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7..00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192..00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp864.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.72017408907567
Encrypted:	false
SSDEEP:	24:CwHVBUlJvRj7YOVbusZhAMiZyi77qcHj92OibcDQAyUjSG:5MlrVnrAMiwMmSsNcDQvcSG
MD5:	146E0D1779D50E070E0EF875E8374DF8
SHA1:	B51E5598712598BC387DD79AE80BD879F139140D
SHA-256:	81BEBFD9A61E9F17495763B68D57742FAB2A1A43871015699A2C8E5FDED4EC19
SHA-512:	1F0DAD8E77712C5A018894332BE72FF5C546C92F481421CCB8553AD6F1E9A18617765C8CEE4187265CCCB1AB073E221289D34C9AB1F0501231D52C81FC1C932B
Malicious:	false
Preview:	# Encoding file: cp864, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00200021002200230024066A0026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00B000B72219221A259225002502253C2524252C251C25342510250C25142518..03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F..00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5..0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F..00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9..FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9..0640FED3FED7FEDBFEDFFE

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp865.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5193842128126676
Encrypted:	false
SSDEEP:	24:CsKHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBnAFj18wDyV8mK:gMlBVnrAMiwMm+VRAFj1LmK
MD5:	150B2E00B3F84F8075F3653ED7A4C8E0
SHA1:	7131DC656EFE1F2277B19DA72F0EEB46B4EC54A0
SHA-256:	ADA1A52064EE93EBE6F8A5D101D01F8776038E12F21A5CA1C006EE833577C705
SHA-512:	AC56EEB0220826BF8FF6CA52768DB63961AAC46095A2F3EEBA11B5973CC92AF52DFBBE9E85A0DD04CAB8998212FA2599EDD83BAAA7FB2D394E330FF2F7C015DB
Malicious:	false
Preview:	# Encoding file: cp865, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp866.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5038992968715266
Encrypted:	false
SSDEEP:	24:CCHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9aRme3cB18wDyVNZkR:bMlBVnrAMiwMm8YnsB1wZy
MD5:	FC33B5F773E87696A69E8798446E9772
SHA1:	4FC5589C1DD88BB8171758BC173A63B3A5687AE5
SHA-256:	32A45DEBA933C7ED99141535087A4C99BA79802175E3F762ACA6EB941157F85A
SHA-512:	332D2FEC532192F58F792441E61D675A8692C36BECF768D07F64B8C31561CC1A2DF402625A4719E758A9B59DE4228FFE9F94F067E7DC0D82F9DA2D6500E50304
Malicious:	false
Preview:	# Encoding file: cp866, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..0440044104420443044404

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp869.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5261138894265507
Encrypted:	false
SSDEEP:	24:CtHVBUlJvRj7SOVbusZhAMiZyi77qii+lh2o5+hdVMQFhWgCDrKE:EMlBVnrAMiwMmXY2o5+hdVMQFhWf3f
MD5:	4A2C66AA630D4AE2BF1E7546DCE2DAE5
SHA1:	FABB672957D21CA2B4E0EACA5FCE6093BAACF77A
SHA-256:	AFE6ED6EB5D07C45B6B928A48BC5EF57EFCF61602D36FF9FBDE4A8EA3FA6DF75
SHA-512:	A548002EB7AF8735DBBBCC9883B44B326F261C02A3C7CE65C373755DD92212A66740112EAE0FC556CAD5B86911709C6DF12167DC5B6AD1E01C6F1EB5AB16DB37
Malicious:	false
Preview:	# Encoding file: cp869, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850386008700B700AC00A620182019038820150389..038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF..03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB..25912592259325022524039A039B039C039D256325512557255D039E039F2510..25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3..03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580..03B603B703B803B903BA03

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp874.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.33737382140564
Encrypted:	false
SSDEEP:	24:CSyHVBUlJvRj7SOVbusZhAMiZyi77qVQEHmEU4AyqU+TWwdd:CMlBVnrAMiwMmWr4AyqUSd
MD5:	FC8C876B4738236FC71A1AF96E4566D0
SHA1:	DDFDC3F62D99A6BD705CF0719B50F66449C8808A
SHA-256:	4F05F31CA026BBFEEEE49ED86504CB060784137A9CFAE0E5954D276E837AB5DE
SHA-512:	5BF58A810E029840825FFF3318E90415E6F2B7E46032FD428B4971923D41A64C127A6F438E4894E80EC9604CD34F1D47B4F9A02ABAB3E7D6351611811DC1F2B9
Malicious:	false
Preview:	# Encoding file: cp874, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC008100820083008420260086008700880089008A008B008C008D008E008F..009020182019201C201D20222013201400980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E440E

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp932.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49008
Entropy (8bit):	3.5144574650895364
Encrypted:	false
SSDEEP:	768:R/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSY83+JRS:RVUidzJCurDGSYvW
MD5:	EF4508C84A025095B183E6BAD67B1ECD
SHA1:	D12D5381D50D578AA8687671DC542C462A7F490D
SHA-256:	6D1B512110BEAF2CD1296AC878F51D567848AB4A1CED4F18C72806BB136B3D23
SHA-512:	E695E7E6F4A11D5E8D62982E26B69B87DB2F1F3D6B6DCCD5F1DF51879F5C4533265CBD7B785E1F2652D8CA3FC913D4F862E7575F67C636314A6E6956FD96E023
Malicious:	false
Preview:	# Encoding file: cp932, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp936.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	134671
Entropy (8bit):	3.5217328918779645
Encrypted:	false
SSDEEP:	1536:+CwDua7D90Jz1aDJmnMfEGniOQdH6prJs3inqlW6/t9Qwf+zCt5:j1WVRpe3rpt9hf+Gt5
MD5:	CF9CFD6329A4FB6C402052B9417DAC3A
SHA1:	75CE13FE1E5898D47B67F951C0C228851F1CC04D
SHA-256:	B6EC2BE0504CA62B9D1B6857F6BAA13FFAC5A567D4432F4EAB98ADC830F5D9C3
SHA-512:	7E19607EEA5342ECFE92D56DAAE82827DE147AE5AFDA8E9D67FD0970F528902CDE20A8A07CF2F341B926E59BB4FF792872976F1C7C5CD351959A71A8B6A1924A
Malicious:	false
Preview:	# Encoding file: cp936, multi-byte..M..003F 0 127..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp949.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132551
Entropy (8bit):	3.100976362851161
Encrypted:	false
SSDEEP:	1536:2UO8ecy5KnSMsDlOmNpkQ4oQHnTApv+ngLbiyEY:2U/etc/sBRZp//r
MD5:	03E19A4DE3490A7DC50D04EC1F558835
SHA1:	9DFECAE08C98109EAA358F5920AED647888F722B
SHA-256:	477F8B79B67F4A22C963EE65B9B387DBD8E4B8F62D800B0A51D2276580C6ADBB
SHA-512:	7D6AD30AF75A3AA6332A860C6ABF87BF725EB6B4AF3B37699043A10EF3235471C63D0ECB4D437D5AD9438DF5DA646EB55117A9BB8B55EF6868F71E49035C18B7
Malicious:	false
Preview:	# Encoding file: cp949, multi-byte..M..003F 0 125..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\cp950.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93330
Entropy (8bit):	3.319807723045599
Encrypted:	false
SSDEEP:	768:aAHU3LIkZlmXrd/uQ0ao98ggKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fW:aVduBGf9PgFMT6q95GDRBfW
MD5:	1D84B025DAB127F2073947D764D307B6
SHA1:	4E3D3CBD96D084836F1FE6F2AA497E3FAA463B9B
SHA-256:	F80E05533D1A1494C32F9412E9AD2D9C11FAF9AE0668A6F9D1FA5CEEDC6870E2
SHA-512:	188D649F9717F20524AFF47F85C3B23AEC3E7825BF54975285D06C17587D581DC24A3F6A7CAB1703DE7AD5521FE2FE2572DE627A81E6A48049A47BB219ED4AF8
Malicious:	false
Preview:	# Encoding file: cp950, multi-byte..M..003F 0 88..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\dingbats.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	3.7780987266961663
Encrypted:	false
SSDEEP:	24:vJMHkUlJvRjmf9RCsUBOdXsCbbNviANpk3m1XFAoE4xSF5HrBPkdn:vKvlA9RCs6CXrViAN51XFA9eSvdPKn
MD5:	90FE0C57BBC6C2D8A3324DEB7FD45F3D
SHA1:	06B95BE43E4C859A0F1B01384EDD26500C6C1F9E
SHA-256:	EB9B262E4D179268E6F017C0D4EF0E7034E31A5B4893595D150640CA1F6A1C45
SHA-512:	6A5E67D9F3EC6046C42793E1437B8A6E50EBD72D8EC67FEFEB6DAD6FAB6A5B5C74F939363587D5A6529E217AF54FB8A9CF0F768E114DD931C57887451CACE56E
Malicious:	false
Preview:	# Encoding file: dingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A327A

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\ebcdic.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	3.0039861897954805
Encrypted:	false
SSDEEP:	24:XXBcIhJZDgEoQkNCGz0Jyh9lZk3Vmd2QhZLXPiALV3d:dTcNCJEhfZk3Vzox/iqVN
MD5:	F7B3771D43BDE6AFF897683BED2FE6AD
SHA1:	E70C2C0902413536CB6163752D70F3AE4AF6A967
SHA-256:	165BE658AB7D61FFC3DF1E2F1438C2F9FCEE6808A756316302157F44E6D3ACD7
SHA-512:	F87DC718EB2DD95237B144FDA090BB636121B9479E492AC94E4F7EBDD88171F070B9E9F6165BDA7B7E2BA2A3E6188B1108D8F91AA5F142CCCFDAD317628DD941
Malicious:	false
Preview:	S..006F 0 1..00..0000000100020003008500090086007F0087008D008E000B000C000D000E000F..0010001100120013008F000A0008009700180019009C009D001C001D001E001F..0080008100820083008400920017001B00880089008A008B008C000500060007..0090009100160093009400950096000400980099009A009B00140015009E001A..002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C..002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F..002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F..00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022..00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1..00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4..00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE..00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7..00F900410042004300440045004600470048004900AD00F400F600F200F300F5..00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF..00D900F70053005400550056005700580059005A00B200D400D600D200D

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\euc-cn.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	86971
Entropy (8bit):	2.3925661740847697
Encrypted:	false
SSDEEP:	768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
MD5:	C5AA0D11439E0F7682DAE39445F5DAB4
SHA1:	73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
SHA-256:	1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
SHA-512:	EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\euc-jp.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	83890
Entropy (8bit):	2.350315390677456
Encrypted:	false
SSDEEP:	768:2GhX8nuQ635vlHptHzh0abNQPQA0OMS2HhFV3:2GikvRpMuNQ4P73
MD5:	F2DE0AE66A4E5DD51CC64B08D3709AAB
SHA1:	97558A51A6DD6C56FC7A42A4204141A5639021FD
SHA-256:	A3C916BA16BCAC9FAA5A1CCC62ACA61452D581CD8BA3EE07EC39122C697274C9
SHA-512:	0EAA90100527FF150D2653D7BB57647D69E592BE53B714DDD867114CFCC71E3A76882772F4FAECE040DF09FA8971D1C22DECC497E589B4CA827A6890497A48D9
Malicious:	false
Preview:	# Encoding file: euc-jp, multi-byte..M..003F 0 79..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D0000008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\euc-kr.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	95451
Entropy (8bit):	2.4080588863614136
Encrypted:	false
SSDEEP:	768:4/vO7UlClqAd8XfpUqv+mCoKRuLbtMjnIxz0DY:4nO4N9fpv+ngLbiyEY
MD5:	103843B3A57168BD574F6CACC550D439
SHA1:	982652EA2B0DCFBB55970E019A4EDFBFCFAF9C24
SHA-256:	5448643398685456A11CBB93AF2321F70B8659E2FFF3CCC534B4D53BD2F38C89
SHA-512:	27A8DE6F97DB4A96E5D0132692A32A99DAB8A6C98973A0C4E50A219F2D2F364E63D657E5E8478B2706CA33C45C376F55B5BFCC9459E06AEA88BFCD4F0E32525C
Malicious:	false
Preview:	# Encoding file: euc-kr, multi-byte..M..003F 0 90..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\gb12345.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88033
Entropy (8bit):	2.3790651802316996
Encrypted:	false
SSDEEP:	768:o4Is/C+0IwpRK1CkinIKUyNiNBzxOC4T/:LIsR0/RKckiIgNiDtOxT
MD5:	1A8E55DEA98B6D5EAC731ED233D3AD7C
SHA1:	1335FC0FC2AAE7E7F5EC42AC17A4168368B4A64D
SHA-256:	B4894AEDD2D5B5AE54B6D2840F7C89A88E9308EFD288F179E65936E172EF4B0D
SHA-512:	9DDCE366BA1196EB9FB913ACFDE8516BC9BB8D51894866D2E7E8CB313DC4D6C6D33C5A9E78142E83594DC423D10DA6F8DE211E69844B939198BC7DB9AED808F0
Malicious:	false
Preview:	# Encoding file: gb12345, double-byte..D..233F 0 83..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\gb1988.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.270324851474969
Encrypted:	false
SSDEEP:	24:qrmHVBUlJvRj76OVbusZhAMiZyi77qN8VmKfkiJt0RMFS:qSMlZVnrAMiwMmNPYPFS
MD5:	D06664ACAA478BDEB42B63941109A4E3
SHA1:	4A6196FCC1BDE988C1A23EAA69745A9979F1AEFF
SHA-256:	ACD50951F81566C8D823670F9957B2479102EB5AE4CF558453E1D8436A9E31FF
SHA-512:	CB51A36B851FFDB5C6F9B9D0333EEA6A14CEF3796E0A60530198C16999D64E638047E873333630360299C9126F79CEDDA2D9F169028CED1FC04B1D3C55FFFC5B
Malicious:	false
Preview:	# Encoding file: gb1988, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..002000210022002300A500250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\gb2312-raw.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	85912
Entropy (8bit):	2.3945751552930936
Encrypted:	false
SSDEEP:	768:D47/S+i8vdx3Tz+hpHcBrQqKtrebjMIGCx8jE:0c873T6DHcBrbKtrVlE
MD5:	9357E05C74D6A124825F46A42B280C14
SHA1:	E5106ABE12D991AFE514F41E3B9E239202A4ADFE
SHA-256:	C445E4C9F676AE997D2DDA2BBC107B746F3547D85F39479951C56F46275EE355
SHA-512:	B2187D70A92FB38572BA46F3C3443233BEED1A4ABBFBA1B860F4BBAE6B3D8C16B8C9F52A20DAA12B2B8B40972E52F816860427B743530177E4CF0D8BA34EF381
Malicious:	false
Preview:	# Encoding file: gb2312, double-byte..D..233F 0 81..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\gb2312.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	86971
Entropy (8bit):	2.3925661740847697
Encrypted:	false
SSDEEP:	768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
MD5:	C5AA0D11439E0F7682DAE39445F5DAB4
SHA1:	73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
SHA-256:	1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
SHA-512:	EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso2022-jp.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.949409835601965
Encrypted:	false
SSDEEP:	3:SOd5MNXVSVLqRIBXS4ovLE9sDXMVyXK9ow1Deq9Ts5dRPMSXcRA0kcR4X9cL+TXI:SVNFS0oyisLMsXK9okTw/BDSVKNw
MD5:	D3AC33390D31705FA4486D0B455247DF
SHA1:	2EE8613DC04A6FA84AB38FD5F3A2AA3FE330625B
SHA-256:	98074C85650A420A095ADA9138DA3A8A0AA4027BE47EA1E97A596F319EB084E9
SHA-512:	CB265B753C84968E2D1D6E706906DA9A7BB796D08F626290BCCA8F089771AFD176A9DC912773E8BA390D2AEC08592AD535C7D254E1DF92CF04848601481D4EFE
Malicious:	false
Preview:	# Encoding file: iso2022-jp, escape-driven..E..name..iso2022-jp..init..{}..final..{}..ascii..\x1b(B..jis0201..\x1b(J..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso2022-kr.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.978693690727393
Encrypted:	false
SSDEEP:	3:SOd5MNXVTEXIBXS4ovLE9sDXNvdwUHEQwqc6XWxVUNOov:SVNFSoyisL/Zzc6mYNHv
MD5:	057CB0AA9872AC3910184F67AC6621BC
SHA1:	BBA47F9D76B6690C282724C3423BD94E2C320A04
SHA-256:	234811FC8B0F8FF2B847D9CC3982F1699DF1D21A43C74DCE45BA855D22520007
SHA-512:	019F187D2D16FB51BF627ACB7E67778857E56D4C160E0E5ACA6ABC05EC5FDB624CE2715CB9E0DAD73BFF9D697982BE0D539BC55BCCD368FC7C8EE0FFC04E9F61
Malicious:	false
Preview:	# Encoding file: iso2022-kr, escape-driven..E..name..iso2022-kr..init..\x1b$)C..final..{}..iso8859-1.\x0f..ksc5601..\x0e..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso2022.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.95909788984399
Encrypted:	false
SSDEEP:	6:SVNFUXoyisLNcs9ozc6W4Twk0sRBDSVKN6tWIHRy:oUYcLNcTzczbwRYRy
MD5:	BB186D4BE3FA67DD3E2DEE82DD8BD628
SHA1:	93CE8627038780CFFF8C06E746DD5FB2B041115C
SHA-256:	741B4C842557EED2952936204D0AE9C35FA3A0F02F826D94C50C46976291797C
SHA-512:	4921E7AA3DB8E33609603FE129B97275DFF80CFB06648D2068FA7950246C67B9B530B74827638F69F4DFB8F55CDD4AA952EA72EAEB6ABB527D52F20C6B46FB51
Malicious:	false
Preview:	# Encoding file: iso2022, escape-driven..E..name..iso2022..init..{}..final..{}..iso8859-1.\x1b(B..jis0201..\x1b(J..gb1988..\x1b(T..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..jis0208..\x1b&@\x1b$B..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-1.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.236046263464657
Encrypted:	false
SSDEEP:	24:iyHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkL+rSMH+tKv:iyMlBVnrAMiwMmTmokLz0
MD5:	3538A970CD098BF5CE59005FE87B6626
SHA1:	285A96CC40D7CCE104FB4B407C7F0C400AA8F9CB
SHA-256:	A9CB4F4CA111608F882729BC5EB1C2F15530C515EF02DD2CA62F2D8DC5A210CF
SHA-512:	A6A6F2D8B5C22E240D195D168A604887062508FF3340D24E13BFCBD6C2E687347F2CFE724FA2ED12F36915B55EE2CFD901EC3F08E2B0A2FFD3BC2A98BBD12A50
Malicious:	false
Preview:	# Encoding file: iso8859-1, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-10.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.319750415373386
Encrypted:	false
SSDEEP:	24:jHVBUlJvRj7SOVbusZhAMiZyi77qimXG2yM6q7KytC:jMlBVnrAMiwMmTXG2gytC
MD5:	CBDE40170FECD2496A9DA3CF770FAB7B
SHA1:	3E1D74DF6AFEB6CDE8ECBDAC8F81F2F9C64150DE
SHA-256:	48F4A239C25354F0E9F83A39F15D4632BB18A9C33E60C671C67307159917ECED
SHA-512:	A26B56A4CFE29E5A0A0B3A55283A7767397693388E2DEEC342C69B6F718FAE2407EB8D5ADE538FAE6947CBB8B052943C3A52F2D046ABAC7A3DAA86D730DC293F
Malicious:	false
Preview:	# Encoding file: iso8859-10, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A..00B0010501130123012B0129013700B7013C011101610167017E2015016B014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF..00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF..010100E100E200E30

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-11.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3206399689840476
Encrypted:	false
SSDEEP:	24:6HVBUlJvRj7SOVbusZhAMiZyi77qimwHmEU4AyqU+TWwdd:6MlBVnrAMiwMmTf4AyqUSd
MD5:	E2A0BCB83BFC3F435CDCFC20D5CF2E0C
SHA1:	CFD18B5B5DB4EE46E63D912B8FD66D513C4C8D39
SHA-256:	21E769C5A66E4D12D6E7DB24022E92AF1EC0D0331FE3C8C605654F239C0F3640
SHA-512:	C86F9180F2F4A177F1EA10E26B0903ABEAFDDE0317C332A48F8D1BB586DAC91C68800E2E4FA2CD739C435419B106CBA4BEFC049F2BCD720E9FC2C0AE8436CFAC
Malicious:	false
Preview:	# Encoding file: iso8859-11, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-13.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.338879965076632
Encrypted:	false
SSDEEP:	24:olHVBUlJvRj7SOVbusZhAMiZyi77qim2w4kBUioGnd2:olMlBVnrAMiwMmT/WNI2
MD5:	21CEBB723D47B1450A7FB21A82470B97
SHA1:	A40FD3AFE1ECE89E3F682D527D281BC563DB3892
SHA-256:	3271D39D7B4DCD841E8E5D5153D1B8837718B88FEFEC73DC37D314816EEFE5E5
SHA-512:	3A0E033A4D93C679215F672C6C4FE425D63E1DE157AA671E7400639165EC3EB498E4EEB030D6FB8FF8BE2FD8C986D341036A8CED9FA094D092CF2822D5DC065B
Malicious:	false
Preview:	# Encoding file: iso8859-13, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F010101070

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-14.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3670559016263915
Encrypted:	false
SSDEEP:	24:vHVBUlJvRj7SOVbusZhAMiZyi77qimhw6COlk1fKMH+tiH:vMlBVnrAMiwMmT/tlkQz0
MD5:	FDAA88946DE4EB4E6D37F2B6AFCF6CAF
SHA1:	56FC4773941E7457EA04EDA92C883642DE45D100
SHA-256:	F0A5675027FB1CA34B4E4128D24C2968CD275890569A32A86AFA4994CE4983E0
SHA-512:	92658A6FEB42A41B3CFFC377C4A9A3F6780A79FC596D3FEDBA6D3B3D75A9F40E859A2CE8DC579A278BAEEDEEFA2408E2B7853D99D5C2D14AACF63C521FE2BB86
Malicious:	false
Preview:	# Encoding file: iso8859-14, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178..1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF..00E000E100E200E30

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-15.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.260398494526282
Encrypted:	false
SSDEEP:	24:mHVBUlJvRj7SOVbusZhAMiZyi77qimmRf4kL+rSMH+tKv:mMlBVnrAMiwMmTmCkLz0
MD5:	D779D5E2A0083C616A226B2D82ABF0EB
SHA1:	D1657DB5E2989EBA80BAB98A1E1217CFFFBB19DB
SHA-256:	C74E8E23A0FF0D5DEA7C318CA20DC817DA4E57B0DD61B3361FC0D5098A9316FE
SHA-512:	26E62BE8AE793ED3B725BF0D1BABF4D6ED63A6F3772ABD48955FC4394BDE5A47614D1FF89A21A828676BF1302F3C9361B557B0FBF0DF8561FB7E66542FE94CDC
Malicious:	false
Preview:	# Encoding file: iso8859-15, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF..00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E30

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-16.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3065938185320918
Encrypted:	false
SSDEEP:	24:dHVBUlJvRj7SOVbusZhAMiZyi77qim0SmmPkYTtyL:dMlBVnrAMiwMmTttPkYpyL
MD5:	74FDEDDAF670023DA7751FB321E345A0
SHA1:	0677FED67C1333A9A74D50642E5214701A57E2AF
SHA-256:	640D977EC1D22B555C5075798DA009E3523E8F55F29BE22A3050CD1B4EF7B80E
SHA-512:	AC02FD95159A856A9DDEF4E6A8216B958DC07311B553FF39403DC5B77E1AFF2A2C4C03F5F26A2BB7AD5DB6800BEE03E895554556DBBFBE89426286796ADE55AC
Malicious:	false
Preview:	# Encoding file: iso8859-16, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B..00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C..00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF..0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF..00E000E100E201030

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-2.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.340505173539446
Encrypted:	false
SSDEEP:	24:UHVBUlJvRj7SOVbusZhAMiZyi77qim/ssm5VO6ys2K:UMlBVnrAMiwMmT/ssYTys2K
MD5:	9B87850646FFE79F3C8001CBCB5BB3A1
SHA1:	8F97576F3FB3B5DBEF71DC2C9314AB5E530974D6
SHA-256:	76949B03F57041B07F41902BD7505AB3594D79AA8F7BDEED5F0481004B10CBC3
SHA-512:	101A28AF0799E7E0A5723E5DD76D5EF0FEEF584AC479A88F499CB3B7D2AA93767D72F8E51C76F7547F08FF8DD3CBBA7FF444BD07F99A92755526E75C596109EF
Malicious:	false
Preview:	# Encoding file: iso8859-2, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B..00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-3.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.2507537230559977
Encrypted:	false
SSDEEP:	24:tHVBUlJvRj7SOVbusZhAMiZyi77qimw2g0kgTJMkFtoD:tMlBVnrAMiwMmTo0kgTJDoD
MD5:	CBD0B9CDCD9BC3D5F2429A760CF98D2F
SHA1:	6DEF0343E0357E0671002A5D2F0BFC2E00C8BCF9
SHA-256:	1F51E7BDA64D466C16FEE9A120BBE3353A10CEB9DAB119FFA326779BA78D8C5D
SHA-512:	88DB6D23B53F4A78133C794ED42FA3F29A4ABAD35DE4B022040FA187AA59B00664CC13F47AFF4507D72F4CB2166F026144213EE760AB0FD67CDD2FA5906F434A
Malicious:	false
Preview:	# Encoding file: iso8859-3, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B..00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C..00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF..000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF..00E000E100E2000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-4.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.3413832766873073
Encrypted:	false
SSDEEP:	24:KHVBUlJvRj7SOVbusZhAMiZyi77qimX4AsD/njR7Ky8hA:KMlBVnrAMiwMmTXBs3EyuA
MD5:	8B620EDECAC2DF15A024C2CE15FB64A5
SHA1:	65C5EE5D08964E37393E6A78ABA0DB16D51240E2
SHA-256:	66B3CF994F0B5E0103D13E812958320AFB555C91E3F81B579D4CBF231E6A0805
SHA-512:	93391325405D3AEA0A913F5EA8EA0391920D10F234C26AB1DA70992702889A3AF7B85E11A1FCA554690942B238CE313DD460798E59C5B1F4069036E7B0F24F44
Malicious:	false
Preview:	# Encoding file: iso8859-4, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF..00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A..01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF..010100E100E200E300

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-5.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.342721205983665
Encrypted:	false
SSDEEP:	24:zHVBUlJvRj7SOVbusZhAMiZyi77qimq5+SAJlz9aRme3cJbx:zMlBVnrAMiwMmTqeYnsJbx
MD5:	6FBEFDC3DEC612B7B2CC903D8C53F45B
SHA1:	14EC3C166DC411149C32C262DBE8E327F6186669
SHA-256:	3130BF26DA0C840C1E02203A90C3B1C38966FB203130E2FBB3DD7CB3865A3539
SHA-512:	F3F15AD8B6C9D9B4C9C994FE3235B4463E59BE7DCE79CF3F7AA77905D6F4DC2C4AABB79B440767DB13D357B13F09EA34983FCA7BC92D0AFA15FB6CBEDDD04E38
Malicious:	false
Preview:	# Encoding file: iso8859-5, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0040104020403040404050406040704080409040A040B040C00AD040E040F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..044004410442044304

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-6.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	2.992219341429816
Encrypted:	false
SSDEEP:	24:YHVBUlJvRj7SOVbusZhAMiZyi77qimEZjyG/KE:YMlBVnrAMiwMmTEs6KE
MD5:	52F025D943A45EE840D9C3DFD06E4D79
SHA1:	571EA14B49FA6150BFD2ABA79E52799955D9FA10
SHA-256:	CB71909BF01A3A7A4C7396359DA06D206B58A42AD68192CE37169D6640D46E13
SHA-512:	77FF9DC785A63CA59A7D58BB25C7D2C16F364E525F9B939177385EF80F7DE37734C8774F1BC829CF0270FD66257A4D31689654C8037DB0A86A0291FFDE637B90
Malicious:	false
Preview:	# Encoding file: iso8859-6, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000000000000000A40000000000000000000000000000060C00AD00000000..00000000000000000000000000000000000000000000061B000000000000061F..0000062106220623062406250626062706280629062A062B062C062D062E062F..0630063106320633063406350636063706380639063A00000000000000000000..064006410642064306

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-7.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.393893260854861
Encrypted:	false
SSDEEP:	24:TMyHVBUlJvRj7SOVbusZhAMiZyi77qim2OBHK9QQSqiWeIDDdn:TlMlBVnrAMiwMmT1hKyQSqiWeIVn
MD5:	4BFB0A35D971A9D4C5EA8D8099E93C37
SHA1:	8FED2CBB1343E5B4442748242B5F89A76110592D
SHA-256:	76F6BC85FC9CB89BC3F94D36275AB23C740BA17FD36EC8907479DA3A885415EA
SHA-512:	C9CE1E9EA57A1DEF62BBC60A115C06325C6EE8F92021695459E1ADAF1193A559BC5F0229191BFC2E344296DC137583ED4A9A61A65890F99F4CF97B3864C7AF0F
Malicious:	false
Preview:	# Encoding file: iso8859-7, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A02018201900A320AC20AF00A600A700A800A9037A00AB00AC00AD00002015..00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-8.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.0494739426493567
Encrypted:	false
SSDEEP:	24:uHVBUlJvRj7SOVbusZhAMiZyi77qimieGlnvs26Kcv:uMlBVnrAMiwMmTirv87
MD5:	5F69EAF54E7A1E8AC81C9E734DBE90D8
SHA1:	BA509C88A4FC03922EF5CDC887FAA7B594A9BC5A
SHA-256:	865E3665743B5FABA3E1AD6AA55515A666BD05DA6266879D9B66C98905DAFF3C
SHA-512:	D9924FBE59CB571AF721CA602DBE58CAD0D9310610EDF544F8FC0FBF3D1CE4E99597D0198E4E7C802107012786346FE4C1B9C6C3A76D5F60B9A83981B0EDA24D
Malicious:	false
Preview:	# Encoding file: iso8859-8, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000002017..05D005D105D205D305

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\iso8859-9.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.2591070910715714
Encrypted:	false
SSDEEP:	24:XHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkBSMH+tA/b:XMlBVnrAMiwMmTmokgzAD
MD5:	0B99E605E73B7D8DEFD8D643F5729748
SHA1:	F30E7CCBCD9C539126E8D6CA0886E4B2BD54E05D
SHA-256:	CF51E867DDE2F19553D98FEEC45A075C4B4F480FB1EDADB3D8DAD1EBEA9299F3
SHA-512:	DA0487CD7F2143195E80697C17FFDB61AFD464C888DDF84813B2B5D1BAB24D96466DA7A7F77C8E4A9D0D53F34D72928923380AFC1B92A96C0A3BFF46006A4E19
Malicious:	false
Preview:	# Encoding file: iso8859-9, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\jis0201.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.2708615484795676
Encrypted:	false
SSDEEP:	24:zBHVBUlJvRj7SOVbusZhAMiZyi77qN8VmKfkiJt0RMFS:zBMlBVnrAMiwMmNPYPFS
MD5:	4E21F24F8D9CC5DF16B29CACD997AC69
SHA1:	064E723EFB82EF1C303E5267496304288821E404
SHA-256:	61B14A7C312366F79BB45F02C6B7EE362E6F51CBAD5E479E563C7F7E785DB654
SHA-512:	AF8FAEB47EFB51F2537139F7C4254ABED119E477FD2B5E83B90B7A903B43C4E02DDF43A7DDB044A0A9601E9F9ADE91B02EE7C0EC87FF5DDCF9951B9601A90435
Malicious:	false
Preview:	# Encoding file: jis0201, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..00000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\jis0208.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	81772
Entropy (8bit):	2.3571626869060776
Encrypted:	false
SSDEEP:	768:AigXM6CwL/9pV7Hl6+Yko9gZxErA3/MS/8xqg8:AZ/tp1Hl2KZxUfr8
MD5:	F0661E22C7455994AA1F6EC1EDA401B4
SHA1:	928B2AC46A9FDE61A81F56BE225E6138B40C22E5
SHA-256:	F6B1C6AC5F5FC4E990A7A1AAC16A406012040936431BEFE7D2B6CD1DA9E422C4
SHA-512:	917CC58678A9E9F5CBE860D30828846ABA4EA8CDFAB7DD1AE6A66C47ECBB85CF67DD97BC3E6F95341DD30F4E757B2CEA571708D5B4CED18A29F19904C3138AE0
Malicious:	false
Preview:	# Encoding file: jis0208, double-byte..D..2129 0 77..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8..FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F..FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D..FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7..00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5..FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\jis0212.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72133
Entropy (8bit):	2.3455261548208055
Encrypted:	false
SSDEEP:	768:9F/D7CH2puD5CdzU3nAkP5dHn7s391fmOarFaVQ:H/D7CHbozU3nAk3H7sXm3FgQ
MD5:	07CE2C135BE17DBAFA558AA5949A53DB
SHA1:	5D9DBEFCCB44E76C1A4E61360C6FCED8DCC8EF4D
SHA-256:	785CFC5F5D9CB06DB8061730AB0016A0F70D0B59F6787D2A3CBB8D5779C99706
SHA-512:	E954D7198D58ACEDEB4C8E5F466107767C3DA43763A5F6CDDFCF567226F9B22B4C2DE27564F28CD125D7F1BA7CB9C6DE6DEC4065EC2676572C793BE458FDDD9D
Malicious:	false
Preview:	# Encoding file: jis0212, double-byte..D..2244 0 68..22..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000000000000000000000000000000000000000002D8..02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000..0000000000A100A600BF00000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000BA00AA00A900AE2122..00A4211600000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\koi8-r.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.531149521168141
Encrypted:	false
SSDEEP:	24:KcJ5mHVBUlJvRj7SOVbusZhAMiZyi77qpSzIa9qVRS3YcEchJh3MAxSl:KmmMlBVnrAMiwMmAzIxVgBE6cAxQ
MD5:	96F54CC639ACA8E466FB8058144C9350
SHA1:	0B9530D6080F2BAACABD5AA0D48BFF316FCCEF64
SHA-256:	0E43244BFC4F33FACB844B9E00270A1A4C24DC59B8A9B95104E2D788BB2F59FD
SHA-512:	5B7859325E5E34C9D4558B1198795BB9C6A8EF783EB97193EA80BA76C38AFE9BDD1B526B77401DF5456B7A0E85E942191FFD4B4F2B9F0C8168A7093EE452802E
Malicious:	false
Preview:	# Encoding file: koi8-r, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204512553255425552556255725582559255A255B255C255D255E..255F25602561040125622563256425652566256725682569256A256B256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\koi8-u.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.5076564572101714
Encrypted:	false
SSDEEP:	24:K+HVBUlJvRj7SOVbusZhAMiZyi77qpSzIaU3dmVRS3YcEchJh3MAxSl:K+MlBVnrAMiwMmAzI/EVgBE6cAxQ
MD5:	4B755EF2288DFC4009759F8935479D68
SHA1:	C3BDF0D9DF316DE8919DAA4329275C5AA81D61B4
SHA-256:	ED04D5B977B8C8944D8760B713FF061292DA5634BCBB67CDFB1C3A6FF5378C81
SHA-512:	3F1E1CC47327054FB9C54157ED10514230F10BFCD4BD9FDAFA02D7B238137DC7442CA2661B0739D8EEA3181E187D3B639A2C8118A0DE272C96000908121B6CFB
Malicious:	false
Preview:	# Encoding file: koi8-u, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204510454255404560457255725582559255A255B0491255D255E..255F25602561040104032563040604072566256725682569256A0490256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\ksc5601.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94393
Entropy (8bit):	2.4104200953565513
Encrypted:	false
SSDEEP:	768:XbjO7Uw6uKdosXRxps9a+ut/BmZPwkpT9A0T03o:XfO4ZBRxpV+4wPwKloo
MD5:	366C09E4A4CC10006E593F5B3F3461D7
SHA1:	A0DABFBEEB66E26FB342844EA41772D7A1D19C24
SHA-256:	9B27FE7E7054F36E279993F19E52E18AC03360D117AE80C42B4E984A97C590AA
SHA-512:	670F32D698C7992038E736D3AD40098D8589C0C5A1379E32A0F02A02FAF251B1312CAD131DDADC3F80B23A3821A91689F2E310309028BDDDF227D532EB505A20
Malicious:	false
Preview:	# Encoding file: ksc5601, double-byte..D..233F 0 89..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300200B72025202600A8300300AD20152225FF3C223C20182019..201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7..00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640..222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6..25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D..221D2235222B222C2208220B2286228722822283222A222922272228FFE20000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macCentEuro.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.4295694929963667
Encrypted:	false
SSDEEP:	24:8jHVBUlJvRj7SOVbusZhAMiZyi77qHVPJSf2FcVDu1LEe4qPPMl2J89:8jMlBVnrAMiwMmHEmJ4IMgi9
MD5:	10850BCFB943318284D6191494EBD7D5
SHA1:	237D5DDF7969A422991F17021244D13A2BB0DE92
SHA-256:	81ECA6840B87F2DEF9FCDD171A55C2D71A49386D88401CE927AE57D7DDD7AAAA
SHA-512:	D797781C228B70D2D83DB8ABA08F840CE49846C9473CC89A2E316900D9E08A63142E68AD9ABBB2EF67BF9F1D392772FAB36CCC09632022A1437AE27C11F2284F
Malicious:	false
Preview:	# Encoding file: macCentEuro, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179..017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC..202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E..012F012A22642265012B0136220222110142013B013C013D013E0139013A0145..0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C..20132014201C201D2018201900F725CA014D0154015501582039203A01590156..01570160201A201E

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macCroatian.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.3992482002374516
Encrypted:	false
SSDEEP:	24:8ULyHVBUlJvRj7SOVbusZhAMiZyi77qsTMdKxOZwwL+KR5D/jlJy6QWky:8ULyMlBVnrAMiwMmOsL+KR5DblE85
MD5:	A60FBDE33D13C732095713D1AB6713AB
SHA1:	4B0EB443F2D0E4B8DB7D0435F9311E5F9A625123
SHA-256:	BBE6F5EBB5EAB08C91DF7D524FAF39B03AA8B9F84C67ABA0553A84EC56668CB9
SHA-512:	3EEBA6BA3FCD875AFBD5DF41EDC21E872416A48D03343232904CC99CAF913045DAF7B1A1ACD0949EF794AD7B6C9AE8F93808423FFC4B67718E732B2FF5D9B6D7
Malicious:	false
Preview:	# Encoding file: macCroatian, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8..221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8..00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153..01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB..201300B7201A201E

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macCyrillic.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.4178221849964903
Encrypted:	false
SSDEEP:	24:8dHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJY:8dMlBVnrAMiwMm8Y6zUk+UVsJY
MD5:	C390D66441AC61CCF0A685CA5EE0BC1C
SHA1:	FCAE825B54400B9D736EF22A613E359E3F0FA6C2
SHA-256:	76EFE571ADDA7AED467F146CB0BD3A2351F2A720508EA0642C419F5347789CAA
SHA-512:	C891DB15E0F600965885DE6745EDD2A4E3A6A20CA30A9AAE89CBD8C429F8455C4AF7F2FC053FB3D730D8544AB6A6E78E769DB93DAD7B29868B746FA10373F021
Malicious:	false
Preview:	# Encoding file: macCyrillic, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..0430043104320433

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macDingbats.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.870022681111701
Encrypted:	false
SSDEEP:	24:87JMHkUlJvRjmf9RCsUBOdXsCbbNviANpkDP1XFAoE4xSF5HrBPkdn:87KvlA9RCs6CXrViANUP1XFA9eSvdPKn
MD5:	DCE78527E3A7B7CB1DE9EE5FAF12AFC6
SHA1:	20F4A3F4DB6B3422C04EBB6B21A568E4C173F9C1
SHA-256:	062E31D48DC33160999074E49205E08C3655DFF91C2C87F254522E6EBCE2DD96
SHA-512:	627F5FD2F12B341F2D7EE9032946FE057C4AC74D99687178CEA98B3E150307BB6AA2495B0FA46400760D467E2BF589BE31E998E25CE1D1E8465DA61F22047345
Malicious:	false
Preview:	# Encoding file: macDingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A3

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macGreek.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	3.4954458011071323
Encrypted:	false
SSDEEP:	24:8dOHVBUlJvRj7SOVbusZhAMiZyi77qJlbaBMD2aSY5us36Ekp1ysOSU2imR:8kMlBVnrAMiwMm7aKPVusqx1ysOJjmR
MD5:	0CC92F685A4132BE4B030006670D81CE
SHA1:	13B1074A90055E9EA061A6206A9C004DA29967A9
SHA-256:	1AABE561B5C944ABD11C293D4ACAC0F3A4A5A9E84A0342D066F4E3E992348895
SHA-512:	E1AF3D47D681CD68B6063DEC1241631CABE86FE835232FA73D855AC74D0175540D46511282BE7198A67A37970A5D05CDECF55C10424ED9C1413C108F116094D9
Malicious:	false
Preview:	# Encoding file: macGreek, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8..00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC..2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7..039100B12264226500A503920395039603970399039A039C03A603AB03A803A9..03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153..20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F..03CD03B103B203C803B

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macIceland.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3991839018654573
Encrypted:	false
SSDEEP:	24:8KHVBUlJvRj7SOVbusZhAMiZyi77qscqMVmOZmk/LYRldjY/g4JyMWG:8KMlBVnrAMiwMmzqi/LYRlYBEXG
MD5:	747ADBE54D6992467415E322326FA1B9
SHA1:	5E3967B5DDF3A6DBF07E90ED6B9B9C2F3F3F35FE
SHA-256:	6FD08CE6FBA521D51E8058DE5C2DBD6583B80306A8BE7D015361F76314E70A35
SHA-512:	A04B946993985BF1F8FBA3A7A9AD3838F43F8F27F69B1FB1015D9DC8612AAFCE24E30CBC1FCABBDFB359FD487D51F70F18DA0CDA4A87749A2C82309CEB054849
Malicious:	false
Preview:	# Encoding file: macIceland, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE..00FD00B7201A201E2

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macJapan.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48813
Entropy (8bit):	3.3767502114972077
Encrypted:	false
SSDEEP:	768:K/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSJi:KVUidzJCurDGSk
MD5:	3DCD22325E0194AAD4959C939B1DE24D
SHA1:	ABEF1372FBDA83714CE29E015D9A198D4B37B21C
SHA-256:	47007D9EBF4D34C6CE3599E50AFC7C1CF8129B88994DE2C2A857C09003F9CD2B
SHA-512:	B8ADFD2315EA38E5F7D4DED219759380069AAB539F1B5AAA5626CE32428CBBEB5E8215AD8351E023BCF72FA4DC30AB40CF59D6D45E33B6D1A6B41BEBFD4BD4C2
Malicious:	false
Preview:	# Encoding file: macJapan, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macRoman.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	3.4060725247347516
Encrypted:	false
SSDEEP:	24:8THVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldjBpmg4JyMWG:8TMlBVnrAMiwMmOi/LYRlTsBEXG
MD5:	34691FADC788B85D98F63159640C7DD0
SHA1:	C8B3D084D3E831EFF6ECEF71B2029545F214C3D4
SHA-256:	C83D971D6BC0284EF323C197896E38C57A5FF44784E451EC2997EDA70C0DD85C
SHA-512:	77D5676F9B7AF7FD1D612A1C426889D8F2C0191887E180B78C4AA42202928A1B3078B76BD3C5F5ABB2A5CE1AE913E3CA6EFDE0483D2A2B0EFC173EF25EAE1D67
Malicious:	false
Preview:	# Encoding file: macRoman, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02..202100B7201A201E203

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macRomania.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.412326247178521
Encrypted:	false
SSDEEP:	24:8tHVBUlJvRj7SOVbusZhAMiZyi77qsTMVZ5OZwYRldj/T9g4JyMWG:8tMlBVnrAMiwMmOA7YRlFT9BEXG
MD5:	04E25073BFB0019D8381B72F7B433F00
SHA1:	B63B0AD9F10A44B0DDD12A3BDBCDEB2992D6D385
SHA-256:	0B805DAF21D37D702617A8C72C7345F857695108D905FF378791F291CEA150F0
SHA-512:	0514EC054676C15C65B01B02747CDBAD79BC89FD1A24A17797A8729752FB748FEDBE920E7BBFF41A6DA4BA99002E3B8DB674D53E30485DC36F6BF737EAF11702
Malicious:	false
Preview:	# Encoding file: macRomania, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E..221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163..202100B7201A201E2

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macThai.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.6062142626989004
Encrypted:	false
SSDEEP:	24:88HVBUlJvRj7SOVbusZhAMiZyi77qqJipJwHmEU4AyqU+TpH:88MlBVnrAMiwMmqJ8Jf4AyqUe
MD5:	06DC6BA6E4A75CD7FF2D7A4248912C61
SHA1:	23FB16763A8F11EF48E805E4F453C2F812D48FC4
SHA-256:	A1802A2FEB01B255EC7C17425EEE4525372DF8CE226F4047D149172EB438F913
SHA-512:	41A487EC5C36C17B2746C5DC770882A836E6E75CF6A14C31595EB211022F0476BD3B953497C447F21554769F127C3A56E5B6EF8FB3C20A8AFF8C67E0CC94359D
Malicious:	false
Preview:	# Encoding file: macThai, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899..FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F..0E400E410E420E430E44

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macTurkish.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.422718883614008
Encrypted:	false
SSDEEP:	24:8QjHVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldD8g4JyS:88MlBVnrAMiwMmOi/LYRlWBES
MD5:	4EA94A0DB35BED2081A2CC9D627A8180
SHA1:	AB2AC3ADA19F3F656780FF876D5B536A8DCE92C6
SHA-256:	AFB66138EBE9B87D8B070FE3B6E7D1A05ED508571E9E5B166C3314069D59B4E4
SHA-512:	7888F560D3728732BE1B7DCE49ECB61F3399CEF11191F4116C891E1D147B2A90ED8FB4A5E7B51904A001C47750BD9EB1B15EA5BA5B4EC5D69CDE7704B69529AD
Malicious:	false
Preview:	# Encoding file: macTurkish, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F..202100B7201A201E2

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\macUkraine.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.4157626428238723
Encrypted:	false
SSDEEP:	24:8TzHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJd:8PMlBVnrAMiwMm8Y6zUk+UVsJd
MD5:	A5B48D6F2678579CBE6EA094A4655071
SHA1:	A13A41D530B21CE8443AFD7E811286537C5BA9C7
SHA-256:	F7E11736C9FF30102B31EC72272754110193B347433F4B364921E8F131C92BF0
SHA-512:	612F9D528CE940B5CA9E67CB127013A104655207511F4CF39C8696A127E6A8F4867F5603DCFB78C25A55668C6EE70F2997A8D1626F6F1DD44B19260967F17097
Malicious:	false
Preview:	# Encoding file: macUkraine, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..04300431043204330

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\shiftjis.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42552
Entropy (8bit):	3.5565924983274857
Encrypted:	false
SSDEEP:	768:w/RPrUHiJrwWkyY/W2wHiwWnwWOORY+gutSX:wVUid5JCurDGSX
MD5:	EEB45AF9D7104872FE290D1EC18AB169
SHA1:	A80CF4EA46301F0B8B4F0BC306270D7103753871
SHA-256:	4A15ED210126BCDAE32543F60EB1A0677F985F32D49FCE923B9FAE8C5BCF3DA4
SHA-512:	C359042B04441AA50E536B23EEA0C6C7B2C1893DFB9CDB5459D3B46945D3BB50FD7A32A4F4E26A83622E76D3D2BB0DBBC3D1F3FB87AAF40520A243165B82AB34
Malicious:	false
Preview:	# Encoding file: shiftjis, multi-byte..M..003F 0 40..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086008700000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\symbol.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.73983895892791
Encrypted:	false
SSDEEP:	24:SdHkUlJvRjvRV7ZQsoRmSds2AsSemxUs+Jw1Viv6ObTXyn:avlJV7ZQsoRmosGSPxU/JOm6wTXyn
MD5:	D59E748D863A5FAEF0CEEC2564E041A3
SHA1:	4FFF3BE37F50C090FFC581F1C7769E20281E90C3
SHA-256:	9660537A7B62996478555C6F57C1962C78FB3972F19370B2E395C44842818A1F
SHA-512:	BF8FD0CF1CC55564C46976F53F441B26819ADBA7AB7BB04FF3FF5A313366FC3049DF29A839CCCB05EDEF4A7ECBB49FFCA62518EDA90AF2D7781874A8435073AE
Malicious:	false
Preview:	# Encoding file: symbol, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002122000023220300250026220D002800292217002B002C2212002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..22450391039203A70394039503A603930397039903D1039A039B039C039D039F..03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F..F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF..03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..000003D2203222642044221E0192266326662665266021942190219121922193..00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5..21352111211C21182297229522052229222A2283228722842282228622082209..2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3..22C42329F8E8F8E9F8EA2

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\encoding\tis-620.enc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.0553142874336943
Encrypted:	false
SSDEEP:	24:ZlHVBUlJvRj7SOVbusZhAMiZyi77qsDHmEU4AyqU+TWwdd:PMlBVnrAMiwMmss4AyqUSd
MD5:	467A67DE6809B796B914F5BFF98EF46D
SHA1:	C62418071A6C9CB0DCE3F67E130BFD2FB7AB0B58
SHA-256:	50B62381D6EDD4219F4292BFDC365954491B23360DE7C08033E7218A3D29C970
SHA-512:	BF98305AA7D759A087B9EABDC404714D8DC6B4F1BEED4ED0E1FFE646641E1AECA307673D64CF95FD09546D977B3409D6C04F56DCCA1D6332B0D9B6DD460B77A9
Malicious:	false
Preview:	# Encoding file: tis-620, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E44

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\history.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8235
Entropy (8bit):	4.855903177272536
Encrypted:	false
SSDEEP:	192:Hf8PxPu7pUHBpqyzmY5rEk/fvs+AokFlTGHts1H/tsEGZPBtsLIVn++G:H6Pu7ELJTtyli8Ozz+L
MD5:	8609B624CD3EC63DD02DBF89455C3A9B
SHA1:	B3E1843E34C38AA668FFDDF435A1A65D55449CA0
SHA-256:	5123DB837EADF45712EA7D449BC40BFD3E8E16D3D71E7D0CE9A32F164973D767
SHA-512:	B20B75473F34209888F38EE570B8A96061760E88466DFC2EC55C814968DC7F67D92D255E8635188B60455B88F2D1D517747613AD0F366D60412D2D6ECE231B0E
Malicious:	false
Preview:	# history.tcl --..#..# Implementation of the history command...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.....# The tcl::history array holds the history list and some additional..# bookkeeping variables...#..# nextid.the index used for the next history list item...# keep..the max size of the history list..# oldest.the index of the oldest item in the history.....namespace eval ::tcl {.. variable history.. if {![info exists history]} {...array set history {... nextid.0... keep.20... oldest.-20...}.. }.... namespace ensemble create -command ::tcl::history -map {...add.::tcl::HistAdd...change.::tcl::HistChange...clear.::tcl::HistClear...event.::tcl::HistEvent...info.::tcl::HistInfo...keep.::tcl::HistKeep...nextid.::tcl::HistNextID...redo.::tcl::HistRedo.. }..}.....# history --..#..#.This is the main history command. See the

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\http1.0\http.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10066
Entropy (8bit):	4.806771544139381
Encrypted:	false
SSDEEP:	192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
MD5:	C2092F8CA2D761DFA8C461076D956374
SHA1:	90B4648B3BC81C30465B0BE83A5DB4127A1392FB
SHA-256:	8C474095A3ABA7DF5B488F3D35240D6DE729E57153980C2A898728B8C407A727
SHA-512:	09CE408886E2CEADDF70786A15D63AF9A930E70CAC4286AC9DDD2094C8EDCF97A2ADC2D3D2659B123F88719340D3B00D9F96E9BC7C8B55192735C290E7D24683
Malicious:	false
Preview:	# http.tcl..# Client-side HTTP for GET, POST, and HEAD commands...# These routines can be used in untrusted code that uses the Safesock..# security policy...# These procedures use a callback interface to avoid using vwait,..# which is not defined in the safe base...#..# See the http.n man page for documentation....package provide http 1.0....array set http {.. -accept /.. -proxyhost {}.. -proxyport {}.. -useragent {Tcl http client package 1.0}.. -proxyfilter httpProxyRequired..}..proc http_config {args} {.. global http.. set options [lsort [array names http -*]].. set usage [join $options ", "].. if {[llength $args] == 0} {...set result {}...foreach name $options {... lappend result $name $http($name)...}...return $result.. }.. regsub -all -- - $options {} options.. set pat ^-([join $options \|])$.. if {[llength $args] == 1} {...set flag [lindex $args 0]...if {[regexp -- $pat $flag]} {... return $http($flag)...} else {... return -code er

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\http1.0\pkgIndex.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	746
Entropy (8bit):	4.711041943572035
Encrypted:	false
SSDEEP:	12:jHx5XRsLzhjJS42wbGlTULuUAZb3KykszLl7+HkuRz20JSv6C3l5kMn:bHRsRJS42wbGlTUcZ+yk2Lli1z2jxXkM
MD5:	A387908E2FE9D84704C2E47A7F6E9BC5
SHA1:	F3C08B3540033A54A59CB3B207E351303C9E29C6
SHA-256:	77265723959C092897C2449C5B7768CA72D0EFCD8C505BDDBB7A84F6AA401339
SHA-512:	7AC804D23E72E40E7B5532332B4A8D8446C6447BB79B4FE32402B13836079D348998EA0659802AB0065896D4F3C06F5866C6B0D90BF448F53E803D8C243BBC63
Malicious:	false
Preview:	# Tcl package index file, version 1.0..# This file is generated by the "pkg_mkIndex" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}]..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\init.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25633
Entropy (8bit):	4.8854383645737895
Encrypted:	false
SSDEEP:	768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
MD5:	982EAE7A49263817D83F744FFCD00C0E
SHA1:	81723DFEA5576A0916ABEFF639DEBE04CE1D2C83
SHA-256:	331BCF0F9F635BD57C3384F2237260D074708B0975C700CFCBDB285F5F59AB1F
SHA-512:	31370D8390C4608E7A727EED9EE7F4C568ECB913AE50184B6F105DA9C030F3B9F4B5F17968D8975B2F60DF1B0C5E278512E74267C935FE4EC28F689AC6A97129
Malicious:	false
Preview:	# init.tcl --..#..# Default system startup file for Tcl-based applications. Defines..# "unknown" procedure and auto-load facilities...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2004 Kevin B. Kenny. All rights reserved...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# This test intentionally written in pre-7.5 Tcl..if {[info commands package] == ""} {.. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]"..}..package require -exact Tcl 8.6.12....# Compute the auto path to use in this interpreter...# The values on the path come from several locations:..#..# The environment variable TCLLIBPATH..#..# tcl_library, which is the directory containing this init.tcl script...# [t

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\af.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	4.10054496357204
Encrypted:	false
SSDEEP:	12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
MD5:	DA8BA1C3041998F5644382A329C3C867
SHA1:	CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
SHA-256:	A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
SHA-512:	4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\af_za.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.925537696653838
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
MD5:	1B9DCD1C6FCDDC95AE820EA8DA5E15B8
SHA1:	E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
SHA-256:	1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
SHA-512:	532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ar.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2018
Entropy (8bit):	4.477377447232708
Encrypted:	false
SSDEEP:	24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
MD5:	D264D01B46D96455715114CAEDF9F05E
SHA1:	A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
SHA-256:	B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
SHA-512:	A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ar_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.872222510420193
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
MD5:	430498B4AB1E77C86BC1311A49747581
SHA1:	684EAD965D9010C2A6E73DCACB2224FDE585F9FF
SHA-256:	2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
SHA-512:	9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ar_jo.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.08645484776227
Encrypted:	false
SSDEEP:	24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
MD5:	5C62D606F4F14BC8994B28F9622D70DD
SHA1:	E99F8CC5D330085545B05B69213E9D011D436990
SHA-256:	5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
SHA-512:	81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ar_lb.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.083347689510237
Encrypted:	false
SSDEEP:	24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
MD5:	6FC1CC738207E2F8E0871103841BC0D4
SHA1:	D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
SHA-256:	1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
SHA-512:	E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ar_sy.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.084701680556524
Encrypted:	false
SSDEEP:	24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
MD5:	8188C37CA44FEFFF8D895AAD503AD4F6
SHA1:	C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
SHA-256:	294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
SHA-512:	F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\be.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.27810535662921
Encrypted:	false
SSDEEP:	48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
MD5:	6334BDDFC1E0EAE4DBB2C90F85818FD8
SHA1:	085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
SHA-256:	A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
SHA-512:	18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\bg.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	4.4251657008559935
Encrypted:	false
SSDEEP:	48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
MD5:	E5225D6478C60E2502D18698BB917677
SHA1:	52D611CB5351FB873D2535246B3A3C1A37094023
SHA-256:	CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
SHA-512:	59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\bn.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2335
Entropy (8bit):	4.107102006297273
Encrypted:	false
SSDEEP:	24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
MD5:	5D25E7FC65824AC987535FEA14A4045C
SHA1:	85C10F05823CD3263FC7B3EC38796BEC261B3716
SHA-256:	890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
SHA-512:	5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\bn_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.868201122972066
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
MD5:	B91BB2ABC23B90962D2070B9588F2AB5
SHA1:	CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
SHA-256:	B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
SHA-512:	932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ca.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.2880653012847985
Encrypted:	false
SSDEEP:	24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
MD5:	72DDD60C907DD235BCE4AB0A5AEE902C
SHA1:	06150F793251687E6FBC3FDA3BC81BCBFC7DE763
SHA-256:	3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
SHA-512:	3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\cs.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	4.466447248030554
Encrypted:	false
SSDEEP:	24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
MD5:	F32EAD82CC26754C5A8E092873A28DB3
SHA1:	325124660F62242B24623B4B737CB4616F86CFF3
SHA-256:	AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
SHA-512:	04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\da.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	4.315504392809956
Encrypted:	false
SSDEEP:	24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
MD5:	27A6A8BE8903AEF9D0BE956906A89583
SHA1:	EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
SHA-256:	0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
SHA-512:	0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\de.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	4.349293509679722
Encrypted:	false
SSDEEP:	24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
MD5:	EE3963A5F7E29C05C9617BE3FD897114
SHA1:	0F978CA174DF596817F872B5EF1B447B9DFE651C
SHA-256:	4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
SHA-512:	EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\de_at.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.412930056658995
Encrypted:	false
SSDEEP:	24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
MD5:	A6227CD4F7434952D093F1F3C64B4378
SHA1:	0DDB9A49CB83DDF2396B2ECA85093260710496C2
SHA-256:	1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
SHA-512:	D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\de_be.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	4.389082225723362
Encrypted:	false
SSDEEP:	24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
MD5:	C351057D8E5328C0790901D1F4DBEC9F
SHA1:	F73DE8AEF7F8083B0726760AA003E81067A68588
SHA-256:	532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
SHA-512:	8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\el.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.371322909589862
Encrypted:	false
SSDEEP:	24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
MD5:	7DD14B1F4FF532DCAF6D4C6F0DF82E9A
SHA1:	707875FEF4207EBB71D066FDC54C7F68560C6DAD
SHA-256:	8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
SHA-512:	5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_au.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.896073290907262
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
MD5:	5B31AD8AC0000B01C4BD04BF6FC4784C
SHA1:	F55145B473DDCAE38A0F7297D58B80B12B2A5271
SHA-256:	705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
SHA-512:	1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_be.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.870560620756039
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
MD5:	DDA87ACED97F9F7771788A1A0A1E4433
SHA1:	E221653CD659C095098180344654770FF059331B
SHA-256:	BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
SHA-512:	BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_bw.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.915769170926952
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
MD5:	4CBF90CE15ECCB6B695AA78D7D659454
SHA1:	30C26ADB03978C5E7288B964A14B692813D6E0B8
SHA-256:	EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
SHA-512:	CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_ca.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.87629705076992
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
MD5:	BFC4A48F5B10D137A4D32B440C47D3C6
SHA1:	C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
SHA-256:	3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
SHA-512:	A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_gb.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.892405843607203
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
MD5:	52E55DE8C489265064A01CEEC823DCDD
SHA1:	16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
SHA-256:	C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
SHA-512:	6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_hk.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.851471679101967
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
MD5:	DE2A484508615D7C1377522AFF03E16C
SHA1:	C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
SHA-256:	563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
SHA-512:	A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_ie.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.833246107458447
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
MD5:	57F0BBE1316D14BC41D0858902A7980A
SHA1:	B68BF99A021B9F01FE69341DF06F5D1453156A97
SHA-256:	9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
SHA-512:	864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.80637980762728
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
MD5:	1A54E506E70B2125C6016B373D3DD074
SHA1:	15289902BAA93208D8FB224E119166D0E044E34E
SHA-256:	ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
SHA-512:	0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_nz.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.939458132662909
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
MD5:	7E81708F107658FFD31C3BFBF704A488
SHA1:	7941ED040707591B68581337F8D90FA03C5E1406
SHA-256:	EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
SHA-512:	8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_ph.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.824360175945298
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
MD5:	E2E3BD806C20D7FB88109B7F3B84C072
SHA1:	2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
SHA-256:	3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
SHA-512:	B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_sg.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.911413468674953
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
MD5:	F70245D73BE985091459ADF74B089EBC
SHA1:	21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
SHA-256:	D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
SHA-512:	171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_za.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.937431055623088
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
MD5:	FCA7B13CA6C9527D396A95BEA94CC92D
SHA1:	E6F338A08F72DA11B97F70518D1565E6EF9AD798
SHA-256:	67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
SHA-512:	37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\en_zw.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.934659260313229
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
MD5:	A302091F490344B7A79C9463480AD7CF
SHA1:	E3992D665077177BAD5A4771F1BAF52C2AD1829C
SHA-256:	6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
SHA-512:	FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\eo.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.3537859241297845
Encrypted:	false
SSDEEP:	24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
MD5:	D87605E6282713EED41D56D53B7A04FD
SHA1:	41AAD4BD3B72CCBB6A762FEED3C24931642DD867
SHA-256:	98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
SHA-512:	4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	4.2910064237800025
Encrypted:	false
SSDEEP:	24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
MD5:	91DE6EE8E1A251EF73CC74BFB0216CAC
SHA1:	1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
SHA-256:	E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
SHA-512:	46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_ar.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.878377455979812
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
MD5:	313966A7E4F50BB77996FDE45E342CA9
SHA1:	021DF7211DAE9A635D52F7005672C157DBBAE182
SHA-256:	B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
SHA-512:	79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_bo.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.924579610789789
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
MD5:	EF58B1097A3C6F2133BD7AA8CCC1AD1B
SHA1:	BD479E4635F3CD70A6A90E07B7E92757BC9E2687
SHA-256:	B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
SHA-512:	F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_cl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9352990174129925
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
MD5:	42BCE0EE3A3F9E9782E5DE72C989903A
SHA1:	0960646417A61E8C31D408AE00B36A1284D0300E
SHA-256:	9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
SHA-512:	C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_co.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.908553844782894
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
MD5:	6A8F31AE734DCEE4845454408CDB3BC5
SHA1:	A3B9A0124D3CFA9E0E5957612897B23193AD5D59
SHA-256:	5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
SHA-512:	188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_cr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.919346233482604
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
MD5:	2EDDA3F61BA4D049E6C871D88322CF72
SHA1:	40AFB64AF810596FCBDBD742ACAFE25CE56F3949
SHA-256:	A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
SHA-512:	B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_do.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.913083040975068
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
MD5:	76CFD4F568EA799F9A4082865633FF97
SHA1:	B09846BBF7A78243A5075F2DC9241791DCBA434B
SHA-256:	8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
SHA-512:	58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_ec.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.915857529388286
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
MD5:	94B713B1560FE7711EA746F1CEBD37CD
SHA1:	E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
SHA-256:	52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
SHA-512:	EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_gt.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9102355704853435
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
MD5:	761D0A468DF2EE75BC2CAB09D5FF38CD
SHA1:	D627BE45FE71CCB3CA53153393C075FF5136C2F3
SHA-256:	19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
SHA-512:	6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_hn.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.947925914291734
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
MD5:	33CEE7F947A484B076F5FA7871A30FEB
SHA1:	F77F8D1F42008770A6FF1F5097C863ECF482BEBE
SHA-256:	07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
SHA-512:	EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_mx.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9102355704853435
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
MD5:	678D7A6DC32355246BF3AC485A24AF4D
SHA1:	B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
SHA-256:	A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
SHA-512:	571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_ni.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.918215906418583
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
MD5:	471C41907CE5DB1F30C647A789870F78
SHA1:	C575A639609620AF7C56430991D0E4C2B50BDEC5
SHA-256:	6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
SHA-512:	CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_pa.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.906719336603863
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
MD5:	571F6716293442672521F70854A5AD05
SHA1:	525EBDEA6F85FC769B6C0C0B179BD98381647123
SHA-256:	EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
SHA-512:	C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_pe.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.90959433688075
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
MD5:	5A5997D834DDD3E2E8FF8C6956AD54AC
SHA1:	AB4110E37B3665D738A8F2B3E64CBA9E99127301
SHA-256:	90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
SHA-512:	1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_pr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.905689521403511
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
MD5:	CE811BB8D12C7E6D53338759CCFB0A22
SHA1:	0AED290AA479DE6887CCB58D3F0A0F379EF8D558
SHA-256:	F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
SHA-512:	0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_py.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.917539255090736
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
MD5:	9CD6FAC4121E3D287C87157142E32845
SHA1:	3081FE2197017EC8E052756A407880C1C4ED026A
SHA-256:	70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
SHA-512:	25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_sv.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.929035824905457
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
MD5:	AF300EA6E733DC6820768EA16194B472
SHA1:	7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
SHA-256:	26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
SHA-512:	C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_uy.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.923802447598272
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
MD5:	2DC550FEC3F477B1159B824479BCE707
SHA1:	4D0B20CF3E50B64D74655A405A7750E0B0BB4375
SHA-256:	1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
SHA-512:	B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\es_ve.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.928484426267027
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
MD5:	184D6C4B9F0AA874DEB959F63F7CC01B
SHA1:	5FB370B498289590C977F6B489FF646F0FB27425
SHA-256:	91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
SHA-512:	881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\et.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.391217201307309
Encrypted:	false
SSDEEP:	24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
MD5:	C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
SHA1:	F5E26B40786B8987C98F9CBDEF5522043574A9ED
SHA-256:	4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
SHA-512:	757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\eu.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	4.002617252503668
Encrypted:	false
SSDEEP:	24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
MD5:	ED9805AF5BFB54EB28C6CB3975F86F5B
SHA1:	2BD91BD850028712F35A2DDB2555036FBF6E8114
SHA-256:	6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
SHA-512:	16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\eu_es.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.915392589807169
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
MD5:	4C91AA000D4316585893025CBB96E910
SHA1:	3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
SHA-256:	D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
SHA-512:	0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fa.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	4.21837106187395
Encrypted:	false
SSDEEP:	24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
MD5:	7AB25F4E7E457469DC61A33176B3AA72
SHA1:	EEA98283D250A99E33DD4D5D9B1B76A029716CE6
SHA-256:	86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
SHA-512:	7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fa_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	4.491667766230948
Encrypted:	false
SSDEEP:	24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
MD5:	C59EE7CA80AD9F612A21C8B6674A820E
SHA1:	AEFD631EFC1892063244FA622DE1A091C461E370
SHA-256:	6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
SHA-512:	42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fa_ir.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.12739029869254
Encrypted:	false
SSDEEP:	12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
MD5:	9778A7C3ABD37ECBEC0BB9715E52FAF8
SHA1:	D8063CA7779674EB1D9FE3E4B4774DB20B93038B
SHA-256:	3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
SHA-512:	B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fi.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	4.32217771842326
Encrypted:	false
SSDEEP:	24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
MD5:	CC06F0ABD8F985654DAD8256598EBCB7
SHA1:	71C880F9F395ACD32AF7F538033211F392F83645
SHA-256:	9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
SHA-512:	E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fo.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1033
Entropy (8bit):	4.15884265510429
Encrypted:	false
SSDEEP:	24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
MD5:	5D224E66FD9521CA4327D4F164CD6585
SHA1:	FC8F4C1D9A69931679028DE02155D96A18F6542E
SHA-256:	2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
SHA-512:	0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fo_fo.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.864028070948858
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
MD5:	92E2B6483B2374817548F4EAA1731820
SHA1:	071E1E9368CCB4EC864E78622B2113F460920203
SHA-256:	C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
SHA-512:	E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.383721663740675
Encrypted:	false
SSDEEP:	24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
MD5:	4D63B4A7CF13A28A6F6784B5597EEF43
SHA1:	FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
SHA-256:	96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
SHA-512:	5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fr_be.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.910112619660625
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
MD5:	07EEADB8C2F2425FF9A27E46A81827A2
SHA1:	AA18A651C64098C7885F1F869B9F221453F42987
SHA-256:	AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
SHA-512:	1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fr_ca.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.890376345610709
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
MD5:	2F70BDDE7685E2892C5F79C632FC2F0F
SHA1:	FD1A6F6042E59D1563ABB5858C348C1D785C435E
SHA-256:	0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
SHA-512:	50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\fr_ch.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.913241133684606
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
MD5:	83FC7EBA68C3727F7C13C8EEAF79823F
SHA1:	81C27F9B97F5F5190F7189230535EC09CD228158
SHA-256:	290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
SHA-512:	35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ga.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.314271783103334
Encrypted:	false
SSDEEP:	24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
MD5:	67D137E5D853DB61A4B4264871E793F7
SHA1:	4280E7F662DE792175AF8B4C93874F035F716F0F
SHA-256:	880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
SHA-512:	C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ga_ie.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.824539027053997
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
MD5:	C27BD7F317AAADB380F4C38AE0D2FDA6
SHA1:	79870A0E68AA0A9B301414EDC21889F83BB81E40
SHA-256:	3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
SHA-512:	3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\gl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	997
Entropy (8bit):	4.120890519790248
Encrypted:	false
SSDEEP:	24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
MD5:	A3D098C1A47E380F7C25233A52FBDE38
SHA1:	C97E4EAA9E7A7F99950F422B93C57134B532C639
SHA-256:	34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
SHA-512:	4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\gl_es.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.886176304042503
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
MD5:	78B9163C5E8E5E7049CBF91D1A5889A4
SHA1:	F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
SHA-256:	B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
SHA-512:	E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\gv.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.213672208102291
Encrypted:	false
SSDEEP:	24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
MD5:	518FC3964D50854081FB79189A42D3E7
SHA1:	59392F16CD56E3E6A685F78974D539FB3A972B98
SHA-256:	404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
SHA-512:	E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\gv_gb.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.936566750568767
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
MD5:	0B6BE614EF5F5F25A30D2D33701A9F94
SHA1:	65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
SHA-256:	86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
SHA-512:	376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\he.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	4.298934047406144
Encrypted:	false
SSDEEP:	24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
MD5:	A0E60036EB17208A449AAFC3AAAE622C
SHA1:	9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
SHA-256:	787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
SHA-512:	46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\hi.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	4.2117128941697715
Encrypted:	false
SSDEEP:	48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
MD5:	4219A929E27308ADC04A9F368F063F38
SHA1:	FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
SHA-256:	192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
SHA-512:	223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\hi_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9286948144352865
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
MD5:	1C1E1484EA0286175FADCB90937C9F34
SHA1:	5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
SHA-256:	5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
SHA-512:	F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\hr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	4.36311224714184
Encrypted:	false
SSDEEP:	24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
MD5:	906963A3AD09EAC781B35C190B77484E
SHA1:	E5AA49DA9C4987EAFA839115F84612426EB8615E
SHA-256:	105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
SHA-512:	557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\hu.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.511450677731002
Encrypted:	false
SSDEEP:	24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
MD5:	E398158EE1CD49CB5286D9642D4A61DD
SHA1:	A93A588B0ADD198C067C4BB070DC1E5170E6E208
SHA-256:	993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
SHA-512:	9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\id.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.02166638427728
Encrypted:	false
SSDEEP:	24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
MD5:	191ACF2E8A8F10A1360B283D42886382
SHA1:	EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
SHA-256:	41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
SHA-512:	29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\id_id.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.904408530699153
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
MD5:	FEB4D50576BF3E11A0A40FD29ABE35A7
SHA1:	8CEAA187C8AA5EC101743060A877D039850964CA
SHA-256:	BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
SHA-512:	8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\is.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.457417703528286
Encrypted:	false
SSDEEP:	24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
MD5:	ACF0452D5BB6D36A40061D2B0AF4D7A6
SHA1:	9DF4D88F1962A672EFBDDE524550F7A5D02D446D
SHA-256:	778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
SHA-512:	34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\it.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1294
Entropy (8bit):	4.282101355195382
Encrypted:	false
SSDEEP:	24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
MD5:	3354A6FC06C298E33AA14163929E56EB
SHA1:	C3005370DAE8A266AE21F7E2B871AEA5A656A155
SHA-256:	1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
SHA-512:	58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\it_ch.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.8982877714191035
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
MD5:	E4400C16406A46C2880250522BED2EDE
SHA1:	787A04037A355FF845025B8865335EB938280BFB
SHA-256:	24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
SHA-512:	3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ja.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	4.951012555106795
Encrypted:	false
SSDEEP:	24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
MD5:	11FBE427747012444AEEAFD6134034A4
SHA1:	58C72C432053264EAE6335D6CC93C5FFA33C42B8
SHA-256:	2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
SHA-512:	4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\kl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.097746630492712
Encrypted:	false
SSDEEP:	24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
MD5:	2F79804667D6F8C77BB188D59EF5F3DF
SHA1:	10950ECA798F24A7C405B3E18B559CCC0C056EC1
SHA-256:	96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
SHA-512:	1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\kl_gl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.882476709336307
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
MD5:	255830678C8724E65C05A7E020E68B5B
SHA1:	0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
SHA-256:	3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
SHA-512:	99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ko.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.612163420716489
Encrypted:	false
SSDEEP:	48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
MD5:	CCB2C2254D3FA3025183DB7E010CAD66
SHA1:	510BBB6A9162F2EF908E6561CC714848C2EA74CA
SHA-256:	EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
SHA-512:	A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ko_kr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.058233326545794
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
MD5:	58CA45CE26AF8ECA729BA72898BB633D
SHA1:	CBBEDB7370890A1DB65080A359A9A5C164B525D5
SHA-256:	4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
SHA-512:	48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\kok.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1997
Entropy (8bit):	4.202940482570495
Encrypted:	false
SSDEEP:	24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
MD5:	67FA08F588A3B44D67E42EC1025013BC
SHA1:	6895FEF0476DE0349895DB052B335AC46636B23A
SHA-256:	9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
SHA-512:	4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\kok_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.904340548436718
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
MD5:	0AA20289A63BA3A14DCFED75EED980DE
SHA1:	2B76013593D886B0724D82849FD1840B20922902
SHA-256:	644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
SHA-512:	6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\kw.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	4.060027087416375
Encrypted:	false
SSDEEP:	24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
MD5:	CCEC7B77DCA1F6A406311FC43EE57030
SHA1:	4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
SHA-256:	EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
SHA-512:	4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\kw_gb.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.959913054070712
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
MD5:	18E8576F63B978F1AFEF15AC57B44FBF
SHA1:	D50EB90944FF81E3CBFF942B16C1874EB7EA2562
SHA-256:	EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
SHA-512:	F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\lt.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	4.506235846178408
Encrypted:	false
SSDEEP:	24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
MD5:	D4EC2E96995E0EB263F338DD16CC4F8D
SHA1:	7ED86175489B1AE3CA5C0E8D42969F951C895D6B
SHA-256:	855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
SHA-512:	A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\lv.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	4.460631492946299
Encrypted:	false
SSDEEP:	24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
MD5:	554ED2CAFD25F5F82DA54AE057F4BA98
SHA1:	E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
SHA-256:	7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
SHA-512:	612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\mk.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.299300188052441
Encrypted:	false
SSDEEP:	48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
MD5:	888014F13A82511ABEF99497A753BFC3
SHA1:	7F4231BEDE191370B37E8B917B6AD8829D15CA7D
SHA-256:	4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
SHA-512:	D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\mr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	4.220147808639664
Encrypted:	false
SSDEEP:	24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
MD5:	07F99E0A05083B10F80A4D6867163B23
SHA1:	B6036C7DA8043E3401583D03831E7A4BF755D93D
SHA-256:	AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
SHA-512:	3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\mr_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.89440333975705
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
MD5:	67368E8A5715860BABD44E54A168192F
SHA1:	7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
SHA-256:	B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
SHA-512:	E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ms.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	4.018924167342869
Encrypted:	false
SSDEEP:	12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
MD5:	7E6A943B7D82404F61BDBD95682073CD
SHA1:	B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
SHA-256:	970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
SHA-512:	12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ms_my.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.818053174805798
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
MD5:	A02F11BE0DF920E63E7A3ACCE746E32D
SHA1:	4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
SHA-256:	F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
SHA-512:	5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\mt.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	717
Entropy (8bit):	4.55153350337982
Encrypted:	false
SSDEEP:	12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
MD5:	D8BBEC2F8935054E6081BB5E4AE8F7E3
SHA1:	33FE6D51A284B8760BC6F442329B10374F506BDA
SHA-256:	7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
SHA-512:	BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\nb.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	4.313626715960843
Encrypted:	false
SSDEEP:	24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
MD5:	42D02C3CAF28BE4994F27CEF5A183AB7
SHA1:	DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
SHA-256:	534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
SHA-512:	0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\nl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1129
Entropy (8bit):	4.235969198645435
Encrypted:	false
SSDEEP:	24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
MD5:	B9B949794203D204628D4DBEA29587AE
SHA1:	1642D8040144469B5C359E80693E68036F87B849
SHA-256:	9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
SHA-512:	0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\nl_be.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.865165930946383
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
MD5:	3261F397ED0291368FF1881E7BA08ECE
SHA1:	7147ABB62034EB152B1FED9246A533535F07372C
SHA-256:	77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
SHA-512:	C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\nn.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.282788574144479
Encrypted:	false
SSDEEP:	24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
MD5:	985E97517C2BF37719A618F575DF392C
SHA1:	65BC07FC3A955300ED09B7485F90AEC18CBAD43F
SHA-256:	06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
SHA-512:	75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\pl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.459506202908786
Encrypted:	false
SSDEEP:	24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
MD5:	79AB7C13AA3833A1DAEADDB1144CCE55
SHA1:	C01ABC2F16549CAEC6B081448B2CBA88A680E250
SHA-256:	61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
SHA-512:	79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\pt.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.394980756969744
Encrypted:	false
SSDEEP:	24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
MD5:	8F53B3571DD29E12BD33349CFA32F28F
SHA1:	C125E059B8BFE5FECD482D1A1DA50B8678872BF6
SHA-256:	6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
SHA-512:	5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\pt_br.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.8608779725401785
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
MD5:	A2626EA95C2480FEA68906AE6A1F6993
SHA1:	A0592902337C00FC2E70B1DFB3A42453A86535BB
SHA-256:	320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
SHA-512:	9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ro.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.350784108088039
Encrypted:	false
SSDEEP:	24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
MD5:	F6575EC17966320106FF7ABDFB3186E2
SHA1:	68C6B72D664FDA27450FCE8B5734AB627CE825D7
SHA-256:	25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
SHA-512:	E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ru.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.2886524607041006
Encrypted:	false
SSDEEP:	48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
MD5:	9F1C8DD58550558977821FD500E7C0E0
SHA1:	EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
SHA-256:	BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
SHA-512:	AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ru_ua.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.9420431225061
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
MD5:	DC98D88964650E302BE97FDB3B33326E
SHA1:	1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
SHA-256:	13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
SHA-512:	F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sh.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.359036493565628
Encrypted:	false
SSDEEP:	24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
MD5:	E297221FA73BD78577B398BC7D061D21
SHA1:	F2A6B456272F913A9E97C495CEE73AC774C90FA1
SHA-256:	E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
SHA-512:	AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sk.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.4043119723436135
Encrypted:	false
SSDEEP:	24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
MD5:	24DA40901D907D35195CC1B3A675EBC7
SHA1:	8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
SHA-256:	976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
SHA-512:	A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	4.333705818952628
Encrypted:	false
SSDEEP:	24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
MD5:	CB76F54CBE0D1AAE8BA956B4C51CBD2A
SHA1:	C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
SHA-256:	11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
SHA-512:	69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sq.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	4.408176575111904
Encrypted:	false
SSDEEP:	24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
MD5:	E606F620F03EC0FBDBE6551601299C5F
SHA1:	0B50AB679E8D90D8E7319BCADAC426E004594D3B
SHA-256:	1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
SHA-512:	08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.307749748884122
Encrypted:	false
SSDEEP:	48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
MD5:	BF363AB60B57F6D8FDCDBFD230A28DDF
SHA1:	6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
SHA-256:	FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
SHA-512:	91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sv.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.3542418837714285
Encrypted:	false
SSDEEP:	24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
MD5:	3B5C3FFA0829768470BDA1B46D882060
SHA1:	C96799036EC5CCDE799A6B50CD7748908935A2F3
SHA-256:	483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
SHA-512:	684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\sw.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.108744949579904
Encrypted:	false
SSDEEP:	12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
MD5:	5774860C8AEECBD48F1502E616158CAB
SHA1:	DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
SHA-256:	1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
SHA-512:	91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ta.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	4.080580566597515
Encrypted:	false
SSDEEP:	24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
MD5:	85288236C3997302EA26D7403BBA2C15
SHA1:	05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
SHA-256:	AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
SHA-512:	8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\ta_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.863003494480733
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
MD5:	CF078352DA0507C767F04E31D6C14296
SHA1:	0A9B1255BD85B60D3620AE61370F54748AB7A182
SHA-256:	4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
SHA-512:	6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\te.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	4.097884113767283
Encrypted:	false
SSDEEP:	48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
MD5:	61E4CB2AAD66285E9113071057F39C35
SHA1:	A2BD21090859669C4B6A875E077825381B7E2702
SHA-256:	9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
SHA-512:	589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\te_in.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.058324650031252
Encrypted:	false
SSDEEP:	12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
MD5:	BCA040A356E7E8CC597EFB9B9065F8E1
SHA1:	ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
SHA-256:	B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
SHA-512:	D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\th.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.382796122808316
Encrypted:	false
SSDEEP:	48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
MD5:	7F61E1EA256D78948189EF07119663CD
SHA1:	6867E9780049FACE9984B7788B6F362B8D1AD718
SHA-256:	48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
SHA-512:	F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\tr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	4.390397293529625
Encrypted:	false
SSDEEP:	24:4aR83ZVUflVdq4qTr6dyX59508THHCh5LbQgWiNv9KvWIn:43PXTtbTngLhWiJGWIn
MD5:	017F0F989BD5DBBF25E7C797CE09C45C
SHA1:	162922DBD55A31A74410375A36EE7BC50E092BDD
SHA-256:	4B85B345D6C43F7257C6849A60A492397FD5FD9D82DF3A2252189D7A1ECCBB64
SHA-512:	73B6CF395753D863330687404E8A584CB08B81A8CC456DCE7BB49C4EA15EA19E45E3CC1E1367E10915DE14AC6258383289BCFEF55AD2768A50889DF390D37EF9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \.. "Paz"\.. "Pzt"\.. "Sal"\.. "\u00c7ar"\.. "Per"\.. "Cum"\.. "Cmt"].. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \.. "Pazar"\.. "Pazartesi"\.. "Sal\u0131"\.. "\u00c7ar\u015famba"\.. "Per\u015fembe"\.. "Cuma"\.. "Cumartesi"].. ::msgcat::mcset tr MONTHS_ABBREV [list \.. "Oca"\.. "\u015eub"\.. "Mar"\.. "Nis"\.. "May"\.. "Haz"\.. "Tem"\.. "A\u011fu"\.. "Eyl"\.. "Eki"\.. "Kas"\.. "Ara"\.. ""].. ::msgcat::mcset tr MONTHS_FULL [list \.. "Ocak"\.. "\u015eubat"\.. "Mart"\.. "Nisan"\.. "May\u0131s"\.. "Haziran"\.. "Temmuz"\.. "A\u011fustos"\.. "Eyl\u00fcl"\.. "Ekim"\.. "Kas\u0131m"\.. "Aral\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\uk.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.289021158621493
Encrypted:	false
SSDEEP:	48:436yILgoQjQPxUIkgPDRQnQ0vVQbC1iQwweIgWQDIoZI7QDI3QbI87IVQnIzQ7mh:2AzUe3EhV8CYgrbH7z3fLVTzgn5jyX7p
MD5:	323BD95809A44B0BADC71AD36E5F095B
SHA1:	44F6016873CA955D27545C56CCD24BDB06A83C43
SHA-256:	7093DA7E39CEB6D3F51EB6CF1CCA2D7F3680ED7B8FE4A5F0CECEEF6BEB21AC77
SHA-512:	DB16E0E2D17CE47673DE781A7171944C14CC550FB8EB0920C05B979E4D067E36DF0B59B8BFA81F82D8FCE1FFDDAAD2755E68BFE5BC0DBB11E8716A4D18BA5F7E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0432\u0442"\.. "\u0441\u0440"\.. "\u0447\u0442"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0456\u043b\u044f"\.. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\.. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\.. "\u0441\u0435\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440"\.. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset uk MONTHS_ABBREV [list \.. "\u0441\u0456\u0447"\.. "\u043b\u044e\u0442"\.. "\u0431\u0435\u0440"\.. "\u043a\u0432\u0456\u0442"\.. "\u0442\u0440\u0430\u0432"\.. "\u0447\u0435\u0440\u0432"\.. "\u043b

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\vi.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	4.44729506678271
Encrypted:	false
SSDEEP:	24:4aR836DNjYTP55YAUy2tJ9kyzW68IFYHMBSW1K1pvhv1O:43dbYJyC8ySgI1dV1O
MD5:	C127F54C462917D3B3EEF5F29F612138
SHA1:	B1D9A67F856D93F98524C6372B352EA0DE1B9CD3
SHA-256:	E9B7AECD456F1D2288604C982B5DED0DCF71DCA968C0B0EAFF4CA16CC3B73EC2
SHA-512:	0B0F132F10580751258D37E070338C3B39DF57FDECDB9D0AFA67E90D6766DDCB4D711876E551ED759D177F1B8F4E9E1DD8F7899F7CB57F8039F55EC4C2984E87
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \.. "Th 2"\.. "Th 3"\.. "Th 4"\.. "Th 5"\.. "Th 6"\.. "Th 7"\.. "CN"].. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \.. "Th\u01b0\u0301 hai"\.. "Th\u01b0\u0301 ba"\.. "Th\u01b0\u0301 t\u01b0"\.. "Th\u01b0\u0301 n\u0103m"\.. "Th\u01b0\u0301 s\u00e1u"\.. "Th\u01b0\u0301 ba\u0309y"\.. "Chu\u0309 nh\u00e2\u0323t"].. ::msgcat::mcset vi MONTHS_ABBREV [list \.. "Thg 1"\.. "Thg 2"\.. "Thg 3"\.. "Thg 4"\.. "Thg 5"\.. "Thg 6"\.. "Thg 7"\.. "Thg 8"\.. "Thg 9"\.. "Thg 10"\.. "Thg 11"\.. "Thg 12"\.. ""].. ::msgcat::mcset vi MONTHS_FULL [list \.. "Th\u00e1ng m\u00f4\u0323t"\.. "Th\u00e1ng hai"\.. "Th\u00e1ng ba"\.. "Th\u00e1ng t\u01b0"\.. "Th\u00e

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\zh.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with very long lines (1598), with CRLF line terminators
Category:	dropped
Size (bytes):	3385
Entropy (8bit):	4.5164095151631125
Encrypted:	false
SSDEEP:	48:43qrY2BBT7uxDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyke2gdr:2yPTKdo
MD5:	2F356DE14D48B1091DEAA32D20C38D96
SHA1:	4AB78D47A73290000955A7C1DFDF7106093F69FD
SHA-256:	EB247F5184A59414D3DF7E3ECA51F5998C248CFB27D2C02E62A7A30AB35197A7
SHA-512:	602410830018B455C68AE2EBDD83BA561CF59DA5898E00C80CE7EF619912E591EB38B4C8FE8D9B1F024E7105B0C4D2D326FC855F31E79C1B954429B947DFFBB1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh MONTHS_ABBREV [list \.. "\u4e00\u6708"\.. "\u4e8c\u6708"\.. "\u4e09\u6708"\.. "\u56db\u6708"\.. "\u4e94\u6708"\.. "\u516d\u6708"\.. "\u4e03\u6708"\.. "\u516b\u6708"\.. "\u4e5d\u6708"\.. "\u5341\u6708"\.. "\u5341\u4e00\u6708"\.. "\u5341\u4e8c\u6708"\.. ""].. ::msgcat::m

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\zh_cn.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.167825099880243
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoX5YBoHJ+3vtfNrsoHJ+3v6MYBoXa+3vYq9vn:4EnLB383U5YMJ+3vtN3J+3v6LcL3vYqN
MD5:	9FCDC2E80E13984D434E3CC91E1ED14C
SHA1:	710D9EE2A71021F4AB609886138EED43C1380ACD
SHA-256:	4C8A855700FEFE8EE21B08030FF4159D8011AE50353F063229C42DE6292475CF
SHA-512:	D899A1F58DF1051BB2C2C4AC859C52A2D19B1593C37022A29439B37A8057ADC3941F3564E2E1D9CEB72AE123A4E12E24C3736343AA3A5EC8749AB5AEBBF65085
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e".. ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2".. ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\zh_hk.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	780
Entropy (8bit):	4.716025632367214
Encrypted:	false
SSDEEP:	12:4EnLB383HmSBBHZovDh4ToC4qU3WwVW3v6P3v3WwSn:4aR83Hxo14u3Ww+viv3WwS
MD5:	CFDA7B6463305FA15DBBA72D725A1876
SHA1:	2BF885073FBAF4A38B7AFDA76CA391F195A5A362
SHA-256:	7E1C5BD9EC1A17BB851B0DCABD0DFA9FF9D64B89603D9D3FBEAAC609172346AE
SHA-512:	55F974C706933ECE0575A33C381D9B370B8A408C5C5514C805EC04C8B0CA5BAFAA47267DA98E1805B478A9589FFB7549D79002B2A7AF387049011D78DD7605B6
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u4e00"\.. "\u4e8c"\.. "\u4e09"\.. "\u56db"\.. "\u4e94"\.. "\u516d"].. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"\.. ""].. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5".. ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S".. ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\zh_sg.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.062880051437783
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoOpEoPpFocMohX3v6Zwoh+3v6fxvn:4EnLB383J53v6O3vCn
MD5:	3218F8E6BEDD534277DE0849C423158E
SHA1:	10C006446A10406A5644C4033665E877EBF72AF7
SHA-256:	500546B3211D454659D845B4AB9AEF226125100DF40407C49530DE17CDD4363F
SHA-512:	3142893DA85BA8F83A5B6851B313B5F5FF80D2B989C1AE015665EE70373249B44EFB4FF7C621F1D8F37AC6019EF5E8D6D21C76C48998C3D9072F9C5060AA8813
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_SG AM "\u4e0a\u5348".. ::msgcat::mcset zh_SG PM "\u4e2d\u5348".. ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y".. ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\msgs\zh_tw.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.124064818715749
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoAykaRULH/XRxy/5oAyjZRULHi5oAyU/G0OMoAyxW3v6ZQ:4EnLB38315xDOiKRRW3v6F3v8A2n
MD5:	9010E34791B5DDB7F1E0AD4DA6BD4623
SHA1:	418F7374BABEF27FEC8E00D3A32F535084593AB9
SHA-256:	DBA0584B8E1925B439F06E0BF0965E97AFB7EB39E70E0E4C9B70769EBC5F996C
SHA-512:	D3AB698B725E84DAB06E472C41FF2EB55D63885D22B4598C596800BAC83A02A44CB524524F267D090952AF7E0031F47720786ACF9E354EF672CF9EEFB7DB3BD4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d".. ::msgcat::mcset zh_TW CE "\u6c11\u570b".. ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e".. ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\opt0.4\optparse.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33777
Entropy (8bit):	4.60013086740989
Encrypted:	false
SSDEEP:	768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
MD5:	4ECD97188BFED58A15FE22EC566FA6A3
SHA1:	6E4E91096298F1A0AE6CD4241F167C8B4F661EE5
SHA-256:	67A157F1873D606B53DC4D894BD8E71F6B1A0DD66177B9513BD039B348B40349
SHA-512:	1D5067BBB13DAB001168EEB41EBFA2D13BACB0F43A8067CC93923E8F4D062AA387DA23D7D98D6A2AE77D7C849A6026F2343102CBE03690C2CEA0890222339475
Malicious:	false
Preview:	# optparse.tcl --..#..# (private) Option parsing package..# Primarily used internally by the safe:: code...#..#.WARNING: This code will go away in a future release..#.of Tcl. It is NOT supported and you should not rely..#.on it. If your code does rely on this package you..#.may directly incorporate this code into your application.....package require Tcl 8.5-..# When this version number changes, update the pkgIndex.tcl file..# and the install directory in the Makefiles...package provide opt 0.4.8....namespace eval ::tcl {.... # Exported APIs.. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \.. OptProc OptProcArgGiven OptParse \... Lempty Lget \.. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \.. SetMax SetMin......################# Example of use / 'user documentation' ###################.... proc OptCreateTestProc {} {.....# Defines ::tcl::OptParseTest as a test proc with parsed arguments...# (can't be d

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\opt0.4\pkgIndex.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	620
Entropy (8bit):	4.702477618616754
Encrypted:	false
SSDEEP:	12:jHxIRu9zhjJS42wbGlTULuUAZb3KykszLYIGbyAkXaqrQ+pBb6:biRUJS42wbGlTUcZ+yk2LY0XaqrB4
MD5:	07532085501876DCC6882567E014944C
SHA1:	6BC7A122429373EB8F039B413AD81C408A96CB80
SHA-256:	6A4ABD2C519A745325C26FB23BE7BBF95252D653A24806EB37FD4AA6A6479AFE
SHA-512:	0D604E862F3A1A19833EAD99AAF15A9F142178029AB64C71D193CEE4901A0196C1EEDDC2BCE715B7FA958AC45C194E63C77A71E4BE4F9AEDFD5B44CF2A726E76
Malicious:	false
Preview:	# Tcl package index file, version 1.1..# This file is generated by the "pkg_mkIndex -direct" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....if {![package vsatisfies [package provide Tcl] 8.5-]} {return}..package ifneeded opt 0.4.8 [list source [file join $dir optparse.tcl]]..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\package.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23995
Entropy (8bit):	4.884828325514459
Encrypted:	false
SSDEEP:	384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
MD5:	DDB0AB9842B64114138A8C83C4322027
SHA1:	ECCACDC2CCD86A452B21F3CF0933FD41125DE790
SHA-256:	F46AB61CDEBE3AA45FA7E61A48930D64A0D0E7E94D04D6BF244F48C36CAFE948
SHA-512:	C0CF718258B4D59675C088551060B34CE2BC8638958722583AC2313DC354223BFEF793B02F1316E522A14C7BA9BED219531D505DE94DC3C417FC99D216A01463
Malicious:	false
Preview:	# package.tcl --..#..# utility procs formerly in init.tcl which can be loaded on demand..# for package management...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval tcl::Pkg {}....# ::tcl::Pkg::CompareExtension --..#..# Used internally by pkg_mkIndex to compare the extension of a file to a given..# extension. On Windows, it uses a case-insensitive comparison because the..# file system can be file insensitive...#..# Arguments:..# fileName.name of a file whose extension is compared..# ext..(optional) The extension to compare against; you must..#..provide the starting dot...#..Defaults to [info sharedlibextension]..#..# Results:..# Returns 1 if the extension matches, 0 otherwise....proc tcl::Pkg::CompareExtension {fileName {ext {}}} {.. global tcl_platfor

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\parray.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	844
Entropy (8bit):	4.883013702569192
Encrypted:	false
SSDEEP:	12:TF7S2n2wn2SNHaeYF9xcwrmXhbs1GUiSYX3EtSK78ex4VIpynEw88/McUBbPgnz:TF7Hn2wnlk2KwyZSM4SkV/3UB7Cz
MD5:	577787C2F4F5956BA70F83012B980AE5
SHA1:	040B2469F796F3FDFCD1E1DD2EB1C5B799EDEF62
SHA-256:	E269029C8263E3CBC1920C3604ECDCF15EDCCB208A0D68F9EB42B73954D620C0
SHA-512:	C2940F6F3D77412EFC537B8AB67352F519DFFA95739FCC17BF1817335AFD9E5BFE91ABE98CBA99E278CB4923D4E6D431ED9D72282745203C0F7D73193F550238
Malicious:	false
Preview:	# parray:..# Print the contents of a global array on stdout...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....proc parray {a {pattern }} {.. upvar 1 $a array.. if {![array exists array]} {...return -code error "\"$a\" isn't an array".. }.. set maxl 0.. set names [lsort [array names array $pattern]].. foreach name $names {...if {[string length $name] > $maxl} {... set maxl [string length $name]...}.. }.. set maxl [expr {$maxl + [string length $a] + 2}].. foreach name $names {...set nameString [format %s(%s) $a $name]...puts stdout [format "%-s = %s" $maxl $nameString $array($name)].. }..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\safe.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42223
Entropy (8bit):	4.822635446297551
Encrypted:	false
SSDEEP:	768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
MD5:	B8C1561D471CFBF4111C706411D59883
SHA1:	71483EAEEF377EE9AF90BEC44F70C7B12C5BC720
SHA-256:	C21DCE3AB31893118BBED01E559070F1D3541877FEE331BD45F5BF4300ED9654
SHA-512:	465065A938C71AF4588B3331B51A62DD57F57492EB1CB6C0F52B9FD0A2FE7A54B1E995AA56E4A41D7A99EAFF665C1E23E3B240FB3F9840AB242C21B1DBFFFF45
Malicious:	false
Preview:	# safe.tcl --..#..# This file provide a safe loading/sourcing mechanism for safe interpreters...# It implements a virtual path mechanism to hide the real pathnames from the..# child. It runs in a parent interpreter and sets up data structure and..# aliases that will be invoked when used from a child interpreter...#..# See the safe.n man page for details...#..# Copyright (c) 1996-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....#..# The implementation is based on namespaces. These naming conventions are..# followed:..# Private procs starts with uppercase...# Public procs are exported and starts with lowercase..#....# Needed utilities package..package require opt 0.4.8....# Create the safe namespace..namespace eval ::safe {.. # Exported API:.. namespace export interpCreate interpInit interpConfigure interpDelete \...interpAddToAccessPath interpFindInAccessPath setL

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tclIndex

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5617
Entropy (8bit):	4.747404679682368
Encrypted:	false
SSDEEP:	96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
MD5:	C62FB22F4C9A3EFF286C18421397AAF4
SHA1:	4A49B8768CFF68F2EFFAF21264343B7C632A51B2
SHA-256:	DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
SHA-512:	558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0..# -- tcl --..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tm.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12204
Entropy (8bit):	4.763796758810551
Encrypted:	false
SSDEEP:	192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
MD5:	215262A286E7F0A14F22DB1AA7875F05
SHA1:	66B942BA6D3120EF8D5840FCDEB06242A47491FF
SHA-256:	4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
SHA-512:	6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
Malicious:	false
Preview:	# -- tcl --..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Abidjan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.995501022397479
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
MD5:	FF8B5540631A6EE93507338C4E7AA49D
SHA1:	817B261A1B6B92AA498EC286349964EA10FB5A84
SHA-256:	7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
SHA-512:	8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Accra

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.832432925672155
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
MD5:	52FDFD3DB98475FBBB620D0D5565C5CC
SHA1:	C7750452859663605272553DBEE0B6C134E1517C
SHA-256:	6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
SHA-512:	2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Addis_Ababa

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.817170256300069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DczqIVDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DnaDkO
MD5:	30CDD4D37E9DD60FBF6D754C9343F364
SHA1:	56F896C21068764B7B8F884F374B18913CA3D9CA
SHA-256:	E11FD8AD8572B684333810CFDC23B92E1ACF619875866985E288D92F8277D07F
SHA-512:	78FC8043CCE25713404E70996229E5EA8238BF5C0F59029064EDA5494E2D4F54398931F3D855E30C82B2C53B789C40EE4CBF09D0F98C2BA6734595D4AA75017A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Algiers

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	4.187497782275587
Encrypted:	false
SSDEEP:	12:MB862D7nmdHh5Cv6/lHY8SOSuvvzXipFSgSO5vW5aKmvbsF6VWsXN87QBWcAFy:5veSvKlHYXNujXipFSjKRKXiWsXCGWJy
MD5:	E8D3DF11CE0E7575485573FA07D955D5
SHA1:	3B2C00C85B6C0BFAA1C676C970D6DF1B4BDC3D4A
SHA-256:	E6874647561CE1C5FD1F650C9B167F77AC5B24FD2026046399A9043CF998E5C4
SHA-512:	E2968BE847622CF243C0E498436FD21BDC2E1DF0FD8D694F2C70569D17CE896CDE4968BB8ABDEF9F687439E4EA2D955AE87D6C15E81F881EE1413416A90765D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Algiers) {.. {-9223372036854775808 732 0 LMT}.. {-2486592732 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1531443600 0 0 WET}.. {-956365200 3600 1 WEST}.. {-950486400 0 0 WET}.. {-942012000 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796262400 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766630800 3600 0 CET}.. {-733280400 0 0 WET}.. {-439430400 3600 0 CET}.. {-212029200 0 0 WET}.. {41468400 3600 1 WEST}.. {54774000 0 0 WET}.. {231724800 3600 1 WEST}.. {246240000 3600 0 CET}.. {259545600 7200 1 CEST}.. {275274000 3600 0 CET}.. {309740400 0 0 WET}.. {

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Asmara

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.801054282631739
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjEUEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DGs+DR
MD5:	A543BDEB3771017421FB75231F0004F2
SHA1:	D682C58C27562FF3ABAB8EDE8EB6EA754DA7C02E
SHA-256:	064EB7F9A1FA05A317C6BDCA6B102BC1560D980758F9E4DDB010C9E7DC068ECB
SHA-512:	44848D60EDC79AF784A819714C0D9F62DCCB6329B47F25D74AB8C174BF9EC3F783C66FEB27F588A93FABA9BECAF076F453D6D797CE4F28461F7AE69440EA54C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Asmera

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.806258322241929
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjAWDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2D8DkOn
MD5:	1B5E386E7A2F10D9385DE4C5683EBB85
SHA1:	FECBA599C37493D2E0AEE8E21BAB40BF8E8DC82A
SHA-256:	76939852A98EA7BF156D0AC18B434CC610DAF5232322C0FBB066CD52C5B72AF7
SHA-512:	B36FABFCDB2187A3A4A211C8E033D96C91E3C4D47907D284E10786555562C82231566033EAB4753EF1E48DF1233CFC8C6C0FB3CA50748BE0B2554A972A88FBA0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Bamako

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.883634030944169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcxAQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwNDBS
MD5:	6B9BB5B37C41AA727E31BF03483DC1CA
SHA1:	CB3BBA37B063EA4A54CD15C6E30C14D8CA30D3C0
SHA-256:	F6D1BA22115A6565B6D6ABEB578F001DDB41E673C422C8EA70D0DF77B24115F6
SHA-512:	23DB3E298FDEB165FD85D99E03C00835B584984B814AF7F54A9CDD4A9F93E16B0C58342D319129F46CF8EC36F93DE5EA51B492CA4CABDAB75D84709BC6C26119
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Bangui

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.882974805254803
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcx2m/2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dw/2D4yn
MD5:	92FF9E5835C0C80F358BFE69120660A0
SHA1:	724758B43BD79DD8A29B02BE6910D492924F8280
SHA-256:	5047A507D22B68C9349EB6A48C41C80DB4C69F98F99C6574059DEA87178E36C0
SHA-512:	6FCB709DB4AC19191FECE1E8BAC55E77F265B5AF89F7A3565F06BFAF0BEE12E3EAF2F52CA09C68D75C358C25A31867505CE8AD75D7386DCD15F4BE1CE61272CD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Bangui) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Banjul

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.888193386512119
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcx79FHp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dw7J4c
MD5:	46E5703CF284E44E15E5872DF075FCBC
SHA1:	EA4BFA6D568DFA877F72302ADA21ECC2840D9FD5
SHA-256:	77E610A02CCECE3045B09D07A9BE6100F5AA9C3C2AEB543535C9AE941194F4E4
SHA-512:	1454467FE63E97DFA4DE66E359F68B2D80C92CDE59FC15A4BE513629FFD154D2281EADF3FC78F7AFDDF5A5896195F3A69E66697A659BBB1A0EAFD3E1DA6565EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Bissau

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.847843768169462
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2Dc5iDMXGm2OHGVkeoHsdSawwF6hSVPVFwy:SlSWB9eg/2D4uDm2OHCkeoH1awwFMmMy
MD5:	7E710C939B9CC0C1AC1ECF4239B543C5
SHA1:	429CC87086FB22727815ED05AC6472333FF06013
SHA-256:	2A870E534DE67713C27F2F3B9BF26FA7498C240CF633988CE76DBDAC5B69214D
SHA-512:	70D9365C31C43A95211FC20E9290B24D356FFEFA935B8829CE32831026A196DECDD12226097F6DA3B4B919E137AA0181714680CDBB72B00C130A87E3A4735004
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Bissau) {.. {-9223372036854775808 -3740 0 LMT}.. {-1830380400 -3600 0 -01}.. {157770000 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Blantyre

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.904342145830274
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc8ycXp75h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAmp1hs
MD5:	7AD3749D7047855CB9B9EC9696015402
SHA1:	F792359AD9EEC2ABD98DAFA6661C1E57BAB89EBE
SHA-256:	8F700409B8EEE33ACE5F050414971FFEE0270949842E58E9299BB5CD6CCF34DE
SHA-512:	681C1B318746C587DEBA6E109D1D5A99D1F3E28FE46C24F36B69D533D884FDDC6EA35BB31A475575D683B73BF129FED761523EC9285F2FF1E4CACA2C54C046C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Brazzaville

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.901235831565769
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DciE0TMJZp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D4qGp4D1
MD5:	7028268EE88250AC40547A3FDBBFC67C
SHA1:	5006D499CD1D1CB93EB3DA0EC279F76B7123DAA6
SHA-256:	596DB2D64CDD6250642CB65514D5BCB52F3E3EA83F50D8915D9D4FDEA008F440
SHA-512:	D623C69FE8A6050E77FB819C2F5FAEE35D5034182B1D30A409C17208155501656133E774E402875537335F8201E4734A0B5D327712CBF623AC330F1014D9025B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Bujumbura

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.947752840781864
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DclbDcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkbDEi
MD5:	0EBC2D8F0BD1A32C21070F9397EAC9E2
SHA1:	95AAA97427265635784E8AC624CA863DB9F1475D
SHA-256:	9A15867255B43A954CA60DA11660F157553AAB6A15C50ACD49D182276E0CF4CC
SHA-512:	4CD2E14F84C58E955742637A51D99DB9493972671A2B5D801EBD9D901D4903654E374C59BF010C70071D33FA17788358F78004201A787CCA2AD714D670393488
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Cairo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3852
Entropy (8bit):	3.7766651198444507
Encrypted:	false
SSDEEP:	48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
MD5:	9DCDB3DD41DA13D81EB8E1CAF56964DA
SHA1:	F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
SHA-256:	8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
SHA-512:	BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Casablanca

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	3.535398586134154
Encrypted:	false
SSDEEP:	96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
MD5:	18183122D242E0B69A80BC02BC0328DF
SHA1:	C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
SHA-256:	8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
SHA-512:	9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Ceuta

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7536
Entropy (8bit):	3.8315604186920704
Encrypted:	false
SSDEEP:	96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
MD5:	30155093248C4F7E45EF7C0132D2B2AB
SHA1:	FAD100CC49F0CB0910BDE39B43295A47512E1BE6
SHA-256:	8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
SHA-512:	469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Conakry

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.88110192592456
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
MD5:	8CDD2EEB7E0EC816F3EC051350FEBF13
SHA1:	37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
SHA-256:	3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
SHA-512:	5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Dakar

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.856992353568779
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
MD5:	946D3B52F915445DBB8EE8BF67F4EFAB
SHA1:	18345968B95E886CA72634D49F2B38F9B29BA629
SHA-256:	D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
SHA-512:	00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Dar_es_Salaam

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.8447607449193075
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
MD5:	7A819572758BC60F4085DF28F1DD1C01
SHA1:	0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
SHA-256:	AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
SHA-512:	C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Djibouti

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.829357904445218
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
MD5:	7981499F9430DC1636C9F834273E0B91
SHA1:	1D63F8578420D56E4A5D9D0881FBEC015421E416
SHA-256:	E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
SHA-512:	3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Douala

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.850101792457859
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
MD5:	44881E75AC32FA95FF6143066EF01B90
SHA1:	A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
SHA-256:	FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
SHA-512:	4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\El_Aaiun

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	3.541189246992611
Encrypted:	false
SSDEEP:	96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
MD5:	956F5B51FA8BA2E954A0E59AAC8F3276
SHA1:	AE35A8502E57EA6EE173E3B42509E4CAC73DA091
SHA-256:	5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
SHA-512:	19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Freetown

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.866631090752554
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcu5sp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dk4DBS
MD5:	6C115220CF951FC2EE3C299F86935B6D
SHA1:	A1CAB8C710BF20553AF45343118C1726CFE922B7
SHA-256:	BC53A4D489F48F14C594C4B0E52079B34E043A5751BBC7DF254A560352243575
SHA-512:	E87A4FD145B645DF034182CAD7F9D2BE5B2D9F3A17B6A9B6C84A0B3E846D92EC4C69DF2E85129B7A1AFBC0CCAAC8E3B1D47EB09F0900A82B908E9F6BF63B9736
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Gaborone

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.899477454245453
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcHK0o/4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAV+4Dt
MD5:	07222D8ED83CDC456B4D5D84C4BDE320
SHA1:	2C657F461FA3F48D56C791AFE4AB7D2EAF45AF60
SHA-256:	653AF88955C4418D973E2F8681A99552EB7BE95BCA64C736072F488462F7B373
SHA-512:	3016D0636F401BD88BCD460F6A61782E7E8A2C32CE4ECB904C711DF414038A5818F0CA3D7FC671C5ABCE70647FC674A2EF9081C5289EBFD184B44885902E007A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Harare

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.884642061266759
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc0B5h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2Dlfh4Dt
MD5:	8666DABE8D196ACD94A9691C592FAF4E
SHA1:	9F7EE009DCEAACA79C6EAA6FC73015D595467919
SHA-256:	06B82C524585192E0E8FC69DCC1CF86183A8C5EF404645DC413FCF3F8C16B0AB
SHA-512:	AAA32FD1B01BFECDD0D1C9C1DF1163374DAFE094C75720EA4095C34F7EAE7DCB594D1A7F6A2A90FB43FF01020F7AEB48E92496E0EE2D039AF23076CD369DD2A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Harare) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Johannesburg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.695542624694403
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DWbzDm2OHePoHvmmXsd//HF2d7d6VcF2d6KsYov:MB862DW7mdHePCvmmcZvF0cVcF/KsFv
MD5:	F0E153FC9B978E30742ABC025CA45E02
SHA1:	73D96F3188190DAC2453E6F18A1C683CECB9CDE3
SHA-256:	5EEF6475E1312051037FCAE3354E32DC0910BE7A5116B71F8CCBE1CCA08D3F1C
SHA-512:	E66F4B5FF18BAAD53AFB1ED36A0827115C793075A61F794F26F32BC9F6799DF816A1F817BEB0C0BC938F89E6F5BFBE1AB4F504F1AF518764103FB287746552C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Johannesburg) {.. {-9223372036854775808 6720 0 LMT}.. {-2458173120 5400 0 SAST}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {-829526400 10800 1 SAST}.. {-813805200 7200 0 SAST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Juba

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.027824722230131
Encrypted:	false
SSDEEP:	24:5mesdOkMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8M5:5YMV04MSHMzNxMbwM0JXMfCsMzaMq0QJ
MD5:	32EC0589260D9D4BCC85FE91E6F04D00
SHA1:	BAA269852C4AC6B89EA7941E7A75A007E0CF9EDF
SHA-256:	F2646E15488ABF2E960759CEFE5705416E71DA71BB8407B26196244FD1A3394F
SHA-512:	4F485453BE1D186ADBE0908852475C63C57BA498091C222EFFB9A5FEA2DB7F55E1BB2DBDBF6AC0F24CC67D47549FA3F5257655B5449B1BCF1FB5CDB27B03D501
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Juba) {.. {-9223372036854775808 7588 0 LMT}.. {-1230775588 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Kampala

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.837466713772859
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcJEl2DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DIEl2V
MD5:	E929ED1BC316C71AABE7E625BD562FB1
SHA1:	C20C172518C02D93327F4BBBC5D410BFFEF5039D
SHA-256:	8EA3028CE2B025F0C457DC8F7601279CA5AF565A88B9FE80208F9F1030F2B0D0
SHA-512:	B2FBCF06EACCF18DE97AF1D6BC57D9638E0A36DBF17044FF97F6B9E5089CF9E13E1304F304495324C0ACC1128A7D2D494E7C1FDB95DB0855FCE54F7028096C50
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Khartoum

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	4.0421745451318385
Encrypted:	false
SSDEEP:	24:5xe9dSXMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8MM:5hMV04MSHMzNxMbwM0JXMfCsMzaMq0Qc
MD5:	2BD3850DDBE2F05BF6F24F3AEFF7516C
SHA1:	22B0DBB54E071F30D51A8654CF103F99537F74CD
SHA-256:	F475DB8A857A46B310B12C21D6A9BC6CA9FF2960DA429A9D57FA375F9439E13B
SHA-512:	1CF82FC07348C697F26625673DA7E3D734358B3FBE69D8E2132CAC0D9F00C7E8CDC353676CD9BAC4CBB9E26CF6638CEAE41DF559E7445D9C453409D7115FFC6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Khartoum) {.. {-9223372036854775808 7808 0 LMT}.. {-1230775808 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Kigali

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.910322325134086
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcCJRx+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DRX+DEi
MD5:	3017253E1C6ACCA8D470A014E4BB321D
SHA1:	671B7AC04580B56E2C34F88D123E8296947DDD7E
SHA-256:	73FEB807006897B4B485CB82394867444E890265EFE960EC66D6C0E325DA9372
SHA-512:	2498C380D761A16C183D78BC1BB18B1D2A1BFCB9C703D86A3FC04CCCE43D88C8D4BC3C47CC31639B78A5FE9C8A7445E9DBB52062E2F3B737DA1E7D0FF70F140A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Kigali) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Kinshasa

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.866127364448228
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcqQFeDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DdD4yn
MD5:	41209A335A99803239A854575190C5ED
SHA1:	E6EA627C25513B9DDE053F9A24D509AA317C30A1
SHA-256:	611375C4901AD6C4844C2BB7D02FB17F34996F49E642546A6784D6F0B28530CC
SHA-512:	DF2C0B131F35F54DF5EBF7F8459F98DBABEB6F081247BA95B5D7B41146E2A2EF9BC6B1D909DE57A1223D9C258AB197D9668ED2E111A365C86BABDAA7DF551FB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Lagos

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.7936510664790815
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2D4JDm2OHWQvvoHvBsp9boFvoHzIX7uRe6vF9:MB862DymdHWQCvqpmVCzIq
MD5:	EC08046589E85D999A597252FF5368B7
SHA1:	126E3DE158E1E7AF4737D0AB5B51C0F92F416DC7
SHA-256:	DCC9F52F539A67DFD7ABAFDE072ACDAE2B67754C559C8A5FE61979F5A286A066
SHA-512:	84B9AB18BC343C8B8934F5FDD2E2EB413925B04D6F5394AA8337B7B55E6487FB071A83A69BD4D0FA40F7F31EBC57B9908729674542CEA3083D700FCD02D77633
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Lagos) {.. {-9223372036854775808 815 0 LMT}.. {-2035584815 0 0 GMT}.. {-1940889600 815 0 LMT}.. {-1767226415 1800 0 +0030}.. {-1588465800 3600 0 WAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Libreville

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.865878143076229
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcr7bp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dgfp4D4y
MD5:	35D8A58EE21E603C6FC4FB896AE6B3D0
SHA1:	F1D0A939D761F3F0954F045814CF5339A5597036
SHA-256:	AB3E797548C7663CF9ABA7FE163635FF7CAB9E6CB61FA1644C0F7B4B5CCE8B99
SHA-512:	97717961987F6B6832C24A7833150CDFE7E82BBEB32DFDB84D2500442AAD9263F8BD4E879591E913D56E9A1991C389EF730211853647A889F358AE3FA37C0185
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Libreville) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Lome

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.862780607964543
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcih4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DNh4D4
MD5:	EA21ABBF8B11953916A1C509B8A1B427
SHA1:	35ADC230C57B001BE8A99A3D2E34B609A60A1162
SHA-256:	EACA9124F17E5B11F27D11FA6141D19EB3AC23E155E155B73467BDAA3BC99AA7
SHA-512:	A7972D4F1C5FB988CA04B39E2CDD580F51383BA9D7A66C478275C11A07B8D7A6EFF53A3E1929B0D89F10BCC39D22F285DB2601ED60DB4647C65465643F70C137
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Lome) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Luanda

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.856982839546061
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DccLtBQDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DXQD4yn
MD5:	40CD47F6DCF51EBEFEF42489F1716257
SHA1:	DF245192A1899A72DE01A57F6969AC060E841734
SHA-256:	4C2FD1E44DFAAF0C0DD2EB56B84B538F1E2D84B301AB2CFB8EE7759783501444
SHA-512:	D39BEB0EEF344B1A44F7D6A806A1D5B956D7D402648EE0C67C4BA46493236840AF975D89A91B2D33B8AA7D6DC9A051E66718DCDBC1C83B0E964215C2E32ED923
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Luanda) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Lubumbashi

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.940313336280723
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcfpT0DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2D8pT0Dt
MD5:	71A5DE1276902DB1542840318F9B1AF3
SHA1:	AC3825BF343482E0E4D9D6FAA6FCA4D1A125433B
SHA-256:	24384EEC359FD24D181AAEF3C017E3C345490A8D352B29D19B1B143A29A811C2
SHA-512:	2984EB42A79B8B32BB93DFE71F1C4C0CABFDC9B0A199971347BB3473463FA07FDB5D20227D288BF8653B1BDE347E1297459BBB4C3C34AF7A5434FBF945683577
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Lusaka

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.905174746463853
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcOf+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkDEi
MD5:	1D7FDB388535CC59742CA0F1AEE27FBD
SHA1:	A99FF2CAC47FD333429C22B271E190D979EEC024
SHA-256:	B00801A7279741434D9C2D7EC7322DD93B85EA4F5C9976AB3A43F0AB142E1553
SHA-512:	0174D3C6F9116C36C62AD1EB58203EE7DFE8C37F618B8449D5E45AD6290CF8334F28798877D7A563A12EE533026244D6A49BCCF29B5D7FCB5BCC91481D0DDDE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Malabo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.857096806490649
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcn2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D42D4yn
MD5:	1CA9B3E7BCD5BC1CC881453D16B09389
SHA1:	1B1964B314E72847D71A42C147CF2BF331B44461
SHA-256:	35D56EFFE9E7E60F17B32BD30486E566B635F0AE7A8948D77395B8E6332E26F1
SHA-512:	9E08D57B7824F5B076D159D9A5106E51450DF24729C36F485B9B68E8F47E8DFC50F9BEC3F11E0AE6579A8E372A5C0F0DA18A2E797CF2115519D1B4E5B64413DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Malabo) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Maputo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.952872531197478
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2DcfKiMXGm2OHoVoHvdSF2I:SlSWB9eg/2DEZDm2OHoVoHvdI
MD5:	CD429B6891CBF603A93F9A9733E2391B
SHA1:	C6833B83B6D1694AC632018A27915E6F97F708AE
SHA-256:	FE6B6A4BE1B61F7F909A3F6137530DFE6D1754499A4D9B0D1CE4952FFF0AE62D
SHA-512:	6E57B70B71515998AD617954F9DDAE19968B20946542201153DAB47FBE63790D42F41AE29148ECBCE6D12812879BCF0A4EC881507B62CDB2675AB20267220BF9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Maputo) {.. {-9223372036854775808 7820 0 LMT}.. {-2109291020 7200 0 CAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Maseru

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.964472328419063
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DZQs+DWb4n:MByMaHw7NH/t2DZiDWU
MD5:	88C8FF2B480648EDADBD0FB93F754275
SHA1:	BED7A784C378909914CEB0D303DFE6D05FD576B7
SHA-256:	1D80FD86CB733D57D88ECD404E702F750B233ED0CCBFBFFFEED1AAD3B7F1CB04
SHA-512:	CB7F831CF099E85B948AE57FCE9D91C7EAAD39753AF82C56EC15B65830EB4115A71BBC83A71A2AC947CAB24DEDDB557E02FAA5A3264546AE6E60607DF6BD2FA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Mbabane

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.957246428185456
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DzjEHp4DWb4n:MByMaHw7NH/t2DzjEJ4DWU
MD5:	CA7255B86425BA706D214924856B6818
SHA1:	E9BE6CF871BB1786E842953D41392299952EC9AC
SHA-256:	547197C09C1987350AE5720A4EEC7E8D8F4B9F4A0559726E225E13C707F7C564
SHA-512:	23F9AD0F926A0945A17BBC3DCFF9A3D7EE68EC9423EA78985F5FFC60CC61641B57871F9AA703B5FB9BE842DCD4693D0641F9EDED702240873F58D24CD4D60C32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Mogadishu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.877126792757121
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcBEBXCEeDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DFSVDR
MD5:	5C2E2B5189E0E816D5BD7AFC8B49A35E
SHA1:	4E43A1ED51399528636D6442B1DDFFD820911407
SHA-256:	25E221BE49DEC5547A74AEB91B0041859C59BC866987272A447AB2343D1CC30C
SHA-512:	B74735CFAB692756BAADFB1A51A8CC0C986F981D8E7E7A8182370A9017E67439875F0115820A349AFB3BE2FA581A721440968EF817471DD2C5E1286E53B2FE99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Monrovia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.8660011420394955
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2D3NPDm2OHrFGxYoHvlHIg5pTwdPsy:MB862D3NbmdHhmYCvdIg5GPsy
MD5:	1B3C94B5098E454981C73C1F2AF80164
SHA1:	1EBA9E2DBEA70BB1AE5EB13739518AB5A62D2130
SHA-256:	2BF0D90610211651127402680519B29AB50B15D344263D0C1A22EDEBE5E01E27
SHA-512:	DA4A0BCE7C6750BD7D3BA76B6301B9390723BE0C001C39BE453D80BD87020C2253A75629F68F83C19410D2A75FAF5223A435299CD4AA53DE545EC7C5B5AA54B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Monrovia) {.. {-9223372036854775808 -2588 0 LMT}.. {-2776979812 -2588 0 MMT}.. {-1604359012 -2670 0 MMT}.. {63593070 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Nairobi

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.655052651600954
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2Dk1Dm2OHsvT5oH99VCV22ufPnVCkVBKBQn9q:MB862DGmdHsvVCjkifvdH9q
MD5:	B640661FB37BB74FAB172DBDF1B433E1
SHA1:	0236A5B53443A4A18B8B9D6AA7732620BE9A6553
SHA-256:	BD8E9765174431C0D403249D3E881C949C83966E9F8162552DA88AE53132467B
SHA-512:	53DCC6DF7C3E0B00A6D98A8DCC4988C8CFD6B53CC89E6F8D32DA41CB532A62D9C6A823675C5039F5639CE0D423F6D571F46F5B93FFC7EFFB4EDFFBF89D46AA12
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Nairobi) {.. {-9223372036854775808 8836 0 LMT}.. {-1946168836 9000 0 +0230}.. {-1309746600 10800 0 EAT}.. {-1261969200 9000 0 +0230}.. {-1041388200 9900 0 +0245}.. {-865305900 10800 0 EAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Ndjamena

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.856754881865487
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DjUfDm2OHNseoH1axCXFHzaSmkFWTvF9:MB862DjULmdHPC1XNzaS3yz
MD5:	EDB548348E590C8CFE04ED172D96B86C
SHA1:	AD3B631FB03819772164402E202AFA781687F597
SHA-256:	9ADA5F5AFB25E823E1F0E8AD2489AAA1C09F01356634A9403670D7AB21CA2E2C
SHA-512:	17E396A9BE497077B774AD1108CC8760ED35FC92F65FFF070F9ACD3C4FB67A335C1C57DF1CCB1570DE14B708EFCA0063990A969E30759C9A47731DA45ED25EFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ndjamena) {.. {-9223372036854775808 3612 0 LMT}.. {-1830387612 3600 0 WAT}.. {308703600 7200 1 WAST}.. {321314400 3600 0 WAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Niamey

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.871519187180041
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcdhA9Ff2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dsh2f2D1
MD5:	0134039CD1666E983A9B6E43ABD6AF59
SHA1:	A2A99345390F4D17C892CEADE58C604257686764
SHA-256:	B517120AD8DB3F21EAB4E44A78001EE856EB4EA35852C54CCA96D38887DEBCFA
SHA-512:	E5911ADD3D776D87ACFC986C4D2564E3ED9AB12C67F23391ED35FF2A31AD8314B873E31DB8DA4D5E0DAEA12BE34110A8F0C27C9C6126977BAD51C6AD5CDFA39B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Niamey) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Nouakchott

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.909962899502589
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcboGb+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dqbb+c
MD5:	550E482599C2F4280F2C258019BB2547
SHA1:	A39045BEF313094CEDC100A7D695AE51BC9E498D
SHA-256:	64CAF2BF9D45095DF97F419714D5617CF6300ACDB544B621DCE1D594AA9B910C
SHA-512:	4FD29C5B4C0D2BDE69C437E9BF4F08A11E1DAAA689B69F28F3551F550BDCCDD055E4C1A241EDB2FA48B18825AFF792F4860F55983E106EA8224F1D87ED4F7546
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Ouagadougou

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.920023025906233
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXCZDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2D1DBS
MD5:	6CFC4E938E50C9B591F8CC42A14FA82A
SHA1:	FCE14A5CA62C9005C76D27B849A238E76C834F8A
SHA-256:	03B9C1FE350B5E9F6F333F9519FA394DCC562308D9388A903AF3D3FECEBDC762
SHA-512:	98F22F1D23A9930276A2D306A1473E64DC43547A16CFD01226E4F030A26A3CC4FDED77F790583CC5C078FC6DFCCE81C16A50879AE46A0D3A6F1FA98373F413C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Porto-Novo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.893842293207225
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcyTKM0DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DQD4yn
MD5:	6D979FCD225D5431C7391AE568C6409F
SHA1:	6C9DCD222061CC00FD386773C6BB2861F3429A60
SHA-256:	8FB8692DB9281AE2B087D704168BFD47D3D0901781FEF65BFD62FCB213BA6B50
SHA-512:	32AFA6AF6BFC3D42CA636DD2B96906048EF1ADFBB135BB7E7B77C444FED99FDABB84FBBADF56EC63828FFA7B3371191FF1311822B1C75241EBD9CF602467088E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Sao_Tome

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.818597723513168
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DXDm2OHH5oHvzdoH1aNbbFHRMy:MB862DTmdHH5CvzdC16bZRMy
MD5:	28A5967C797F4B38FB63F823D6F07168
SHA1:	17872E91683B884191D2E4C777FB79DCE6D73EE7
SHA-256:	BA1D60DF2B41320F92A123A714E17E576C89383526B96E0541A464C3FBA415B7
SHA-512:	B335E3D3268631F3A71F4BAD59740F3A5222344E8223C201B8FE885BAA7F1A550FA7778E498D6DC2111F41053856F50B21413AECCE84B80833EC8176F2A1009C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Sao_Tome) {.. {-9223372036854775808 1616 0 LMT}.. {-2713912016 -2205 0 LMT}.. {-1830384000 0 0 GMT}.. {1514768400 3600 0 WAT}.. {1546304400 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Timbuktu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.905303708777235
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcHdDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwdDBS
MD5:	F2D7F7BC4EA3629EC7F0E45300A0CFD2
SHA1:	E7594D378C5DCFEB1E87E13AC79A026260D2E630
SHA-256:	9D8009ACAB019B32B1E87AB10E0AC3765ABCABE8066318DA8CA4905D41562F72
SHA-512:	795E58172907020C85CF0B10BBA35842D5F92872CCB3382DFDC787BAA504C79927FA23BC3104AD63541A95C44CA80977E8247846DE918A0B00963B970F4823D2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Tripoli

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.151253074491018
Encrypted:	false
SSDEEP:	12:MB862DrmdHrCDWR+f7Zn9ueRSmNvlTtuyI/ZBv8dq8Jw4VFZBZYEuAENSfp8kSYx:5veuDkWx3NdT18kbjjAkxTx
MD5:	2DF9B050D82B06EB89DA908C31C1F1C9
SHA1:	CB294E12560A98D5CEA3BA7004B5519B6C22BAAC
SHA-256:	B447B6B1C351E77F22A2D77C0437F2BBB7D8BDFDFDC3D6285E0D260519CC7110
SHA-512:	BBE281D551E9F8DA7B6BB08D809177615410A11E4B1184ABD220EA8B1F355B2BBC090C6BAAF7E07FD61286891388ECD4026D4433C4E4B6A8D201F8D95E174532
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tripoli) {.. {-9223372036854775808 3164 0 LMT}.. {-1577926364 3600 0 CET}.. {-574902000 7200 1 CEST}.. {-512175600 7200 1 CEST}.. {-449888400 7200 1 CEST}.. {-347158800 7200 0 EET}.. {378684000 3600 0 CET}.. {386463600 7200 1 CEST}.. {402271200 3600 0 CET}.. {417999600 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {465429600 3600 0 CET}.. {481590000 7200 1 CEST}.. {496965600 3600 0 CET}.. {512953200 7200 1 CEST}.. {528674400 3600 0 CET}.. {544230000 7200 1 CEST}.. {560037600 3600 0 CET}.. {575852400 7200 1 CEST}.. {591660000 3600 0 CET}.. {607388400 7200 1 CEST}.. {623196000 3600 0 CET}.. {641775600 7200 0 EET}.. {844034400 3600 0 CET}.. {860108400 7200 1 CEST}.. {875919600 7200 0 EET}.. {1352505600 3600 0 CET}.. {1364515200 7200 1 CEST}.. {1382662800 7200 0 EET}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Tunis

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.150944563639585
Encrypted:	false
SSDEEP:	12:MB862DHmdHjCvbB/lxRjntMVyoKCyFWeey0XSe/OSyHaCgmvLOcSFQSFeSTC6ZPJ:5LemvbplxRhbv+yuh2tIee6kvcw9Cy
MD5:	0C99335A41D33AA8BC1EDA0CB4CDCBF5
SHA1:	5CABC28D318FA5B8307429EA571FFF91EB8E1252
SHA-256:	0760D1028E733888E43E7F1E057217DC2B52786029FCEC67B27EB69CC6A54938
SHA-512:	C8FE685ACA46FD4836F3AABC15833F294E5EBED123A487D04E74A8C5668BDFAFB96D2326760452A6E5A1B9CC25AC6C3918D8C10A7F8EF737456640E3000BBA2F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tunis) {.. {-9223372036854775808 2444 0 LMT}.. {-2797202444 561 0 PMT}.. {-1855958961 3600 0 CET}.. {-969242400 7200 1 CEST}.. {-950493600 3600 0 CET}.. {-941940000 7200 1 CEST}.. {-891136800 3600 0 CET}.. {-877827600 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-842918400 3600 0 CET}.. {-842223600 7200 1 CEST}.. {-828230400 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796269600 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766634400 3600 0 CET}.. {231202800 7200 1 CEST}.. {243903600 3600 0 CET}.. {262825200 7200 1 CEST}.. {276044400 3600 0 CET}.. {581122800 7200 1 CEST}.. {591145200 3600 0 CET}.. {606870000 7200 1 CEST}.. {622594800 3600 0 CET}.. {641516400 7200 1 CEST}.. {654649200 3600 0 CET}.. {1114902000 7200 1 CEST}.. {1128038400 3600 0 CET}.. {1143334800 7200 1 CEST}.. {1162083600 3600 0 CET}.. {11747

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Africa\Windhoek

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1649
Entropy (8bit):	3.9974091170263066
Encrypted:	false
SSDEEP:	48:5t+Lmcz0iMHHWMbnHoMcHiM0H+MCySHr/MDHqMafHO8MwHJMHHOMHSHWMHHXM5Hs:OLjQDI6jZ2WFcv
MD5:	4846FB13467BA93EB134D88228D7F534
SHA1:	477FC6144B7DF365606A2E44EF1430F8DF6FB841
SHA-256:	DFC3D1FC182B315B31D999BC103C264BD205EB16F971C8636003A71170D7BD7C
SHA-512:	A719F5083F66CE44FE047880A10B2ED04B66E01C7F0F7DADAE2FFB95172308F091D669BCFED5A236D2A0F80A4A1D78DA7A778DDE3FAECB40170ECDA705573769
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Windhoek) {.. {-9223372036854775808 4104 0 LMT}.. {-2458170504 5400 0 +0130}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {637970400 7200 0 CAT}.. {764200800 3600 1 WAT}.. {778640400 7200 0 CAT}.. {796780800 3600 1 WAT}.. {810090000 7200 0 CAT}.. {828835200 3600 1 WAT}.. {841539600 7200 0 CAT}.. {860284800 3600 1 WAT}.. {873594000 7200 0 CAT}.. {891734400 3600 1 WAT}.. {905043600 7200 0 CAT}.. {923184000 3600 1 WAT}.. {936493200 7200 0 CAT}.. {954633600 3600 1 WAT}.. {967942800 7200 0 CAT}.. {986083200 3600 1 WAT}.. {999392400 7200 0 CAT}.. {1018137600 3600 1 WAT}.. {1030842000 7200 0 CAT}.. {1049587200 3600 1 WAT}.. {1062896400 7200 0 CAT}.. {1081036800 3600 1 WAT}.. {1094346000 7200 0 CAT}.. {1112486400 3600 1 WAT}.. {1125795600 7200 0 CAT}.. {1143936000 3600 1 WAT}.. {1157245200 7200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Adak

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8447
Entropy (8bit):	3.867931581740766
Encrypted:	false
SSDEEP:	96:6hvOs5vveFaHU6lgqN/zNMkixlrxYTMcmo1LWF59:6hvOstgqN/zNMkArxiZmf
MD5:	DF52E726B33FA47EB115C1233614E101
SHA1:	26B0E49022FCB929F0160617F9C9D2DBEDC63610
SHA-256:	77231D179260C08690A70AEE6C2517E4B621ED4794D9AEEA7040539F4FF05111
SHA-512:	48AAF25419E07B06E076B0E19F9A0C27EB257556E62FD8F7B2AA963A817823DD89D33AB6AFEAAC2EF2230361D76776355E19CC2BBBB4D19536F823A347AC8AA4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Adak) {.. {-9223372036854775808 44002 0 LMT}.. {-3225223727 -42398 0 LMT}.. {-2188944802 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Anchorage

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8685
Entropy (8bit):	3.9620252256806845
Encrypted:	false
SSDEEP:	96:esKLO6KLC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:etLhN9DiaJCUbPI+D/iMpCIBSuk
MD5:	BFEACEA04AAA8A69A9AC71CF86BCC15C
SHA1:	1693971B8AAA35021BA34799FB1B9FADC3DA0294
SHA-256:	DE7FBE2B3ED780C6B82099E1E249DD41F4452A3ADB9DD807B1D0EC06049C2302
SHA-512:	E94112A2A5F268C03C58CE3BB4C243B2B9B0FC17CB27FDD58BCD2CCC8D377B805C87A552AE7DE1C5698C5F2C4B0FCAB00A3420B1DAD944C1A2F7A47CE7118F78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Anchorage) {.. {-9223372036854775808 50424 0 LMT}.. {-3225223727 -35976 0 LMT}.. {-2188951224 -36000 0 AST}.. {-883576800 -36000 0 AST}.. {-880200000 -32400 1 AWT}.. {-769395600 -32400 1 APT}.. {-765378000 -36000 0 AST}.. {-86882400 -36000 0 AHST}.. {-31500000 -36000 0 AHST}.. {-21470400 -32400 1 AHDT}.. {-5749200 -36000 0 AHST}.. {9979200 -32400 1 AHDT}.. {25700400 -36000 0 AHST}.. {41428800 -32400 1 AHDT}.. {57754800 -36000 0 AHST}.. {73483200 -32400 1 AHDT}.. {89204400 -36000 0 AHST}.. {104932800 -32400 1 AHDT}.. {120654000 -36000 0 AHST}.. {126705600 -32400 1 AHDT}.. {152103600 -36000 0 AHST}.. {162388800 -32400 1 AHDT}.. {183553200 -36000 0 AHST}.. {199281600 -32400 1 AHDT}.. {215607600 -36000 0 AHST}.. {230731200 -32400 1 AHDT}.. {247057200 -36000 0 AHST}.. {262785600 -32400 1 AHDT}.. {278506800 -36000 0 AHST}.. {294235200 -3

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Anguilla

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.908728298285591
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290/8J5290ppv:MByMYbpwt290/8m90b
MD5:	1C3CE9F156ABECEAA794E8F1F3A7ADDB
SHA1:	6F84D0A424FD2DE85E3420EA320A186B277B0295
SHA-256:	F38610019C0A2C18AC71F5AA108B9647D9B5C01DCB55211AFB8312308C41FE70
SHA-512:	CA2DA6F9551E4DBF775D7D059F6F3399E0C4F2A428699726CD2A1B0BB17CCF5CDEEF645EE1759A2A349F3F29E0343600B89CE1F4659CF5D2B58280A381C018AD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Anguilla) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Antigua

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.898881450964165
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290//MFe90ppv:MByMYbpwt290//V90b
MD5:	DB16FFE76D625DEC731AB6320F5EF9BF
SHA1:	D286994E03E4F82C08DE094B436FA098648AFADE
SHA-256:	561E58E11DC5A86CAE04B5CB40F43EFCFF9ABC0C841FAC094619E9C5E0B403F8
SHA-512:	8842B616205378AF78B0B2FC3F6517385845DE30FFD477A21ACFA0060D161FB6462A3C266DCFD54F101729446B8E1B2ECF463C9CF2E6CE227B2628A19AF365F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Antigua) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Araguaina

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	3.733307964154526
Encrypted:	false
SSDEEP:	48:5KChlvEw6kSSx5H4a8tf3fkuozd23t8VZDG8+GCRRRd:QIlvEwJSSxdF8tfMuozdCt8VZy8+GCRB
MD5:	9B01680A362EA7B462DC236F6A35E14C
SHA1:	456A5E771F6B749BFDB2BFD59836A6A930499881
SHA-256:	B1327CBEC20A21E3FF873E28A2EDFA271EE3A5C01933779300EABD6B185DA010
SHA-512:	E6C2F5C489BEA31B0AAC3CB1DB750AC2B665DAC0AC82C1CE6756E768305300297BA5E3B32EDEB9E1715452F02223E47674C4F2B1844920F664623C9F34309240
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Araguaina) {.. {-9223372036854775808 -11568 0 LMT}.. {-1767214032 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Buenos_Aires

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.7664759014118188
Encrypted:	false
SSDEEP:	48:5p9uuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0wi:jIu3pfe92jCs/VOHv2kdeRtnxafwwfF0
MD5:	2B9A1EDE5110B46E24F4726664EA1E3F
SHA1:	939D1A7A50544F34B318ACDB52BC6930FE453F6D
SHA-256:	BC86AC89121EC4AA302F6259CCC97EFFD7022DC6CEE3B291C57DA72B6EA0C558
SHA-512:	C204740DACBCECF2CC5CF4FEB687E86B9150512623203C999D6F4EB5FB246D07681A35C28D8445F6A50F49940C321E0AA5E51FE5A73B8ED076F29CEB5B4D4CA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Buenos_Aires) {.. {-9223372036854775808 -14028 0 LMT}.. {-2372097972 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Catamarca

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	3.742645155048276
Encrypted:	false
SSDEEP:	48:5/nuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0NC:Vuu3pfe92jCs/VOHv2kdeRtnxafww3mP
MD5:	3D2AF5714DFC392ED4BC976784D5A58A
SHA1:	9252DE40B6EF872E1D2F7CDD53DDD21145E93C5C
SHA-256:	A516BB0937977EF949D47B3C8675E30F1CA6C34F8BD298DCF6EBB943580D5317
SHA-512:	8D5FFDB5B578B8EA0291D3A21BDDE25F8301CB16B11AE794FFBA8DCFFE46F6AC5EC03D93E511061B132D84E69E5FAF1BB212837EB8A5A4B4BE517F783837E615
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Catamarca) {.. {-9223372036854775808 -15788 0 LMT}.. {-2372096212 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522740

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\ComodRivadavia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.72138001874583
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/290/MquQ90/MMXAy:MByMY/MYp/MrRt290/MquQ90/MK
MD5:	8A609667DE461CEDC1127BE38B161459
SHA1:	557D2D55DEA38D1CD1103E183F89C65F4016662B
SHA-256:	8CCD6FC77D55582938F1912B1BA66035882D1BFC18A797C631E5E89ABFBF570B
SHA-512:	DBAFDA069DB5FDBCBA11050AC91A733C1712BD6395939CFFFC5EAA78BD0B70B4AF2D9FB8954C6841CCF3AC5F8EDCF08E604D3F2CF67F1CBEA5EB6D3C4DC7F2FA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Cordoba

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	3.7481312409221594
Encrypted:	false
SSDEEP:	48:5lxQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0n:/xBu3pfe92jCs/VOHv2kdeRtnxafww3j
MD5:	8C1D665A25E61CE462C2AC57687763BF
SHA1:	B5BBC26CF6A24BD5BEA42AC485D62C789B80905F
SHA-256:	FA75E274240A341C6BFE3539CFDC114D125AEAEA3161D3C2409347CF8046042A
SHA-512:	A89A7A92C025B87DA4CDFE99BF70CD0E64690D7BFE827DCBFBF0E91B188003FA26487E72B6B950D3BFC9C854B890E5936F414BBEAAD5F3F0673AC5EFE273CDF4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Cordoba) {.. {-9223372036854775808 -15408 0 LMT}.. {-2372096592 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Jujuy

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	3.7481290145270245
Encrypted:	false
SSDEEP:	48:5HluuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwcSPAC8OS0E:xwu3pfe92jCs/VOHv2kdeRtnxafwcDCK
MD5:	995EDE9E1E86DB500C7437A196325E21
SHA1:	4A8FB1511AA124CA2D299EC8DE155EE9D0479180
SHA-256:	43EB79ABC03CBAC661C563DE1BC09D9DD855CBC72DD2B6467EA98F0F90421BA9
SHA-512:	B58B35EA1B2F0388B8108DCF254F3BD1B21894F00A9F313ABC093BC52C36FCDD94B7486DBA38161C9EFCDB12BC3CD81E7E02395B0CA480A7F01148C43CD3054F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Jujuy) {.. {-9223372036854775808 -15672 0 LMT}.. {-2372096328 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\La_Rioja

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	3.744252944523733
Encrypted:	false
SSDEEP:	48:5lduuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0NC:Tou3pfe92jCs/VOHv2kdeRtnxafwwkFP
MD5:	4A45A063D45EB94214005EF3CA5BCD6D
SHA1:	2420E8591DC53A39EE1A58B2E45DCFAF9503685F
SHA-256:	2B018B791E48269FA9EDA12662FFEC3E2DC33603A918E8B735B8D7D6BEB3B3AA
SHA-512:	0B2824FA3D40B2EDBE8488D50C30368F4CF6E45A39FF6DEBC5BB4FD86F85AD52F5331AD1EB50E5166FA2E735B7E8AA9D94A5FED9421334DB0499524DBE08F737
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/La_Rioja) {.. {-9223372036854775808 -16044 0 LMT}.. {-2372095956 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Mendoza

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	3.738002814507529
Encrypted:	false
SSDEEP:	48:5CPBuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwGSmSc8OSI:GUu3pfe92jCs/VOHv2kdeRtnxafwGJld
MD5:	F6CB24E8567B2443224E9E17EE438BFE
SHA1:	8029426C30C4C645EA77C6240391CDB1C3107568
SHA-256:	DC39400BBFD5BDDDC174FE099194806FBFD3FC3AA20E670D67BE0AC35FE97AD4
SHA-512:	6869CFC24C21FBB2DFCCAA9AE7E21A0B24DC002EE792FB28A8F2F05C75C20E93C95A39BD8653AA272AF10FE95922B99EECC1208AACE814817D9441F84360E867
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Mendoza) {.. {-9223372036854775808 -16516 0 LMT}.. {-2372095484 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Rio_Gallegos

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	3.7580685839169545
Encrypted:	false
SSDEEP:	48:5oQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0NC:qBu3pfe92jCs/VOHv2kdeRtnxafwwfFP
MD5:	212D13CE27AF114A8EC2E04023D218C4
SHA1:	C4C5F86BC6EC0D5EA4C9CF199309D085767B97E8
SHA-256:	A05B6708DEFF0607396BFC6661C2287341C3432841AE353D94A67AC742B5FAFA
SHA-512:	CE7201EEA6A86FB49641410D2EEE4030EDB1B96F3218D764762F5AE23883C796F5742ED69CEC985A9D3582D6C72ED74114DE81508F6DEB4B54865B6974ADC965
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Rio_Gallegos) {.. {-9223372036854775808 -16612 0 LMT}.. {-2372095388 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Salta

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2011
Entropy (8bit):	3.7415813345133975
Encrypted:	false
SSDEEP:	48:5NPuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0wF:72u3pfe92jCs/VOHv2kdeRtnxafww3mz
MD5:	A06C33CDFD7E7B630CB1DF34E72E61E5
SHA1:	694826B9B910DA0BD70A9CB547C26E6838B08111
SHA-256:	CAEFC60F2F36EF9FFE0C5921C3C392DE1E95755683A96C1C4EC0BA2C242A4D84
SHA-512:	D6696A6C14EECF2B77EC586F40137BDD95E5CE5C5193570C809FAB9E5FCA4B8744283CEB6818E525C73F6EFF657274410B2622902EE8C15912C8D5F5FA5C805E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Salta) {.. {-9223372036854775808 -15700 0 LMT}.. {-2372096300 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\San_Juan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	3.747934819596411
Encrypted:	false
SSDEEP:	48:5vXxuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0K:hUu3pfe92jCs/VOHv2kdeRtnxafwwkFl
MD5:	32A50D0ABF408D9E59C0580D5B8CC472
SHA1:	EA5BB8860982F8BAFEAEFDE1D6ACD440DA132DFE
SHA-256:	41B2C25E42146A76934B866061BB3245B8ADA0FF4E1BFBA6F8842A30BDD5C132
SHA-512:	E5D2521A4EF53AAD3E74506708EC2768C4D2EE8D6D014DCCF4A6DC290B713B4D46021B66527548C35004E10D753E1B685EEFD55BBE7BF01EC6104D7D8AAC4403
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Juan) {.. {-9223372036854775808 -16444 0 LMT}.. {-2372095556 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\San_Luis

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2081
Entropy (8bit):	3.7399269084699975
Encrypted:	false
SSDEEP:	48:5MDuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafw6bS2nZSbdI:yCu3pfe92jCs/VOHv2kdeRtnxafwWnZr
MD5:	FB06B66F5D41709C7E85C8B1E9BFCFA0
SHA1:	D5C0C4B12C6190856C300321B1C106C7474BA54B
SHA-256:	A43B35F25E54EF359D046E33281C0A978F0EE8811C93A6809F1F65750878BBB6
SHA-512:	D445F46D6A17A075AD995885E45234A711F53BF3FE2DFC6DFBB611E8AC154B10C91E137927DD66D6A7C596A93BAE5DE283796F341B5095FA0DD05595E1C3A077
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Luis) {.. {-9223372036854775808 -15924 0 LMT}.. {-2372096076 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Argentina\Tucuman

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	3.741704529449777
Encrypted:	false
SSDEEP:	48:5yZujuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OSf:suiu3pfe92jCs/VOHv2kdeRtnxafww3w
MD5:	D9497141EC0DC172E5FF5304FED0BE6B
SHA1:	CD20A4F0C127A84791093010D59DF119DD32340A
SHA-256:	0F7DB23E1280FC19A1FB716E09A9699ADA2AAE24084CAD472B4C325CC9783CCF
SHA-512:	0B71952055013CD6045ED209FD98168083550655FAB91B7870C92098E40C4FE6827EAAF922D34ECE28298CBB14327A76AD6780D480E552F52F865AA11A4AA083
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Tucuman) {.. {-9223372036854775808 -15652 0 LMT}.. {-2372096348 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Punta_Arenas

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3698
Entropy (8bit):	3.6242875066986078
Encrypted:	false
SSDEEP:	96:22SW+xUQjzoMUBI0nuUoDKlHslPlgiot7JC/Xk8NWse4r4g5xCEmSdLkUsZOn+ZW:28+xUQjzoMUBI0nuUoDK6lPlgiot7JCV
MD5:	11B8DD9FB854C62D7692EDD2445C6F90
SHA1:	51F2ABF95D73CA21674D1AA1C5F50501F76A7F3D
SHA-256:	22418567D55A0E38CAB005665271D9279A384856FDF0CE5A9AEABDCD66CCBC72
SHA-512:	B657DE13FF71268ABA1790AED7D60CC1DA867434CE78421AD023BDECCC5E1BA9863952029E07FB577B57A3247FA9157B2C0AA9F894658B3F032CC36DDE701887
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Punta_Arenas) {.. {-9223372036854775808 -17020 0 LMT}.. {-2524504580 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}.. {37767600 -14400 0 -04}.. {55915200 -10800 1 -04}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Rainy_River

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8104
Entropy (8bit):	3.8351355650290304
Encrypted:	false
SSDEEP:	96:InJkLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:IJ3qtfA604qSBgI7DBch
MD5:	98E0F428A3773CE6FF0CEBF2F88EA81A
SHA1:	3DFA7D21A31C99078A139C5F41740B8EAD4085C2
SHA-256:	B1630FA919D652F30D23253E1C561BB76FB4D28844A2F614D08B0A25B17CFB27
SHA-512:	11C8E1F15B3FDC36DAD12229038BE10DA231872F804BD9FFF1786192541C4ABAFB27099C24EC3122F92A0D94D7D4A6E1ACD0A05845EC614982176A859B74E9FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rainy_River) {.. {-9223372036854775808 -22696 0 LMT}.. {-2366732504 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-923248800 -18000 1 CDT}.. {-880214400 -18000 0 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {136368000 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {167817600 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CS

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Rankin_Inlet

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7614
Entropy (8bit):	3.8349162993762267
Encrypted:	false
SSDEEP:	96:Wi8h4ZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:bqOfA604qSBgI7DBch
MD5:	793DAEDB7E3077DE52DCC3C8A7CBEC5B
SHA1:	37562E9F28D51DED41FFD5FF2FF19E2E4E453B7A
SHA-256:	AA8866D58BEAB07548180628FF423887BBF48AADB1B55392B288F7310F94A9B1
SHA-512:	68A32B41DC2D3E730D6BE53656B0D566AB1BCC1E189A2FFDB5687A947EF4F4008BC17456F8CE0D59C838EEA87A44400231A44E6AB35BEDBF5D7779E1CD7EFD8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rankin_Inlet) {.. {-9223372036854775808 0 0 -00}.. {-410227200 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Recife

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	3.78262494063765
Encrypted:	false
SSDEEP:	24:5aLexyGcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaI1kR8nd:5eTChlvEw6kSSx5H4a8tf3fkuoYVZDm+
MD5:	4D12651CEE804EB9F29567CB37F12031
SHA1:	54B2613475B8BDB1DBCCA53A4895DA021F66BDC0
SHA-256:	A36AD4614FC9A2A433712B555156EDE03980B88EB91D8DC7E8B10451D6D7F7D3
SHA-512:	E6690F6B6DF613C8B7289A2DB71FBC9B87B997707A6C3B4B45BDE8F347082AE8C69F212BAACE50F3C04E325ABE0976AF1F61107BDF8A15D5B88F11FAE11A9D00
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Recife) {.. {-9223372036854775808 -8376 0 LMT}.. {-1767217224 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Regina

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1781
Entropy (8bit):	4.034282439637634
Encrypted:	false
SSDEEP:	12:MB86290hjmdHfCv24Q1NAvHaE+YB+Q4kRcMxIeRUVX/SEQd1rRR9xRv0+Ro/wPjp:5EjeavTGOtAVvSRBpx0yq1epwD+yz+
MD5:	14B29B4391B643E5707096ADCC33C57E
SHA1:	B3F875ABB79C634C74307B7CB7B276B13AEE11D1
SHA-256:	50105E788288CF4C680B29BBDCDE94D8713A5361B38C6C469FD97CF05503FF7D
SHA-512:	D92A51547DF2C1AB6E6CDEFF34C07B755D3F6BB5E7DD1907693E7658EDE4D2BADC5DEFDB658ADD0F8D8F14B3B87CEA17BC00DAC364C5CB7ACBF8778C245276A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Regina) {.. {-9223372036854775808 -25116 0 LMT}.. {-2030202084 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1251651600 -21600 1 MDT}.. {-1238349600 -25200 0 MST}.. {-1220202000 -21600 1 MDT}.. {-1206900000 -25200 0 MST}.. {-1188752400 -21600 1 MDT}.. {-1175450400 -25200 0 MST}.. {-1156698000 -21600 1 MDT}.. {-1144000800 -25200 0 MST}.. {-1125248400 -21600 1 MDT}.. {-1111946400 -25200 0 MST}.. {-1032714000 -21600 1 MDT}.. {-1016992800 -25200 0 MST}.. {-1001264400 -21600 1 MDT}.. {-986148000 -25200 0 MST}.. {-969814800 -21600 1 MDT}.. {-954093600 -25200 0 MST}.. {-937760400 -21600 1 MDT}.. {-922039200 -25200 0 MST}.. {-906310800 -21600 1 MDT}.. {-890589600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-748450800 -21600 1 MDT}.. {-732729600 -25200 0 MST

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Resolute

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7610
Entropy (8bit):	3.8312000314798085
Encrypted:	false
SSDEEP:	96:li8h4Z80NA604qSScBgN+4ctDzIVQ/c/3hNxTh:EqOzA604qSBgI7DBch
MD5:	541EACD872723603971058CB205121D7
SHA1:	8F7DFD5ECA2913846D9342839AE1C60882153DA0
SHA-256:	643CC43E3F906779C040E1F0C20E78D6E95CC7301B3C7370A8ADBCBD76A8C5E8
SHA-512:	971D06D3FB67B7AE79EEDB6D3EBB805B5992C2BF4A7166016B405E21BFB25D9A87A757E8065073D5FBEB9084F6F742269A5BF432BF2F03D30913DB092E1AB3A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Resolute) {.. {-9223372036854775808 0 0 -00}.. {-704937600 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {73391

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Rio_Branco

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.8413073465060457
Encrypted:	false
SSDEEP:	24:5Ybe/k5Yss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6Gs:505YsMw57XJh4CxUF/A6GTrtSUDwr
MD5:	7E23FDE0E158E8ED2E7536EDE70D2588
SHA1:	319052BE076DC79F130E807D68B11CCAA0636340
SHA-256:	28082D20872B61D6098D31D1C40F12464A946A933CD9AF74475C5AF384210890
SHA-512:	BE078ED12F05AB5CEE5D77212EB76A01A1BC52EEAA17E3B91D93B88D75E5281B6AF164E712A9AB0F57A21B3CDB20F6FCCADB73CAC4745B5D2E665D18F9F06B55
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rio_Branco) {.. {-9223372036854775808 -16272 0 LMT}.. {-1767209328 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {57120480

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Rosario

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.801485647578614
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MSHAIgp/M1ovN/290rI5290/M7:MByMY/M7p/M16t290r190/M7
MD5:	90830F3B1F91FE48AC2944C7C92A3F6E
SHA1:	777377AE4959DDD2B472EB6041A23A5B93D64BB6
SHA-256:	0117D33D4F326AA536162D36A02439FBD5F2EB3B4F540B5BA91ED7747DDAC180
SHA-512:	20A371E4550E402AFEB83EF19EFFF6B3C0D7A68DCAA06AD894D04DB63B7096560E701C45B455B23A98BB20FE3B590F920219152415CA506AEDA427BB1381B826
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Santa_Isabel

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.869058214823402
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7ekHAIgpeON/290tX2U490eBn:MByMYMpJt290c90m
MD5:	F4E62378AA05771D348AA6DA516CD386
SHA1:	07FCA813693F7944CBCBB128F2F2FE32929D37A2
SHA-256:	3B4C2F3A5B9CD22A73F05187C032723D07BB53C9946D04D35E1BA1CB90CA0A62
SHA-512:	E9F6CEB824D656CA25A72BF8EB4347A22E1A8E40410F01E0C2EDE19ACAF32D76540399796B3EBC7781C8B5D48C1A6B2C856CA06158AE37D95C95CF0567DFA2E5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Santarem

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	3.8200568741699223
Encrypted:	false
SSDEEP:	24:5zeUdunSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/h:52SeSFESoSQSrSsCSeSPS1cSQSQlSsSU
MD5:	7F2658032008F2C1308F121C2EBF2479
SHA1:	B6F24E818B4424C0DEF818C103D1DA5359958932
SHA-256:	4A397BD937DE1D7E6A941D18001B34D4CD195AEFD08951C30C7EE8E48656AA0E
SHA-512:	F78853AA75F58A85555DD79E08A7487E5161854650DBF480189790D855738FEDCBDA936870067DE40FE000861008A9E9AAF61DF02B6B30B96038C61B5E1F1C1D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santarem) {.. {-9223372036854775808 -13128 0 LMT}.. {-1767212472 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Santiago

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8871
Entropy (8bit):	3.5333393351633897
Encrypted:	false
SSDEEP:	192:5Gv/IxUQjzoMUBI0nuUoDK6lPlgiot7JC/k8NWse4r4g5xCEmMQUs8nCxvisEbzQ:5Aa9TzDCjg32+E
MD5:	0659C7482FC6121AF4714DA6E2188069
SHA1:	79D8B13C54AEDE9EDC191EB92F8CD6BE936490F4
SHA-256:	B2D7FD4DB34800C9EF9BD73CDDB1105543CCED05F3E2AC99F3E5E2F6CF340AE2
SHA-512:	C138C580648D7EAAB22828EA4318F6FAEEF618B994C2E05AF23ACF03A279506053C85BFDBC03B9E32B1CA5826713D7FFC249CE33B3F0EA734A2E4CE626AAB3A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santiago) {.. {-9223372036854775808 -16966 0 LMT}.. {-2524504634 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-740520000 -10800 1 -03}.. {-736376400 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Santo_Domingo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	616
Entropy (8bit):	4.330655351784895
Encrypted:	false
SSDEEP:	12:MB86290/StmdHhvCvuCY/h/uFkS/5MVvMrW//MVvMrpx/m0XVvMr4UB/47VvMr/d:5+seQvuCY5/u/REfk+xxdbUBQpu652GO
MD5:	FAD0621010889164ADC4472003C9391F
SHA1:	C4EE0B8D6925338D17D5745DE9D45FA3C628DFC5
SHA-256:	2217E72B11A90F2D679C175DE3CC0F2FED4C280C9FF9707CFFAF118BF9A06A4B
SHA-512:	90E8E5A109CD72458C7796CF0324F63E543CCD63D13A09A3DD28EDC8B2793C964C18E79FDF0C5067C5A481B7FB03E8413139C32F59DA07E9D7893378ABBBD2B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santo_Domingo) {.. {-9223372036854775808 -16776 0 LMT}.. {-2524504824 -16800 0 SDMT}.. {-1159773600 -18000 0 EST}.. {-100119600 -14400 1 EDT}.. {-89668800 -18000 0 EST}.. {-5770800 -16200 1 -0430}.. {4422600 -18000 0 EST}.. {25678800 -16200 1 -0430}.. {33193800 -18000 0 EST}.. {57733200 -16200 1 -0430}.. {64816200 -18000 0 EST}.. {89182800 -16200 1 -0430}.. {96438600 -18000 0 EST}.. {120632400 -16200 1 -0430}.. {127974600 -18000 0 EST}.. {152082000 -14400 0 AST}.. {975823200 -14400 0 AST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Sao_Paulo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2900
Entropy (8bit):	3.6548008349990755
Encrypted:	false
SSDEEP:	48:5uFChlvEwR9xSSx5H4a8tf3fku+da2XUd23t8VZDG8+w/ghBPWTRz908a9zRgwun:cFIlvEwZSSxdF8tfMu+da2kdCt8VZy8n
MD5:	F6B732A862659EB131C2E6FEC00E9734
SHA1:	49517DF63BC5B6FEC875CE9477BBF84F4072FA31
SHA-256:	0E7BA1C5A3FA3DABDAA226BFE1E8D797A3835EA554828881AB5E365EDA09B92E
SHA-512:	670A5B604B5EA0F5FA15083BC1EA115B7EFD449F9EAC4518E109493591893DD3627AFC6628E0EDD1953E932E2A7AD9B5A379526548677158EC445366E4ED7166
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sao_Paulo) {.. {-9223372036854775808 -11188 0 LMT}.. {-1767214412 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-195429600 -7200 1 -02}.. {-189381600 -7200 0 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Scoresbysund

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6839
Entropy (8bit):	3.565857684485945
Encrypted:	false
SSDEEP:	192:9OgtbdF7TI7nYUYXg9W/OAcv7vuShytWi0PnvLrqPoKR2XszXckXtogYN4Ezlk0X:PJr9Q7TMq+ML
MD5:	D1BF579FE8123E8EE9248A51E794CC78
SHA1:	BF9CB9BED143C7529719E0C1E2F88BE1AC9F8DD4
SHA-256:	158BD9E4EB0B9DFF3F2D3E2DBA72F217B73423012DD33A688FD57852124E884A
SHA-512:	78192AC38912021F848592D0B208CB122EFFC6DDB326540FFAADA4FD3322B7A442FD1116F408D64B8788520B46545DFAE571EA42046D62A282A97ECCD5663655
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Scoresbysund) {.. {-9223372036854775808 -5272 0 LMT}.. {-1686090728 -7200 0 -02}.. {323841600 -3600 0 -01}.. {338961600 -7200 0 -02}.. {354679200 0 0 +00}.. {370400400 -3600 0 -01}.. {386125200 0 1 +00}.. {401850000 -3600 0 -01}.. {417574800 0 1 +00}.. {433299600 -3600 0 -01}.. {449024400 0 1 +00}.. {465354000 -3600 0 -01}.. {481078800 0 1 +00}.. {496803600 -3600 0 -01}.. {512528400 0 1 +00}.. {528253200 -3600 0 -01}.. {543978000 0 1 +00}.. {559702800 -3600 0 -01}.. {575427600 0 1 +00}.. {591152400 -3600 0 -01}.. {606877200 0 1 +00}.. {622602000 -3600 0 -01}.. {638326800 0 1 +00}.. {654656400 -3600 0 -01}.. {670381200 0 1 +00}.. {686106000 -3600 0 -01}.. {701830800 0 1 +00}.. {717555600 -3600 0 -01}.. {733280400 0 1 +00}.. {749005200 -3600 0 -01}.. {764730000 0 1 +00}.. {780454800 -3600 0 -01}.. {796179600 0 1 +00}.. {8

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Shiprock

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.888573146674231
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/2IAcGEtOFBx+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/290tO09Z
MD5:	2FF74846ADF32AA3A9418376775B7F25
SHA1:	130D7548DFFEBCE74969962E335B40299D7C5C54
SHA-256:	BF4FAB3AE72CC7FA4F9E34CF0551A85C54A084CD826DF5D9CC684DE6188E84DB
SHA-512:	9E52C017E595EEF1C68C8A1943416A9109D7DB4C32D25F83D05213C4200869A50E2E726894E39ECA364C558BB7F5566F6150CEA5D3CB14D1DEAE28C3D8C810E0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:America/Shiprock) $TZData(:America/Denver)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Sitka

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8651
Entropy (8bit):	3.959337076866423
Encrypted:	false
SSDEEP:	96:IGCG0hPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:I5G0A9DiaJCUbPI+D/iMpCIBSuk
MD5:	7CCB6902749079A0496F1E2E2137448E
SHA1:	3D0ED7BF1C26659F6794E26AE3869F8AB925B6DF
SHA-256:	ABB08435CAE80119068A85984BFFE9C1596F4FB90F07CC01124C907E5162C189
SHA-512:	0B5B2DCECC70F357DB6D590AB63E600C572EA6B3F430565EFEB29777B1901AAC55CACC7495C668F739201076B180402141BC1B2ED2357E9B4DFBABF3B122AB44
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sitka) {.. {-9223372036854775808 53927 0 LMT}.. {-3225223727 -32473 0 LMT}.. {-2188954727 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {3099492

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\St_Barthelemy

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.932842207797733
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290txP90ppv:MByMYbpwt2907P90b
MD5:	CBFA61DBF6F7459CF8D517402B29998E
SHA1:	A562B29C9470DBD25480966B0462433124BA4164
SHA-256:	353CDBD46BA8C7472A93E9E800A69105801F6784B22EC50A59294CDC3BE40E18
SHA-512:	00B333EAA2C32EDDA8F06457AD0E10013A0147B20F504F4F1096656F731A7C1896D5ABD83E7EDBD5D4E7DA587EE9BFA796539EB1E9F4056D75D1FDF203251150
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Barthelemy) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\St_Johns

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11289
Entropy (8bit):	3.8713946894934614
Encrypted:	false
SSDEEP:	192:PmxVjd1cO8f7/EjUhSicN6zvfwb+8YbTE0M0J:PmrcOI7/EjiskY01J
MD5:	8F068899DA75663128320633E1881333
SHA1:	E9161B45D7B11A2DD6E9679AC080E84EC51561E3
SHA-256:	E2917204B0C843C32051BB371CF6D0AD272C02720B9C0D913AC072C8ABE1EC64
SHA-512:	2200E9B9D816157330ADAEA7383635876E5A37329B1AF9613D38BCFBE8143835837A25132A94E44A61DB8058ED98B1A33F295EA64BC1F4CE30966D52BB0B673D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/St_Johns) {.. {-9223372036854775808 -12652 0 LMT}.. {-2713897748 -12652 0 NST}.. {-1664130548 -9052 1 NDT}.. {-1650137348 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1598650148 -9052 1 NDT}.. {-1590100148 -12652 0 NST}.. {-1567286948 -9052 1 NDT}.. {-1551565748 -12652 0 NST}.. {-1535837348 -9052 1 NDT}.. {-1520116148 -12652 0 NST}.. {-1503782948 -9052 1 NDT}.. {-1488666548 -12652 0 NST}.. {-1472333348 -9052 1 NDT}.. {-1457216948 -12652 0 NST}.. {-1440883748 -9052 1 NDT}.. {-1425767348 -12652 0 NST}.. {-1409434148 -9052 1 NDT}.. {-1394317748 -12652 0 NST}.. {-1377984548 -9052 1 NDT}.. {-1362263348 -12652 0 NST}.. {-1346534948 -9052 1 NDT}.. {-1330813748 -12652 0 NST}.. {-1314480548 -9052 1 NDT}.. {-1299364148 -12652 0 NST}.. {-1283030948 -9052 1 ND

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\St_Kitts

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.907031043022691
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tMp490ppv:MByMYbpwt290g490b
MD5:	D521F2D9B28C5374FC3BD540C6B6F40D
SHA1:	39A3D86CB71F742F33B02F50B316638815B3CD4E
SHA-256:	EDB9457A7C64E47062BDC6458FD3BCFCD6C37820F1A2BC89DFE99ED77355011F
SHA-512:	05C1BE92550A962904ED3BB7DECCAC16FCB54D258F24F2AEDF755FCC44E4FEF5F86AB663945809F5D7AFA64178E807BBDAE77048270ED516DFF2C7720A746D52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Kitts) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\St_Lucia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.9037013606484905
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tY90ppv:MByMYbpwt290a90b
MD5:	9392E5A7BD198B0308F9271E4C7E59B2
SHA1:	A902440920A0318BC930957C74804A9A51EF7818
SHA-256:	6727A509BB937CB3446D41B57826DE70C7028E96F088AB5B7F803BEAA18279E8
SHA-512:	6DA1EAC390E72905DF1A14D82362B499D20FAD6D85F3DF116AE01E566D5D19C6D16E56DA72C458BB6143345EF45F35A53B245488C641D80BFBA200B16A59719E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Lucia) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\St_Thomas

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.919272465019375
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tXIMFJ490ppv:MByMYbpwt290tJ490b
MD5:	49D0C8DAFCA053C9967EDCC4C0A484B1
SHA1:	7B4999D4B9AD93306BD411DF2946D741EC597770
SHA-256:	974AEED3D79124B50265C83D84F23CBE4F0328D00C75F42DD3ABC5D4C0A78DE1
SHA-512:	378E3657B26C5A039FF82ECCAC7797FF45CBC6479596629B3048164EE4E035F4ECFC557AA9EAF6848E78999B4FF8C63E53C7163BDF6F626ED6111004490D6F80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Thomas) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\St_Vincent

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.909053768717241
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tzb+Q90ppv:MByMYbpwt290xyQ90b
MD5:	6CFB23E7164605CDE380FB7C4D88DF11
SHA1:	CC513B29AD7B59E600DBCBC97927EB632558F657
SHA-256:	6B19404D295964EF66F47802836BB728FCE8E6481115797C0B5F200C354D7C8A
SHA-512:	728987D0925B6E12E8A220920BEDF94180880E78F3F08F6AC740E6304B22D446846068CEA499F61E7032ADB2E700CE31954921D478C9A8B6CB599E05A6292EA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Vincent) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Swift_Current

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.253846650171654
Encrypted:	false
SSDEEP:	12:MB86290hEbmdHLCvYX4Q19xRv0+RmwPj+uLkQOzL3+ORL4FXgenM7RSslKA1PyKp:5zeOvT4xuyqoYaAxt7l
MD5:	C91F801CC5E9F78B966D1DF2259C38A8
SHA1:	D29C970CBFC74684D46AAAD543B73B520775632C
SHA-256:	939B25C9412B9E25D73F552E87826999FC8C929770E66491D1E4530046D3E758
SHA-512:	093378E61DE9310F9C48170CBB0FDBD3C79E184DA1489F759B20BCE410006A9D5A793C82E79A46E0AFF0DAA47D9DBAFD605959E491BA9ED4E55D26F293642D32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Swift_Current) {.. {-9223372036854775808 -25880 0 LMT}.. {-2030201320 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-747241200 -21600 0 MDT}.. {-732729600 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {-684342000 -21600 1 MDT}.. {-671040000 -25200 0 MST}.. {-652892400 -21600 1 MDT}.. {-639590400 -25200 0 MST}.. {-631126800 -25200 0 MST}.. {-400086000 -21600 1 MDT}.. {-384364800 -25200 0 MST}.. {-337186800 -21600 1 MDT}.. {-321465600 -25200 0 MST}.. {-305737200 -21600 1 MDT}.. {-292435200 -25200 0 MST}.. {-273682800 -21600 1 MDT}.. {-260985600 -25200 0 MST}.. {73472400 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Tegucigalpa

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	341
Entropy (8bit):	4.638828647226646
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2903fDm2OHskeoHxbV1ULhgdrV/uF+IcmJ3/uF+ivi9/uF+SNv:MB862903LmdHsVCn1ULSB/uF+QV/uF+q
MD5:	4C4034ABAB9E4804CCB23E51694044C9
SHA1:	7DB24CE83AB2C07E6F6784D27C4E3AC0F149D080
SHA-256:	1F0503579B0DDDBAF88814A278127D9CD7019EDD3C35F4CBFC0EF11C0EDAFE5B
SHA-512:	0BC366CD3AB2E1388D11770DC8DEC1FC94C48FDC846ABB6C487828BF9FF15CD9A1C15B33E08F6E48B7F4A6F2AD1617FF12B359784CA4C32256D72422E6825105
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tegucigalpa) {.. {-9223372036854775808 -20932 0 LMT}.. {-1538503868 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}.. {1146981600 -18000 1 CDT}.. {1154926800 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Thule

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6890
Entropy (8bit):	3.8331465442823704
Encrypted:	false
SSDEEP:	192:mJInJuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/Bm6BTd69xK7KjhVbHyR3h1gOZM:miFCC
MD5:	D93B62D5F7EEBC28AC047BED2307CAE8
SHA1:	8B3E02240A01B5AA42D30E86005E880916432227
SHA-256:	7FB0CBB101D3B6FBB6B9DAD5446BBF9E6AEC65EC38472739E604F68F6AA9AB7B
SHA-512:	3648106F4DF84CFD94AAD4E9430F8D3BBCB38A9196DE9A59246DFBBC170FADBF106DD1FD08FE2E4F7319BFFB1C2607E4F5D563C222CED8267483D1A0C388CCE5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thule) {.. {-9223372036854775808 -16508 0 LMT}.. {-1686079492 -14400 0 AST}.. {670399200 -10800 1 ADT}.. {686120400 -14400 0 AST}.. {701848800 -10800 1 ADT}.. {717570000 -14400 0 AST}.. {733903200 -10800 1 ADT}.. {752043600 -14400 0 AST}.. {765352800 -10800 1 ADT}.. {783493200 -14400 0 AST}.. {796802400 -10800 1 ADT}.. {814942800 -14400 0 AST}.. {828856800 -10800 1 ADT}.. {846392400 -14400 0 AST}.. {860306400 -10800 1 ADT}.. {877842000 -14400 0 AST}.. {891756000 -10800 1 ADT}.. {909291600 -14400 0 AST}.. {923205600 -10800 1 ADT}.. {941346000 -14400 0 AST}.. {954655200 -10800 1 ADT}.. {972795600 -14400 0 AST}.. {986104800 -10800 1 ADT}.. {1004245200 -14400 0 AST}.. {1018159200 -10800 1 ADT}.. {1035694800 -14400 0 AST}.. {1049608800 -10800 1 ADT}.. {1067144400 -14400 0 AST}.. {1081058400 -10800 1 ADT}.. {1099198800 -14400 0 AST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Thunder_Bay

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	3.832494305415669
Encrypted:	false
SSDEEP:	96:tDbEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tvEItON0HY2iUmUFLqU
MD5:	8DD2E298AEB672F32AD8B44A0A84431A
SHA1:	9687C478FC6803F4FFCA125D921DF821181B8E75
SHA-256:	0F95CE0A36415B43E7B5E6CD790D3BD9EF6D53F4B7AA0235360C0847CBB3F0C1
SHA-512:	9380327C04FC48A61423F161DFD4AC1C431278D5B392F585DCEB1D893CB8212C4093A92D5D089BC23DF0B5BB6F99595937999A6B1E843DAE1AF36D76B0858281
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thunder_Bay) {.. {-9223372036854775808 -21420 0 LMT}.. {-2366733780 -21600 0 CST}.. {-1893434400 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {18000 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {126248400 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {35711

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Tijuana

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8755
Entropy (8bit):	3.8517632099398114
Encrypted:	false
SSDEEP:	96:c4uS6mjvZk53mtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:J6jFOzN6IkWq/WHQt/RY4yP
MD5:	8F912B1F7E3144EE787E4386B1AE2AF1
SHA1:	60236FC9AB9C06F614C76357915B57B286721BC6
SHA-256:	FE3681F580ED7F3F2FD21F510DFF1BEF81BD521737F5846FA15FD309E44E69BE
SHA-512:	87EA33079EEFED848150884BC41131B2CC49B0AAA5FA10C0700818A8C292F1F3AD928E98C98EF34EFC48F0E3AFB3CBBBE3D09C483A2CDA545DFF7CB77D29CB3E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tijuana) {.. {-9223372036854775808 -28084 0 LMT}.. {-1514736000 -25200 0 MST}.. {-1451667600 -28800 0 PST}.. {-1343062800 -25200 0 MST}.. {-1234803600 -28800 0 PST}.. {-1222963200 -25200 1 PDT}.. {-1207242000 -28800 0 PST}.. {-873820800 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-761677200 -28800 0 PST}.. {-686073600 -25200 1 PDT}.. {-661539600 -28800 0 PST}.. {-504892800 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}.. {-355330800 -28800 0 PST}.. {-337186800 -25200 1 PDT}.. {-323881200 -28800 0 PST}.. {-305737200 -25200 1 PDT}.. {-292431600 -28800 0 PST}.. {-283968000 -28800 0 PST}.. {189331200 -28800 0 PST}.. {19

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Toronto

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11248
Entropy (8bit):	3.8061065077303926
Encrypted:	false
SSDEEP:	96:lBew85RnK1a8phYBNXEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:lBq5RnK1a8phYTXEItON0HY2iUmUFLqU
MD5:	0D906EC3F658730131A65C5A770D885F
SHA1:	BFA72C43BCE0F37F795E974457FBE4A664687B38
SHA-256:	5A98C6BEDDA4DF608051D702A8E037093A8068E1B85F8F55D42B4468F45662A5
SHA-512:	CC634DAF4EEC7F57E3AB0C20D891380A7F96DE79602A7B57C6C2BF229DD76A69B399A689FA6D0675380B1432C2115B0C8577DC49C3C9E567A08CAD6FCC3599BC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Toronto) {.. {-9223372036854775808 -19052 0 LMT}.. {-2366736148 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1609441200 -18000 0 EST}.. {-1601753400 -14400 1 EDT}.. {-1583697600 -18000 0 EST}.. {-1567357200 -14400 1 EDT}.. {-1554667200 -18000 0 EST}.. {-1534698000 -14400 1 EDT}.. {-1524074400 -18000 0 EST}.. {-1503248400 -14400 1 EDT}.. {-1492365600 -18000 0 EST}.. {-1471798800 -14400 1 EDT}.. {-1460916000 -18000 0 EST}.. {-1440954000 -14400 1 EDT}.. {-1428861600 -18000 0 EST}.. {-1409504400 -14400 1 EDT}.. {-1397412000 -18000 0 EST}.. {-1378054800 -14400 1 EDT}.. {-1365962400 -18000 0 EST}.. {-1346605200 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-1238954400

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Tortola

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.864308662322047
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290RRKl290ppv:MByMYbpwt290V90b
MD5:	21D152A2359A4EFDE6DCC304F16096F3
SHA1:	961B3CFB351615604981114A115D396D1F2006A2
SHA-256:	46A236EC38F3A122D414208328A462B2A937392ECC6C55F673FB7A402F118D96
SHA-512:	04A2AD6DDC2E7B0D3F95DA1C731FF553F8CBC0DD6BDFC36FB2EDCE755612103E3B4EA6F3AB7FE63CA60976538EFABF40827539DFC35B7E83129BD48471FE514B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Tortola) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Vancouver

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	3.8481935495337356
Encrypted:	false
SSDEEP:	192:sOR864CjSAG5a9bFzN6IkWq/WHQt/RY4yP:sO664CjSAGYbGBt/M
MD5:	9423BC81647BC4C37888860CE0518BBB
SHA1:	37E6E6554576D1DD36C3494EAF0BD169003D870D
SHA-256:	00B5FB8F37DFF43925C501AEAB039F39F058E002572C4203286317046CC1D700
SHA-512:	1830CA2B62B7CA6EEB5A924D2148925DF7DD87A7B93B21F4F023E4678EF42DC20BFF57F702923E10F4382FE6757323D21414D094E99FEEB43316DE4A7E5A909E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Vancouver) {.. {-9223372036854775808 -29548 0 LMT}.. {-2713880852 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-747237600 -25200 1 PDT}.. {-733935600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-4

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Virgin

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.914983069791254
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290RXgr490ppv:MByMYbpwt290xg090b
MD5:	9F7DA15BE387B8F7DEC5DFFE069F3505
SHA1:	D298B963B0048E9ECA3BC7B85248506AB1388479
SHA-256:	561D9D04B0CE0F96A9C351C7D5C30AA1D5A42A3D70066CD9AF0DA6CBC5388DBE
SHA-512:	606C2A918633C74BD2954D39B00EFA2CD9DA852BC7034F129A04258A65DC74942FA0826E9BC6E4433926E7F1375612554B04845077E434D0CD3BD15832DC6B95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Virgin) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Whitehorse

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	3.9652694533791917
Encrypted:	false
SSDEEP:	24:5CeFvmpn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5BmCKpj/AOZFCARCeQbvb5wxMN6Ix
MD5:	2F2D39B5FB844E170FA7B6AF11B948CA
SHA1:	3D89672134D979FCF65225A58249380D9C8A4A65
SHA-256:	8E0BC71BD7146145DDE3C064AE205DF08124FE2402853A9655B0EB799E90F31F
SHA-512:	6C046D1133C8CCF697C8FB553A1F539948F71FA80BA447B87AA8D1D1D7113B32A6B764C5C1734C615319A27961B6116FCA087EB571869119BE87656FCA351498
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Whitehorse) {.. {-9223372036854775808 -32412 0 LMT}.. {-2188997988 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Winnipeg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9695
Entropy (8bit):	3.8209220355628766
Encrypted:	false
SSDEEP:	96:pOEhc8/rvNZONqXXyIjNA604qSScBgN+4ctDzIVQ/c/3hNxTh:pY8DvbO+A604qSBgI7DBch
MD5:	E8DB00D2B99B308018F4F5E48AC47C3A
SHA1:	8841467CB264DC9F87FABAADBE90EE2C8DACC80F
SHA-256:	F3FC5F6D93D1D9EB0F3DED33873F33C47F841797D96439966F8E0A5A189941FA
SHA-512:	5D684B07332ED53F9F8CB71FFF3B6D0F848426A5E4D9E7DA84E49E358C666F1C3BB9CF21352D939B35B558FC691839E24BC84656317F73C768B474AF5AC480EB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Winnipeg) {.. {-9223372036854775808 -23316 0 LMT}.. {-2602258284 -21600 0 CST}.. {-1694368800 -18000 1 CDT}.. {-1681671600 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1029686400 -18000 1 CDT}.. {-1018198800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-746035200 -18000 1 CDT}.. {-732733200 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620755200 -18000 1 CDT}.. {-607626000 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Yakutat

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8683
Entropy (8bit):	3.957710943557426
Encrypted:	false
SSDEEP:	96:po1acs6yyyxC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:p4acsW9DiaJCUbPI+D/iMpCIBSuk
MD5:	18EC35FCEC15CE9304818E22222411EF
SHA1:	F4A04B3E2B5F55C9582F578C3142E706C4EB6BD6
SHA-256:	79B44F245D86A4EC299D1A9A2EDB2AB92D50AB5A7C1C03759D283AC4070F9005
SHA-512:	40AC47AC278DF22C7ECFF568456E7C3767B38701B9A2E2639C2201DC53CDD794CF7521BCB773A8AF2A8D4A034D3BBD35BF9788FB5B4E4D51A7A139B3B3353479
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yakutat) {.. {-9223372036854775808 52865 0 LMT}.. {-3225223727 -33535 0 LMT}.. {-2188953665 -32400 0 YST}.. {-883580400 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-757350000 -32400 0 YST}.. {-31503600 -32400 0 YST}.. {-21474000 -28800 1 YDT}.. {-5752800 -32400 0 YST}.. {9975600 -28800 1 YDT}.. {25696800 -32400 0 YST}.. {41425200 -28800 1 YDT}.. {57751200 -32400 0 YST}.. {73479600 -28800 1 YDT}.. {89200800 -32400 0 YST}.. {104929200 -28800 1 YDT}.. {120650400 -32400 0 YST}.. {126702000 -28800 1 YDT}.. {152100000 -32400 0 YST}.. {162385200 -28800 1 YDT}.. {183549600 -32400 0 YST}.. {199278000 -28800 1 YDT}.. {215604000 -32400 0 YST}.. {230727600 -28800 1 YDT}.. {247053600 -32400 0 YST}.. {262782000 -28800 1 YDT}.. {278503200 -32400 0 YST}.. {294231600 -28800 1 YDT}.. {30995

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\America\Yellowknife

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7737
Entropy (8bit):	3.8656193813344064
Encrypted:	false
SSDEEP:	96:42GaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:uPlLv/PCenJzS6cy
MD5:	A7606AE597027C26BC90702B2BCC80E9
SHA1:	7B2AB2E0A23B8D770D1305A171DBCCE2D471EF2F
SHA-256:	B33838F12640C64BA4F10F50657EC4D8D5B30FD226DA4ACA21B169B53AD30576
SHA-512:	B18711B4110D6DB0CC7A6EF66639E1B38323F0B61DA4F5287A51BC9EC8534133568C6D3E4F18F6328564DAD291E0CA707768DE4478DD502A40FFD189C08114A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yellowknife) {.. {-9223372036854775808 0 0 -00}.. {-1104537600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Casey

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	478
Entropy (8bit):	4.205595904143294
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2L09xSDm2OHE5QMFUH+KNUoTVsBEE0ZZICxZbDtVby:MB862LcUmdHE5QMFi+KdTVPZIwXDy
MD5:	7D8132A23238C14CCEDD520BBEB49F77
SHA1:	A8BAE9269DAA2AC535B292E1AE8632B451A0BBA5
SHA-256:	04247ACB2B4FA126D13F4573FF74D15A89CF42B2C5CD7E688D5BB1C1FD3972BF
SHA-512:	74FCB14037B0AE11A95B036791D69037590F8EC7F09D90A866E6A6CAAD6D58E4EC3723A3BB356FBF0E25ED1239A5820A8513EBF6653578E4BFB8988D6D20EF13
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Casey) {.. {-9223372036854775808 0 0 -00}.. {-31536000 28800 0 +08}.. {1255802400 39600 0 +11}.. {1267714800 28800 0 +08}.. {1319738400 39600 0 +11}.. {1329843600 28800 0 +08}.. {1477065600 39600 0 +11}.. {1520701200 28800 0 +08}.. {1538856000 39600 0 +11}.. {1552752000 28800 0 +08}.. {1570129200 39600 0 +11}.. {1583596800 28800 0 +08}.. {1601740860 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Davis

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	324
Entropy (8bit):	4.360007144607037
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2L0mDm2OHEfwz0/MVSYyF/KZ7VoX/MVSYyF/VpVQVF9RXhNXSMVSYy6:MB862LVmdHEIjsF/KZOksF/Vp6v9RRFl
MD5:	97AA556F7EF06786B76316133794F4E9
SHA1:	B3CDA284DE80987B954E2CC9BFA3ED33462CDD4F
SHA-256:	2F36D2E13D7E251322B7A7B30F39645393525CEB49A2B5C26F27797F2AAF4D7F
SHA-512:	14C6F17252C2AC89D86FE00BD8A8934D627C85478B0AB08AB6237988922D18616B00878498FFFC0E1978308BC6D775E2DC3ADCEF827AB0A06B214BE4DDABAB52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Davis) {.. {-9223372036854775808 0 0 -00}.. {-409190400 25200 0 +07}.. {-163062000 0 0 -00}.. {-28857600 25200 0 +07}.. {1255806000 18000 0 +05}.. {1268251200 25200 0 +07}.. {1319742000 18000 0 +05}.. {1329854400 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\DumontDUrville

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.938579775653117
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yci/452HAIgObi/4oA6N/2L0/3Zp5/4pv:MByMdNXiU5t2Lkwv
MD5:	CC22302B9FAE52E36A2A35C0361E774B
SHA1:	45CFD95A5821C4C4FDF2E1519F08029FF0BE664B
SHA-256:	96F2AB9A9FFCD10598FDF105F68460CC4B4EBC1F18054D1BC8E39DF6AD24D1AC
SHA-512:	FC9084D7B16EAA985681762F2658D32C77EE186D8D3C7225093CC5CB4A6AEB74A3D0A41A904EB6C8AEF7DB110A89497BAFAF811BBC26103F96E5E1D4D4E1002A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Antarctica/DumontDUrville) $TZData(:Pacific/Port_Moresby)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Macquarie

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8447
Entropy (8bit):	3.850137279218428
Encrypted:	false
SSDEEP:	96:s1qigkx6WsYyS391QiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:s1q05h1QiAmcOM6e0pj
MD5:	81C612A1544910544173687C416841C6
SHA1:	4A707B403F0B9556A3D3D50B08BE0F56660F3F0B
SHA-256:	C4EA7F1C0B5A0FAE653419F1C6D058BDDD745A3CDBA11900005C157DF23DDC01
SHA-512:	122E2DC3D8D61CCDB83E03C9487DD29AABE7AB3F71FE4F6315209AF0BBCFD01FBDC3A1E3F6D910FB0D690378DF852170A9819D8C1EF96BE6BC8C0811BFB453A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Macquarie) {.. {-9223372036854775808 0 0 -00}.. {-2214259200 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1669892400 39600 0 AEDT}.. {-1665388800 36000 0 AEST}.. {-1601719200 0 0 -00}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {28932480

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Mawson

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.7511104559982
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2L0GRHEzyeyFNMXGm2OHvavFeVU/VPKVVFSTVF9svUX0VQr:SlSWB9eg/2L0zyfXDm2OHEVy/Ur9s/Vg
MD5:	7A2AD9BD8F8DEE5C600CABF2D5E9D07B
SHA1:	CF5D230A29946B7FA3ECD8EB99F1EF1BF0FA5B50
SHA-256:	ACA533B8BC82296373EDEC82F6E0AA45A34D817C7C18FF5E8E94B81C0BD30259
SHA-512:	95F8FA68735E88AB15C403191928FA4AA5D1628453BE64B87EE7E8DF9F35FB5DA74A3CED5F5289A13D84A8A12BBB86734E578059CA8B6405399CFF5E33C9384C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Mawson) {.. {-9223372036854775808 0 0 -00}.. {-501206400 21600 0 +06}.. {1255809600 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\McMurdo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.880387042335617
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3ycqXHAIgObOvRN/2L0z6/fy:MByMdTiYt2LrK
MD5:	88EE32AE5C538AEBFDE2D1D944ED5B2B
SHA1:	55E7234E6FFF298182A6C8889A9F506CDCE7C959
SHA-256:	E9D99293C5B275D8E0D7B066084177EDF670D5B52B81E87608BAB02025F33155
SHA-512:	45A3EA146CA719BA6F22E99EAA57AC1DED1C762E19BDFBA176E5FEAC36EC58586F771572DD16ACE09E660F97DEB91A701BA1B1F1AEF3BD8688F3451C0772420A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Palmer

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2613
Entropy (8bit):	3.6082359166067905
Encrypted:	false
SSDEEP:	48:5fzJS6S4wRSenSOaf7HSKSkSqS7STslSmSMSCSxygSiXS/SrS+S9SfShS7SoSlSL:jdeRtnxaf7HlPlgiot7JC/Xk8NWse4rf
MD5:	BDFA5908E735F866FEC16F6B481AD385
SHA1:	524AEE21BB97D923A8812A5722AF2FEA43B4D971
SHA-256:	1637381A20E9D5C6A530F110BDB08D9515E675C9206F000407D8511074948E61
SHA-512:	3D65C7941BA15A698264848F9B6F43ED5B63D4CF86D495334E8E1DC381D63435E9424BBBC389229693D20044FDB8425A7CC805AB5EA055F59D3E0DD4C7AC2A28
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Palmer) {.. {-9223372036854775808 0 0 -00}.. {-157766400 -14400 0 -04}.. {-152654400 -14400 0 -04}.. {-132955200 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-101419200 -10800 1 -04}.. {-86821200 -14400 0 -04}.. {-71092800 -10800 1 -04}.. {-54766800 -14400 0 -04}.. {-39038400 -10800 1 -04}.. {-23317200 -14400 0 -04}.. {-7588800 -10800 0 -03}.. {128142000 -7200 1 -03}.. {136605600 -10800 0 -03}.. {389070000 -14400 0 -04}.. {403070400 -10800 1 -04}.. {416372400 -14400 0 -04}.. {434520000 -10800 1 -04}.. {447822000 -14400 0 -04}.. {466574400 -10800 1 -04}.. {479271600 -14400 0 -04}.. {498024000 -10800 1 -04}.. {510721200 -14400 0 -04}.. {529473600 -10800 1 -04}.. {545194800 -14400 0 -04}.. {560923200 -10800 1 -04}.. {574225200 -14400 0 -04}.. {592372800 -10800 1 -04}.. {605674800 -14400 0 -04}.. {624427200 -10800 1 -04}.. {63712

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Rothera

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.829975802206526
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2L0GRHEsKRsMXGm2OHvavFN/H3VVFVGAvFv:SlSWB9eg/2L0rRsDm2OHEN/VVFAKV
MD5:	C330982049AA053DA62B926627D2F2FA
SHA1:	050CE68265F1A183F0173C825AC59EAE8B6AB9EB
SHA-256:	943F10D8E836773F0B7ACD13ED8422C0B27813C7BBE0B09B57697D1D70D21ECE
SHA-512:	DE9953D0E505D6B110C0CC4E756B5B0311646C9CA4703A33B92147D36CFB4C288D73851E6766CE1432F41AB51B5D0A1D58680BDB4E28F067E1D36F670B4A192E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Rothera) {.. {-9223372036854775808 0 0 -00}.. {218246400 -10800 0 -03}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\South_Pole

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.906125935761354
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3ycqXHAIgObOvRN/2L0tlo+ply:MByMdTiYt2LMq+p8
MD5:	8095A3749DBDE05377836D74A4EEFE33
SHA1:	6987CA972B63AE26A65654961588D51D3EF2166C
SHA-256:	88057832175BB642B23FC99F788A2F78A24005CF1F84A7B1B5E8C84FB8F4D4C1
SHA-512:	9066104C9C16D2AB88523D651C74CE268468E093A497D128D0D12A986BD62DBC1388A56ED1737C2AFACF04185CF06FD0EE66797A3390B2F0E1EB08A4D92AAFAD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Syowa

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.871844665431957
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2L0GRHEtWlFBQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2L0tQB
MD5:	CA52057130DCF506D11A7CC069F4FBA3
SHA1:	2C38B7E7872BB41C3569DFCB539C3EC3AAE24FDD
SHA-256:	2488805DE4FEA42305689F679F1AE2D80B1E934E657FEA329AD39A82DAC63022
SHA-512:	B19D409870939C8F0834C6C028239E010EE5128DFA6E97D4903BECA229B04FE530EA376B936767D9BFE21709720C1791289D8E3622B17C18F2680B0670794A02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Antarctica/Syowa) $TZData(:Asia/Riyadh)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Troll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5370
Entropy (8bit):	3.5134546899897146
Encrypted:	false
SSDEEP:	96:YveRdmbxnKIJqU9XThVIsopb8BcrFgoZVlzeEG+PtJ:UeRdmNnKIIajfopb3FVVJ
MD5:	442F495C36B31CA5D7A9BEFF12105AEF
SHA1:	B3F6CA5B4A5756F9B2C09A27198F7A651CC6032D
SHA-256:	6FD5AB8B7B308CDCEA4B747A81D8675988AE218813C91714FC4CA97919CEBEA5
SHA-512:	C6EAECC26D67D218615EBB5602639DAB62A2578BD9683553D765DC1AC5580627D29B6F911388F5F1BFC284278EA4EBECE94630D3C6B95FF9EF93D3D61A3C2028
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Troll) {.. {-9223372036854775808 0 0 -00}.. {1108166400 0 0 +00}.. {1111885200 7200 1 +02}.. {1130634000 0 0 +00}.. {1143334800 7200 1 +02}.. {1162083600 0 0 +00}.. {1174784400 7200 1 +02}.. {1193533200 0 0 +00}.. {1206838800 7200 1 +02}.. {1224982800 0 0 +00}.. {1238288400 7200 1 +02}.. {1256432400 0 0 +00}.. {1269738000 7200 1 +02}.. {1288486800 0 0 +00}.. {1301187600 7200 1 +02}.. {1319936400 0 0 +00}.. {1332637200 7200 1 +02}.. {1351386000 0 0 +00}.. {1364691600 7200 1 +02}.. {1382835600 0 0 +00}.. {1396141200 7200 1 +02}.. {1414285200 0 0 +00}.. {1427590800 7200 1 +02}.. {1445734800 0 0 +00}.. {1459040400 7200 1 +02}.. {1477789200 0 0 +00}.. {1490490000 7200 1 +02}.. {1509238800 0 0 +00}.. {1521939600 7200 1 +02}.. {1540688400 0 0 +00}.. {1553994000 7200 1 +02}.. {1572138000 0 0 +00}.. {1585443600 7200 1 +02}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Antarctica\Vostok

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.825276519494304
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2L0GRHEoKcMFPMXGm2OHvavFYd/bVFXKVVFSTVVn:SlSWB9eg/2L0XcMFPDm2OHEsVFXK/UX
MD5:	EEF1A803C78FEDC2848A967F8F7C8C28
SHA1:	AC0E8008EFE4EF1A393478C82724335EA30BF1CD
SHA-256:	1EFDAE8A23BA4EE37E7992F3C9DCADA6C2E95AF82A955A4C6597E7295C950855
SHA-512:	F19EA119EA4F354099402FDEEAAA551AA2C5FC1295E40B5A82E5896CB41F0C86AD8CAA86FDC4E7BD30AAF0ABAF2794FE7B177C4FE25A89F1C744C400A140AA88
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Vostok) {.. {-9223372036854775808 0 0 -00}.. {-380073600 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Arctic\Longyearbyen

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.968479138333469
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2XbeLo4cA4FH/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2XbUyAK8K
MD5:	3FE28E22313BA8C8100254644DBFD164
SHA1:	46F917F0E706CD072B89C06652DAA032CD67AD98
SHA-256:	944A38702A5176A082755897F1E4B1C88D5721CB499245E2FE51D2CFD849A23F
SHA-512:	BF6E42C039C780EB62CFD69B0375EFF9D459E6468CAFE2323A086D2EB2039B97F805BC361962C72F51F527E96B51973298F13774427E38A28E851A9D19664820
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Aden

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.829666491766117
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFK4h4WFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKs46
MD5:	60D7F3194F19179E0CF0F561F9C40EE6
SHA1:	B079EC49485CFBFFB7A5BE6149319B75684258E9
SHA-256:	8FCDDB246932BAED880B70C0CA867057E7989AEA55EDDC174430E1055CD1058D
SHA-512:	0BDC86B1D473D4875C6F7C092F955D0999E6C1F2EF83CFC7726A3C5BFEB0F5CB8E00B1F0CBC1F91F806EC635C472927504DF681A32DAC55EF372DA16FEA9EF40
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Aden) $TZData(:Asia/Riyadh)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Almaty

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1637
Entropy (8bit):	3.732051305399264
Encrypted:	false
SSDEEP:	24:5qehddmvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10SvPFu+a+CK/Eu3CWuD0Vob1:5YvdJqxiF0rvK50Sv9fGSM
MD5:	D6BCB21F65642F36A159AFD72EC93953
SHA1:	D3E670E579924E6E4F04AB574D48334FF521D8B2
SHA-256:	06DC608C0B8CDD69CCE66A6BF86F141C46DF39CB45312E684E46F19ED8CAFF15
SHA-512:	9A633B629873E5EE5AF923A94865EBE5FD9ECA181B2C47B7368A0828468715E07AD3FD825D5E2312D2D0BA1FA5490E3817C36B6339824C8012A0B75538C4A0DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Almaty) {.. {-9223372036854775808 18468 0 LMT}.. {-1441170468 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {695768400 21600 0 +06}.. {701812800 25200 1 +06}.. {717537600 21600 0 +06}.. {733262400 25200 1 +06}.. {748987200 21600 0 +06}.. {764712

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Amman

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7301
Entropy (8bit):	3.7085177447035047
Encrypted:	false
SSDEEP:	96:Fz0T52akyId7+xOXdkwqeIFcvQdaKkIQV9aOBmGILnNoRkEKnFj/XmJmoTSVI:FY85S0VqXFcvQMZUnNrK
MD5:	C5521EB658601F0C03F3122A1529B7B9
SHA1:	0B0F9BD69F3B49DF5D25A9F567471409D7467ED8
SHA-256:	AA5E87C065E5AA4516F1AA50E1840EE22683D3B4C25A4E00CA92C53F96C6D062
SHA-512:	B16039183DF4AF64768F4956075E9557988466E4FC327968712958186CB8F804C1F1B0ED80F5EC7900521CC5710E8AA0DD6716C3B58F7B31116E22CB5785C000
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Amman) {.. {-9223372036854775808 8624 0 LMT}.. {-1230776624 7200 0 EET}.. {108165600 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {215643600 7200 0 EET}.. {231285600 10800 1 EEST}.. {244501200 7200 0 EET}.. {262735200 10800 1 EEST}.. {275950800 7200 0 EET}.. {481154400 10800 1 EEST}.. {496962000 7200 0 EET}.. {512949600 10800 1 EEST}.. {528670800 7200 0 EET}.. {544399200 10800 1 EEST}.. {560120400 7200 0 EET}.. {575848800 10800 1 EEST}.. {592174800 7200 0 EET}.. {610581600 10800 1 EEST}.. {623624400 7200 0 EET}.. {641167200 10800 1 EEST}.. {655074000 7200 0 EET}.. {671839200 10800 1 EEST}.. {685918800 7200 0 EET}.. {702856800 10800 1 EEST}.. {717973200 7200 0 EET}.. {733701600 10800 1 EEST}.. {749422800

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Anadyr

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	3.7698340044911616
Encrypted:	false
SSDEEP:	24:5DeEdVrEOeFt7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5ZejsFLrcZwvJt2F+doTr9Q3G80
MD5:	6EFC35043BDCA4AB61D72E931DB954E6
SHA1:	F0B4E76C154DC773073E41AA8E94030E972A986A
SHA-256:	D9DF64FDA4638F7604624B0F68A885D5ABADB1DE12AF1AF5581C2AF7DD971562
SHA-512:	16AE582B113D6960C73B64620A8AF20F9D436AA4B3EC8E881617AED3389EB4357931882103F162F19EE8202953A7E6FB4FDD6D7760FB7621F4DB9D229AD13F17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Anadyr) {.. {-9223372036854775808 42596 0 LMT}.. {-1441194596 43200 0 +12}.. {-1247572800 46800 0 +14}.. {354884400 50400 1 +14}.. {370692000 46800 0 +13}.. {386420400 43200 0 +13}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Aqtau

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	3.7149890651919644
Encrypted:	false
SSDEEP:	48:5uvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIkhYwr:sFBNKs6b03zB0WJEuDa7sFZiKWaN6TiF
MD5:	A72FB1FE01C93BD7E0A8136635C72639
SHA1:	2383CF839F50784D4BF8B7EDDB324C80E2DDD0DC
SHA-256:	96B510AF9B8C6BC1DFA84E9ED5E072F3FD484EEB66BBEBC7B6826ED859ED9027
SHA-512:	061FECE3C750C0229638DD8AF38FB3E8E48E59E0DE1B13BCFE46483A7A170B71B9BCB0D6F110B6B2EF68510FA940F9066F14CBD59829E222D6644D3657CE1893
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtau) {.. {-9223372036854775808 12064 0 LMT}.. {-1441164064 14400 0 +04}.. {-1247544000 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {7647156

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Aqtobe

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	3.721746335201775
Encrypted:	false
SSDEEP:	48:5FUvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQR:PwaBNKs6b03zB0WJEuDa7sFZiKWaN6Tt
MD5:	E278B985BD2515DBCAED8CB741BE9208
SHA1:	BC9F5E72C430661D7ED1AF04571CE5D0F73DD18D
SHA-256:	991638FA2AB2A2F7A091A23D78D99306EE73A740F1A03FBAC448EDCAB55A0E38
SHA-512:	9951DB729B837647CC4B3D2E605525DCCBAFFD39D76460331BF62235DCAE5E4470CDA578F940B1739AABFEC55D293FF60D79AE0EFDFE1EB64E84571881FDEA6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtobe) {.. {-9223372036854775808 13720 0 LMT}.. {-1441165720 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ashgabat

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	878
Entropy (8bit):	3.937249024843323
Encrypted:	false
SSDEEP:	24:5ggeRMdIQvNcDvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKTob3CGcr:5gbkvNSvNhQQvmRKqv0fvzQIovWdvEGD
MD5:	259179C7A1CA04F9F3A373B6C8FCB8C5
SHA1:	D042DF8EFD8EC1473B45B1131BD5EB714F1B2C17
SHA-256:	13745BFA25E6E2D8D0FABAE42CB7C37CF9F974CFB343D4FE84E4E2D64A25926B
SHA-512:	703BEAD5A1E5B3816D98057A08A87C2139F418787F38561FE35175B84E2005365727F85D1B949CC5DF464B207A7D01BB65FB1A632E73DDA523E843B82D76FBBD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ashgabat) {.. {-9223372036854775808 14012 0 LMT}.. {-1441166012 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +05}.. {370720800 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ashkhabad

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.801820439218014
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8xEYM4DyXHAIgN/ZEYovFvWARL/2WFKUNSH+WFKYEQ:SlSWB9vsM3yR+HAIgH8VWAN/2wKUNSeq
MD5:	5193EF7ADB646798801245BC50C8DDA6
SHA1:	83ED851CBC60EFB330A8FC119E1BED5B4C0BA630
SHA-256:	2C752F641B98E3C05B14AE31330D1F198DAA4A7E354BA9670C7754926BFB891A
SHA-512:	E940E1BE67A9AC895F3D060B1CB34797A429147A9DC2AC0F1162D37D86661EF217EDABA720F0AE3796186FE801229210AC785BB4511CBBE5A41791D236101D8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ashgabat)]} {.. LoadTimeZoneFile Asia/Ashgabat..}..set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Atyrau

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	3.7265766742957402
Encrypted:	false
SSDEEP:	48:55TvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQJ:XrFBNKs6b03zB0WJEuDa7sFZiKWaN6Tl
MD5:	0236793F90ABC6F68718DDBB44AF5E2F
SHA1:	A5EFAEEF9B9159E748A3FED231F8A978E400482E
SHA-256:	4B7B118E6AE72D41740CF0CB2BD8E970700758DCBC0DD6F298199D841DF8408E
SHA-512:	851C7A9C110790454312BB9C5B5D3C426365EEF4673191B9ABB2E4A32301894C5FB1ADCBE2A4C67BEE416AD63FB8BED85F94EF9BF42473DA4BFFA7824935A1D5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Atyrau) {.. {-9223372036854775808 12464 0 LMT}.. {-1441164464 10800 0 +03}.. {-1247540400 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764715

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Baghdad

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	3.7261419515679393
Encrypted:	false
SSDEEP:	24:5/eVvyGiHD6UC4UrUomFMmUZcjbUKNFcUEUvUOpU8MYUWCUlbf/U9bUiUUybUQUF:5m8G9mFdnNF1FfsTuvQXHCe
MD5:	690013310A46BD1AE250A5E019353809
SHA1:	0DF434C7EEB707DC071007FAB112F4DEB37E936F
SHA-256:	D20B75D2604C3B742C1629C5EE02CFF6783E472249982B272B68F2A6DE9BDC38
SHA-512:	FF8C33E55E4F006C38D3FD37A1AD3E1200718CA374ECBEAE8255C7635912F0BB23A59A600BF7130D5660A24C515F726E8440D0D908E560CB59F74059638E6AA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baghdad) {.. {-9223372036854775808 10660 0 LMT}.. {-2524532260 10656 0 BMT}.. {-1641005856 10800 0 +03}.. {389048400 14400 0 +03}.. {402264000 10800 0 +03}.. {417906000 14400 1 +03}.. {433800000 10800 0 +03}.. {449614800 14400 1 +03}.. {465422400 10800 0 +03}.. {481150800 14400 1 +03}.. {496792800 10800 0 +03}.. {512517600 14400 1 +03}.. {528242400 10800 0 +03}.. {543967200 14400 1 +03}.. {559692000 10800 0 +03}.. {575416800 14400 1 +03}.. {591141600 10800 0 +03}.. {606866400 14400 1 +03}.. {622591200 10800 0 +03}.. {638316000 14400 1 +03}.. {654645600 10800 0 +03}.. {670464000 14400 1 +03}.. {686275200 10800 0 +03}.. {702086400 14400 1 +03}.. {717897600 10800 0 +03}.. {733622400 14400 1 +03}.. {749433600 10800 0 +03}.. {765158400 14400 1 +03}.. {780969600 10800 0 +03}.. {796694400 14400 1 +03}.. {812505600 10800 0 +03}.. {82831

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Bahrain

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.784355129067593
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8hkXHAIgNvZORL/2WFKENUKMFB/4WFKKB:SlSWB9vsM3yBkHAIgPON/2wKENUr/4wT
MD5:	1B5E0D449DAEF469D586A853CB3073AD
SHA1:	FD735B0472B31644E787767B82B737CC39EC4175
SHA-256:	3D437037FBF2BBDF969C8E71967080947F24860D431B39F5D8F23151316ABCD5
SHA-512:	2A2DC33D4258A5E1AE59172883F3B11723798ED35CF5AF1B8BA81A8807DC6F8222C8044D82B152EF6AF43E7350FEB2625D4406C6C7DD309CE65810EA3D3286B6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Qatar)]} {.. LoadTimeZoneFile Asia/Qatar..}..set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Baku

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	3.6155622322573713
Encrypted:	false
SSDEEP:	24:5/eFdqlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUTIEjvZJ+76:5RsUf8mFpNWFny1ZGMte3aivUKo
MD5:	294DFC98F67AC00A188EC3D3B87C501C
SHA1:	93C434CD9AA170E35AD676C88EE09986A94EC02A
SHA-256:	873E8F08B87610D0DAFE239D32345248A4595C6B13D1DA83EC214D78E88FA12C
SHA-512:	5346082CCA733724C0D2C36B768467E59BA9ED6452B6CF1BA923AF4F0D2BC05C67DB49E804CA81DAD449D30D0835026D708D9AB632D02FDA1EA1A0BF717111DE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baku) {.. {-9223372036854775808 11964 0 LMT}.. {-1441163964 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 14400 0 +04}.. {820440000 14400 0 +04}.. {828234000 18000 1 +05}.. {846378000 14400 0 +04}.. {852062400

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Bangkok

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.911309754748998
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKELYOiMXGm2OHB+keoHvZKmrROpDovFFsQ+8EXVeVSYe:SlSWB9eg/2wKELeDm2OHxeoHvZ3FO1og
MD5:	9AC4947AC29C797055B7EBFA4F6AC710
SHA1:	E7758A9A8BFA255F6B2D27F5366D9FE2A26DDF6C
SHA-256:	6E72BA908F250FD45D554A12E3E7B3BD2F1C02A6C2431F806FD2A054F843AA90
SHA-512:	F9D0F0CB7D3726C2AB3B5049429172D9DD4BA21353F6F98570CBA4EE969F7D97BD973CB165AECFF930AFFA8633E8052624D44EE7FB91763681ED3F78A61F4F98
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bangkok) {.. {-9223372036854775808 24124 0 LMT}.. {-2840164924 24124 0 BMT}.. {-1570084924 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Barnaul

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2117
Entropy (8bit):	3.7025684250364725
Encrypted:	false
SSDEEP:	24:5VeTtXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEnsr:5n40yVRB7VfXucdKmtTTDOV
MD5:	6CC13B6910412A3A3D16CA36ADF00352
SHA1:	061CF4A8FEA8C139F50F96E6B6506B50ED3DD792
SHA-256:	992F93A7975F8CD4E94D96B3BA1ECFB3585E52A53F4442A15993402D3F955F66
SHA-512:	4E9750B1C3C0BA4F7922BCBC76276A3E74031D78A98E21DC59F66D6EA8E1B70865BBEB50A6B77EB0423421A18428B97B47412053CE15213128CEED669F4DD6E8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Barnaul) {.. {-9223372036854775808 20100 0 LMT}.. {-1579844100 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {76470

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Beirut

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8024
Entropy (8bit):	3.7230911686481774
Encrypted:	false
SSDEEP:	96:4nBKPP8LFH0TDkywaZb1QSCK5VUjiO1PoBQpo7778CZicJZS80EGcLt4Mok1MgJl:4M38LCRZb+sAiO1PoBQpo1ikjD
MD5:	1D99E2BBB01B1669403CFBAF7E03F733
SHA1:	DBDD58C7FD195FC602C4541D6F416CC96094C121
SHA-256:	17AF14646D562AFE17DCCFD1D2FBA95C122F3E0263906A36EB48BFF04ACF233E
SHA-512:	98524E8DCD17C090058F17BDA1200D9801EB1B14EB5CEB8C31149A4A402A53BA4923A2AFF457E0A72DAA601D88095247806F945F704000F874FCBF73631DD135
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Beirut) {.. {-9223372036854775808 8520 0 LMT}.. {-2840149320 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1473645600 10800 1 EEST}.. {-1460948400 7200 0 EET}.. {-399866400 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336794400 10800 1 EEST}.. {-323578800 7200 0 EET}.. {-305172000 10800 1 EEST}.. {-291956400 7200 0 EET}.. {-273636000 10800 1 EEST}.. {-260420400 7200 0 EET}.. {78012000 10800 1 EEST}.. {86734800 7200 0 EET}.. {105055200 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {212965200 7200 0 EET}.. {231285600 10800

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Bishkek

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	3.7443715330695735
Encrypted:	false
SSDEEP:	48:5qvdJqxiF0rvK5XvV4vUzvCjvT7voPvkPvJUbvn0vYpv99v3uvuWvKJhv3T:Ad1mzK5/VkULCbTjoHkHJUDnQYV9p3mO
MD5:	1EE8FF3DF0D931A140ADBB021EB3BFEB
SHA1:	F1F15EF70C4E9F456849AF89CAC97AD747D9E192
SHA-256:	1D5E9A8F6A04273AF741F648EF10718B004A60D7884FE432DDF85A8F558BEA98
SHA-512:	155539A5CF21A34FBFACBF1652D934BF32255F4E505E60B3B4D8B5F2F7FAE552E6CB4824D8608A9C56370F58E48702335995BBD16B7A296A86A72A615FBC8ABC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bishkek) {.. {-9223372036854775808 17904 0 LMT}.. {-1441169904 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {683586000 18000 0 +05}.. {703018800 21600 1 +05}.. {717530400 18000 0 +05}.. {734468400 21600 1 +05}.. {748980000 18000 0 +05}.. {765918000 21600 1 +05}.. {78042

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Brunei

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.843807524560784
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKXeAMMkSMXGm2OHCQdvVVoHsWUOVFW/FvOVSSFdaUMWO:SlSWB9eg/2wK0iDm2OHCIvVVoH3UuW/N
MD5:	37B0C37CDDEE62E6002AF3D09B0B6225
SHA1:	75F1329492C231587FE233175D9B71112DA09B08
SHA-256:	A4216B59F2478DE7E88A99E2B11BBBD93070477D7E62BFD453D1CA430EBB4834
SHA-512:	6FDC5C74F927970DA261A5842D9647E97163009A2902C8A8AB6DFAACF261485AB179495D2D72FAC513D1A27F662553F1F0EEC8687E009EA5753D5A9E6B0A0D34
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Brunei) {.. {-9223372036854775808 27580 0 LMT}.. {-1383464380 27000 0 +0730}.. {-1167636600 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Calcutta

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.774027471796823
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq864DyXHAIgN1QvRL/2WFKh0s+WFKvovn:SlSWB9vsM3ya4DSHAIgcvN/2wKN+wKvy
MD5:	8BB098AB77CB0469B1FA0E0B64C4A9E7
SHA1:	88C73626985071DD0923E1CAB343ACCD854A7297
SHA-256:	1BAEF7850111D2C33B2A766A8AE804534ABA1711BF80A4087A89656DDD8469D5
SHA-512:	82216A7F787AF20A4C97C7AA754CD6BE979FEF24137CF9A8B18EECA5E8FBCF12834DD8A6FC9CD2357D807F1629806745B46B11DC0472E0284E18DCCC983897DE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kolkata)]} {.. LoadTimeZoneFile Asia/Kolkata..}..set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Chita

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	3.6981807774781017
Encrypted:	false
SSDEEP:	48:5Bpr1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2M:95PhtjLiII2ZFlgd
MD5:	69E03A5CEB689E19B60168C0F7EBAE8E
SHA1:	95C6396EB753753B4FE4AE1B98D76332523E72A4
SHA-256:	10B6F435B05D887176A4D90CA5AC957F327F62F36F15D6F6E4F81844662429B9
SHA-512:	DFA72EDC54A11F0840ADBEE7F5AD8EA472AA52A1F196292F1341CD92A68FB2EC0A5BC7DE6C8E83C975420DB4B76CECD4393370FDB2C09F86EC11A50E540F6F02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Chita) {.. {-9223372036854775808 27232 0 LMT}.. {-1579419232 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647012

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Choibalsan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	3.775783980828041
Encrypted:	false
SSDEEP:	48:5th5fSW2sp4Qh2rRSQnGw7GywvWbC25XrMYWG4AIQTUhp9pkTGdXguHaena44XY5:rh5kpmWG29QFUmD
MD5:	540A7304A62ABB8D7F84454ABD6E2556
SHA1:	52C37529929218A668D7A4AD6FD1B5FE0A727E16
SHA-256:	94B2C14EF45C695EF6B19D94722E1BCBB629A595F2866DBA80F00A66721040B5
SHA-512:	3B535D109DB369E301D6B412F21EC990976B997826F22B2E16ECEEEB048D60F064C7CA1A616393DC2F1B491BAC0548DC0965B9EA149A95280FFDBCAD6726EF0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Choibalsan) {.. {-9223372036854775808 27480 0 LMT}.. {-2032933080 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 36000 0 +09}.. {433778400 32400 0 +09}.. {449593200 36000 1 +09}.. {465314400 32400 0 +09}.. {481042800 36000 1 +09}.. {496764000 32400 0 +09}.. {512492400 36000 1 +09}.. {528213600 32400 0 +09}.. {543942000 36000 1 +09}.. {559663200 32400 0 +09}.. {575391600 36000 1 +09}.. {591112800 32400 0 +09}.. {606841200 36000 1 +09}.. {622562400 32400 0 +09}.. {638290800 36000 1 +09}.. {654616800 32400 0 +09}.. {670345200 36000 1 +09}.. {686066400 32400 0 +09}.. {701794800 36000 1 +09}.. {717516000 32400 0 +09}.. {733244400 36000 1 +09}.. {748965600 32400 0 +09}.. {764694000 36000 1 +09}.. {780415200 32400 0 +09}.. {796143600 36000 1 +09}.. {811864800 32400 0 +09}.. {828198000 36000 1 +09}.. {843919200 32400 0 +09}.. {8596

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Chongqing

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.865222436335267
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKh2V7/4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKho4wKU
MD5:	C5DC40C6325391F7247251ADB2C07F78
SHA1:	3DDB1BF94532FB1F1271095B9C8CAA779BC545EF
SHA-256:	A87382DC5F3C3141547A65E3746AF1DAF94B51468B96DA6CEF30E95754C97D37
SHA-512:	062FF8D5E5392E5372B0405EDF3C7CF997AC33F95EBFFAA9CC9AB82BBE27B60C80255FCCEE9E6F5E02CBFCB163F99984BB2103217FFD1F80BDEC5C684BF2F61A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Chungking

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.889115378893491
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFK7LeL9J4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wK7LUT4wj
MD5:	C3676771EB813B346F58A7B574D0D7B5
SHA1:	A473EF621309E019F29F3DEF95C38593775B8404
SHA-256:	D6D2B4A761C547F1F853AE901AC71AB49FBE825037079C4E0C89DC940AE4A822
SHA-512:	21C3A5D499E6E0427FBF585CA8CC5D99D193C586483AB107C4D8E9F9DC8412021E8E019A314757DAFE1225D2635F6D48E9C54A511709863F22A02449FA201E02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Colombo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.465596050904646
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKr+iDm2OHgoHvZv9tdvjSWV/FSQipPUrKkTD/k5QqRVVFSQOR/UIp:MB862zZmdHgCvZvJvj1Nj+Phkv/YtvjA
MD5:	9541BB43E79AB0C6E8163945B5BFB1BF
SHA1:	C4994420DB8313DECDE19B4B9F6C5DB0126A95A7
SHA-256:	E5B5E6D607A15DA65CB00C92C35A63EAF25F547E64CB34BB419CB8CFC2714B1B
SHA-512:	46F623B3F7CF8A50F97DD812521398EB9100C9CDFB967C18EF1BD112306AAEB3C9CB224424E48611CB8CC21D1DC3D820DD83032D12BC9DF19301CF07786FA664
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Colombo) {.. {-9223372036854775808 19164 0 LMT}.. {-2840159964 19172 0 MMT}.. {-2019705572 19800 0 +0530}.. {-883287000 21600 1 +06}.. {-862639200 23400 1 +0630}.. {-764051400 19800 0 +0530}.. {832962600 23400 0 +0630}.. {846266400 21600 0 +06}.. {1145039400 19800 0 +0530}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Dacca

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.786111096226559
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8ntyXHAIgN6KyFvRL/2WFK1S2WFKwBn:SlSWB9vsM3yHtSHAIgMKON/2wKM2wKwB
MD5:	BA575D37459540907A644438071277F8
SHA1:	14CF10D6AABBAF7BAE42B3B9641D8469C206567F
SHA-256:	B3AD560F66EA330E54A147017E6E6AB64452A5255D097B962D540836D7B19EE7
SHA-512:	9CA386EF4D812B00C2E63558B81B273F92BBCA98AF304C9FD6FC166210FC4E2F92B769E1D6FB96B670650DC76EFFAD2FC6E39AE12C24B47EAED4E50A2AFAC2D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dhaka)]} {.. LoadTimeZoneFile Asia/Dhaka..}..set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Damascus

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8311
Entropy (8bit):	3.719987853637512
Encrypted:	false
SSDEEP:	96:8YI5WpVAdVGlkBOLh8X0CkBheIFlPup7YI6z0Y3lV9Jitv5F6Ya7vEzg93kn/R:8dIpqdk6BrqhXFlPUsz57AbV
MD5:	DCB84F498498C06953E7FC1A4FD9AF17
SHA1:	5B5A115CDA727C9439667E3E95CA3333E49BA810
SHA-256:	7D44F4C16E862752D399999B9F0B1E4E8ED5D80C1322A980094801DD8A4A03EB
SHA-512:	DC143B6DB263377413D4BBC9575236D525F6ED898934CB9A2FC1E3B32E1235F2D86BD8E133B38463DFC143EC2F6E8AA9184048479A4E797C39D63A1AD364BB74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Damascus) {.. {-9223372036854775808 8712 0 LMT}.. {-1577931912 7200 0 EET}.. {-1568592000 10800 1 EEST}.. {-1554080400 7200 0 EET}.. {-1537142400 10800 1 EEST}.. {-1522630800 7200 0 EET}.. {-1505692800 10800 1 EEST}.. {-1491181200 7200 0 EET}.. {-1474243200 10800 1 EEST}.. {-1459126800 7200 0 EET}.. {-242265600 10800 1 EEST}.. {-228877200 7200 0 EET}.. {-210556800 10800 1 EEST}.. {-197427600 7200 0 EET}.. {-178934400 10800 1 EEST}.. {-165718800 7200 0 EET}.. {-147398400 10800 1 EEST}.. {-134269200 7200 0 EET}.. {-116467200 10800 1 EEST}.. {-102646800 7200 0 EET}.. {-84326400 10800 1 EEST}.. {-71110800 7200 0 EET}.. {-52704000 10800 1 EEST}.. {-39488400 7200 0 EET}.. {-21168000 10800 1 EEST}.. {-7952400 7200 0 EET}.. {10368000 10800 1 EEST}.. {23583600 7200 0 EET}.. {41904000 10800 1 EEST}.. {55119600 7200 0 EET}.. {73526400 10800 1

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Dhaka

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.412125512631861
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKwiDm2OHEmVFnoHv9vX+Yl7UIFckVVFSQiL/FG/UIvy/Ur9i/Ur97:MB862Y2mdHzdCv9P+Y9vvjeQlP9/9VkK
MD5:	B5496A038AC230B9D75AA22BB2BE6BDD
SHA1:	ACFD9C78F803F344272E8E188C41ED969EBADA16
SHA-256:	BFC4562055CC4355E79F9EFAA580A4C6A658285916159A5D390A0CDA96A97E98
SHA-512:	AB05D0176DADC1ED03CC526C372B9827A5FA03459E4F4B4365C6CE4B6FBDA043514A9D3FE2DA747159C5A1BC0E07727E6578A101E42B4DB120AF9624368C5FEA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dhaka) {.. {-9223372036854775808 21700 0 LMT}.. {-2524543300 21200 0 HMT}.. {-891582800 23400 0 +0630}.. {-872058600 19800 0 +0530}.. {-862637400 23400 0 +0630}.. {-576138600 21600 0 +06}.. {1230746400 21600 0 +06}.. {1245430800 25200 1 +06}.. {1262278800 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Dili

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.597480383845617
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKCXeSDm2OHnBGeoH1mpvyvScHTU71avScr:MB862qXbmdHnBvC1SyHHq8Hr
MD5:	316DDF860FA234621698EB473E558DB7
SHA1:	35BF955F764555945CF8B314B8E881DAD6CF557B
SHA-256:	8BC2E0D77AC35B6D63E11B820AC45EC23A4195ED773680C600C772FDF4B953F8
SHA-512:	D1A8D5F1DAAB7827BDCBC14506AF8681FD1ED94C6101CC4A3C8CC2A76EA7D3649038069158C539A2007A1B0734FBD87DE120415E07A3F08F44417100C95459F5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dili) {.. {-9223372036854775808 30140 0 LMT}.. {-1830414140 28800 0 +08}.. {-879152400 32400 0 +09}.. {199897200 28800 0 +08}.. {969120000 32400 0 +09}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Dubai

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.97292023820863
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKQUMXGm2OHvkdoHsQK23NVsRYovV:SlSWB9eg/2wKQUDm2OHvsoHxVNSN
MD5:	861BA4A0A71E6C3F71B90074275FD57C
SHA1:	BC6FC5233340BB19AE4BD0BA563875479AC0A2B9
SHA-256:	3DB174F1568BC23BF467A3DC7BAF8A2A2952B70653D4DE54F4DB391EC50B6925
SHA-512:	B187735E0783F299253D9F93E002AEFF131FCCA50FB3E04CF0545B334B051D5ED978108A47C6957B608F5F93ED4CC3D69751FE0F40413719EE1C0440CD49AC76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dubai) {.. {-9223372036854775808 13272 0 LMT}.. {-1577936472 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Dushanbe

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	820
Entropy (8bit):	3.969189280047274
Encrypted:	false
SSDEEP:	24:5we3dJvOt81FCuLqecDngO6jPvTpYy5T4TiFGDr:5BvdJqxiF0uGr
MD5:	9ABD0ECB5F3E738F49CDD1F81C9FF1A4
SHA1:	46B68C7BBD1BE9791B00128A5129AA3668435C93
SHA-256:	550DB44595F59D0F151BE4AF70D6FECE20580AB687EF45DE2A0A75FB2515AC80
SHA-512:	67E2B0EF216D509C4B6DD367519E0A733E54A7CA767D5F7960715E8056E61B7B633C7516D568544F55C9277E90412C1443B822C6EED3341C01F1BD9AA9476FA1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dushanbe) {.. {-9223372036854775808 16512 0 LMT}.. {-1441168512 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 21600 1 +06}.. {684363600 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Famagusta

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7597
Entropy (8bit):	3.7170041442081203
Encrypted:	false
SSDEEP:	96:G3pv/7V6Aj8aZaNlK0UpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:G3v/AaaivBeRF+W35Syrwl9h5j
MD5:	F8E4BA3E260452AE13CF234E60149A62
SHA1:	8DDB08E2FDEEF6539EE0C0038B166908BFED16CD
SHA-256:	8CFE85C48FC22033411432F8B75EE4C097A5D84897698CB1AFD5AB51C47FF5A3
SHA-512:	487177411FB7E9F83AB9AAD84B685322B13A85784D4F90BB9C30F57BFAA6A9298E5C4F36C97444DE1117E51F85A62DC639D08B405460D071C2B29C898553E9A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Famagusta) {.. {-9223372036854775808 8148 0 LMT}.. {-1518920148 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {622587

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Gaza

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8427
Entropy (8bit):	3.7517631589916043
Encrypted:	false
SSDEEP:	96:NyHSd2XK1GbJFp3gP0nPVl8dcqU/8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBjq:NyyIgGbJv3dPAD7c1Flvai+4j/NKJ
MD5:	E539AE663A076DD9F1C6E927289DE5B1
SHA1:	855BCE0790A7259B01181861BCC748FE5F2815EB
SHA-256:	F030E2B3DBCA556C36602FBF234C7DB7D4F222D02CFAB192288E91E6A1BF3C90
SHA-512:	83E87396576A36455DF22EE809D71CBD18CDEC7F574A7AABFF6D5A21A71D2BE865B84105E2D72FD89F3C9AB19B66B6893F82934925E2311A8E6EAA015D6227F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Gaza) {.. {-9223372036854775808 8272 0 LMT}.. {-2185409872 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-16580

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Harbin

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.86422571961583
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKwHp4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKi4wKU
MD5:	1BCCB3578FADE993EE8B2C11EAC06CD8
SHA1:	CAEAB714E014CD5040C44E4603708B97BC0B03D4
SHA-256:	12811A7944B892E3D1C0B4B09057CC1899F28081B3CD47FFD248BA49BA308AF0
SHA-512:	1D791DC0E8F45359366DF33C2C337688D2E0E972A90F038733B840D28585505AEF542DDBAD014C9EA8C252048A588CD017DD67A84545A81EDB7C17E3B2E65092
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Hebron

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	3.754379249421927
Encrypted:	false
SSDEEP:	96:fXSd2XK1GbJFp3gP0nPVl8dcqUZ8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBj5w:fiIgGbJv3dPADPc1Flvai+4j/NKJ
MD5:	02B58C89D64C423A47559B2386FDAD1F
SHA1:	B01C4C83ACB44F454A593A510BCBB5A4068EC835
SHA-256:	2C126BA5F78CF7A13FBDFE00F647BB29E2AC104B89AB51B39281047D9B2E45A7
SHA-512:	BBF564FBBDF90091F4D97F3DCFA0F2AF1CE6EB6B0D24CE4F4133E098F7A637344A78BB27DD8160D8424148ECB46B7BF578959B15F9AA0AEAD5D080DCE7C9C176
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hebron) {.. {-9223372036854775808 8423 0 LMT}.. {-2185410023 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ho_Chi_Minh

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.419283016412891
Encrypted:	false
SSDEEP:	12:MB862RLmdHqCv3tYC5sF/p+zHHviViksF/dMUYPsF/RQ9EsV:5debv3td5sFR+znv2vsFlM/PsFVsV
MD5:	5154581E724080F43C9D68B983C5CF77
SHA1:	1BC86A418AA654DA9EF73954DFD01ACF53D796E9
SHA-256:	FE977368691F4FA43D068CD8D989F39D2AEC46D199D7D629B8DD3ECF7423A335
SHA-512:	3708654E022919D5CDC2CA90D8623370CFFF248E3AF10ECCBB6F56BC7E8DD000E6119614C30678D6628BBE6A8CCA00746315108A04632B3F6DD2DE172BBF8956
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ho_Chi_Minh) {.. {-9223372036854775808 25600 0 LMT}.. {-2004073600 25590 0 PLMT}.. {-1851577590 25200 0 +07}.. {-852105600 28800 0 +08}.. {-782643600 32400 0 +09}.. {-767869200 25200 0 +07}.. {-718095600 28800 0 +08}.. {-457776000 25200 0 +07}.. {-315648000 28800 0 +08}.. {171820800 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Hong_Kong

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2226
Entropy (8bit):	4.0055033036300145
Encrypted:	false
SSDEEP:	48:5Ze9l9Pm4yoHtTYJJIX1Zcp6GS0j1SPQpP6gPE8fTZIPNYQGm75st/nQdwi9:DyaoTcwQt6EsQTng
MD5:	26BCBBA28AE34FE3CF7D17EF4C6B69C8
SHA1:	5324DEA8E7965C66650E7B4769EFA1297B508486
SHA-256:	EE9A6997BC1AAD4A8FA95DB312774C3F37FBB895549230C30FC66C02CC170EB6
SHA-512:	54594CD18838B4A8947EBB5BDE2415727CC127CF79AEC98FC0F5D5A32F68EEAF4E079853239DE9F753CE90F18EFD55AE51FC43D64E313666CEA0EF8AC93BF065
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hong_Kong) {.. {-9223372036854775808 27402 0 LMT}.. {-2056690800 28800 0 HKT}.. {-900910800 32400 1 HKST}.. {-891579600 30600 1 HKWT}.. {-884248200 32400 0 JST}.. {-761209200 28800 0 HKT}.. {-747907200 32400 1 HKST}.. {-728541000 28800 0 HKT}.. {-717049800 32400 1 HKST}.. {-697091400 28800 0 HKT}.. {-683785800 32400 1 HKST}.. {-668061000 28800 0 HKT}.. {-654755400 32400 1 HKST}.. {-636611400 28800 0 HKT}.. {-623305800 32400 1 HKST}.. {-605161800 28800 0 HKT}.. {-591856200 32400 1 HKST}.. {-573712200 28800 0 HKT}.. {-559801800 32400 1 HKST}.. {-541657800 28800 0 HKT}.. {-528352200 32400 1 HKST}.. {-510211800 28800 0 HKT}.. {-498112200 32400 1 HKST}.. {-478762200 28800 0 HKT}.. {-466662600 32400 1 HKST}.. {-446707800 28800 0 HKT}.. {-435213000 32400 1 HKST}.. {-415258200 28800 0 HKT}.. {-403158600 32400 1 HKST}.. {-383808600 28800 0 HKT

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Hovd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	3.7521760184466206
Encrypted:	false
SSDEEP:	24:5x3LecCvgsFFFKOksF8FpsF71FQnsFNFxhsFlF6sFaFasFZFisF8GF5sFKLFAZsZ:5FqKVx8Cq9f/y2L
MD5:	A77140A0D8C2D3E2993E4BA7CADFB4C6
SHA1:	AE3586264A86D42F578D4B0F7A30C9BE6047EAB1
SHA-256:	CA88A45E954A9854C680B399E69E4858BF5E861FABFADC19D62D97B734B25415
SHA-512:	05EA9D903EEC755F799B7C2399ED933245A5AE3A594648FE37AF1CE7699AE499B4ED159F428D91259D80BC9AF5117F2DA055A506AED94E5281C38B7AFF69C6FE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hovd) {.. {-9223372036854775808 21996 0 LMT}.. {-2032927596 21600 0 +06}.. {252439200 25200 0 +07}.. {417978000 28800 1 +07}.. {433785600 25200 0 +07}.. {449600400 28800 1 +07}.. {465321600 25200 0 +07}.. {481050000 28800 1 +07}.. {496771200 25200 0 +07}.. {512499600 28800 1 +07}.. {528220800 25200 0 +07}.. {543949200 28800 1 +07}.. {559670400 25200 0 +07}.. {575398800 28800 1 +07}.. {591120000 25200 0 +07}.. {606848400 28800 1 +07}.. {622569600 25200 0 +07}.. {638298000 28800 1 +07}.. {654624000 25200 0 +07}.. {670352400 28800 1 +07}.. {686073600 25200 0 +07}.. {701802000 28800 1 +07}.. {717523200 25200 0 +07}.. {733251600 28800 1 +07}.. {748972800 25200 0 +07}.. {764701200 28800 1 +07}.. {780422400 25200 0 +07}.. {796150800 28800 1 +07}.. {811872000 25200 0 +07}.. {828205200 28800 1 +07}.. {843926400 25200 0 +07}.. {859654800

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Irkutsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	3.7296034934492694
Encrypted:	false
SSDEEP:	48:5PZy4DdOKStci4KjXoYjoSvfQJWE00dtT43kgiTskNrrBizhzRBqY3M:Py2/svfraBGfgP
MD5:	C9F7AC464970567E5C38CB01ED2297AE
SHA1:	453718BACCAE3FACD761AF22CA5875185478ADDD
SHA-256:	61BAAAD6315FFBDAED6F266880165B06ECCAF72F660B7FB01C8B654F3952D68E
SHA-512:	72044EFAE262CC12974F2DE2AAF06AC4C31BE73071ACD53DDC6B8D8BFC6FBDF937EC03DC881901F730659BDE662FBCFC76C57B2C086DAA97F160530464FBA7C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Irkutsk) {.. {-9223372036854775808 25025 0 LMT}.. {-2840165825 25025 0 IMT}.. {-1575874625 25200 0 +07}.. {-1247554800 28800 0 +09}.. {354902400 32400 1 +09}.. {370710000 28800 0 +08}.. {386438400 32400 1 +09}.. {402246000 28800 0 +08}.. {417974400 32400 1 +09}.. {433782000 28800 0 +08}.. {449596800 32400 1 +09}.. {465328800 28800 0 +08}.. {481053600 32400 1 +09}.. {496778400 28800 0 +08}.. {512503200 32400 1 +09}.. {528228000 28800 0 +08}.. {543952800 32400 1 +09}.. {559677600 28800 0 +08}.. {575402400 32400 1 +09}.. {591127200 28800 0 +08}.. {606852000 32400 1 +09}.. {622576800 28800 0 +08}.. {638301600 32400 1 +09}.. {654631200 28800 0 +08}.. {670356000 25200 0 +08}.. {670359600 28800 1 +08}.. {686084400 25200 0 +07}.. {695761200 28800 0 +09}.. {701805600 32400 1 +09}.. {717530400 28800 0 +08}.. {733255200 32400 1 +09}.. {748

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Istanbul

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.9013773460609
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/2WFK4HB/8QaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/2wK4HJa
MD5:	8A92C690BE27A69D122BFF51479B7B56
SHA1:	52DB64587A347F34153A51788BDE8C349D966575
SHA-256:	1F77C4BD27574E1D2066885DEF01806A02D3E444424A219A8EC5C114F89665E5
SHA-512:	FEDF57C4862B6792A789F339EB1027EC8A8472B01B7D1D0814C419850B9AC03A7B454FDB04D8BECE166E9A8BCAA58B0B461007A6C824B30B1080991A1DB49CCA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Jakarta

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.4733192761103515
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKcrJfDm2OHATJeoHMaSYov/YSZkc5q/MVSSFFWSyvScH+dMVSSFL+:MB862EJLmdHjCEdOc5aMxaSyHHaMxF6P
MD5:	C689A1AA9FFE535AEB3AD3D7EDE55172
SHA1:	0520FC9A4619FB555A79C5DF2AE82422BF2C5EDA
SHA-256:	2F39D9F93761B85C254F458317A7DE2B4184BE9459F2193A85C08662E801269A
SHA-512:	C1034FB2FCFEF201C5362AF21B048B6637A824C5C93D75854CF3807892C772CD4376533E58BFF8D8726F531F43CB231365B8012EBD3C1BECED865D3CD2D6673D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jakarta) {.. {-9223372036854775808 25632 0 LMT}.. {-3231299232 25632 0 BMT}.. {-1451719200 26400 0 +0720}.. {-1172906400 27000 0 +0730}.. {-876641400 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 25200 0 WIB}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Jayapura

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.834345288972067
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKcaDm2OHG4YoH1kcfvScHVowkVcr2CV4zvhyov:MB862PmdHNYC6cfHHVop2NVkoov
MD5:	2CB3A13FCC48F8C4457E001FC309918B
SHA1:	83174176815CB93D216B5BC532C120EC8AC433CF
SHA-256:	761C1E80FEBF46D6D6215CEBF211F121974156D9BCE2FB4258C1074C6ED2CE22
SHA-512:	65009020AB9FEC2F8158A4851A78B71127F9B262DDD1472583942E19B7C086304F54BC8DAE5A40BD1448BCAEDA0FDBACCD19400E10FFA0357E324535F9036EF0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jayapura) {.. {-9223372036854775808 33768 0 LMT}.. {-1172913768 32400 0 +09}.. {-799491600 34200 0 +0930}.. {-189423000 32400 0 WIT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Jerusalem

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8135
Entropy (8bit):	3.770028446231146
Encrypted:	false
SSDEEP:	96:GKfnxFAEX/nPVl8diAg9oEhH20AHz7LzdWhYbBJPXuVhKaM76Rmg4DLeEcNptv5C:7ffBvPAzF0AHzPzdD1+XBRF0
MD5:	884227D48C92BA6C519BFE571D4F1037
SHA1:	21F8977816C2B439686A50D353B836A6D132A946
SHA-256:	0BDC2C693134199C2ECD374CC01468813DB29DF47422C706A3EA2BE5ECCA177A
SHA-512:	8A09F1FE11DAD203501A16FE6A2CAEC969FE3553B456B8BD1997E55B3EE430B2BB4B54F7D87C5E99931FD96E7C769CAA618C777EBD23FBD1E1A0F57409422914
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jerusalem) {.. {-9223372036854775808 8454 0 LMT}.. {-2840149254 8440 0 JMT}.. {-1641003640 7200 0 IST}.. {-933638400 10800 1 IDT}.. {-923097600 7200 0 IST}.. {-919036800 10800 1 IDT}.. {-857347200 7200 0 IST}.. {-844300800 10800 1 IDT}.. {-825811200 7200 0 IST}.. {-812678400 10800 1 IDT}.. {-794188800 7200 0 IST}.. {-779846400 10800 1 IDT}.. {-762652800 7200 0 IST}.. {-748310400 10800 1 IDT}.. {-731116800 7200 0 IST}.. {-681955200 14400 1 IDDT}.. {-673228800 10800 1 IDT}.. {-667958400 7200 0 IST}.. {-652320000 10800 1 IDT}.. {-636422400 7200 0 IST}.. {-622080000 10800 1 IDT}.. {-608947200 7200 0 IST}.. {-591840000 10800 1 IDT}.. {-572486400 7200 0 IST}.. {-558576000 10800 1 IDT}.. {-542851200 7200 0 IST}.. {-527731200 10800 1 IDT}.. {-514425600 7200 0 IST}.. {-490838400 10800 1 IDT}.. {-482976000 7200 0 IST}.. {-459388800 10800 1 I

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kabul

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.8546989169864085
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKTtNMXGm2OHodFxsYoHvgVHURRNVsRYovFFFkdj/cXHF:SlSWB9eg/2wKTPDm2OHoH+YoHvgVHURA
MD5:	9BD9B21661C235C0794078EC98978D3B
SHA1:	3D854780F49D0E5F5A190DC9367C7406127C5E4D
SHA-256:	A59C95C038F2E945D685D96FA9B859CE82A643A1B7F56EB36B2C809DE91CD4BA
SHA-512:	A76E99CF03DA8897F0A210A98DB79E4CD60070F2BE363D0D0960D9882919F9B49978FA55BB2500F1648ADD4080730CAD85BAFF61D885A9EAD394AC04C850F6BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kabul) {.. {-9223372036854775808 16608 0 LMT}.. {-2524538208 14400 0 +04}.. {-788932800 16200 0 +0430}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kamchatka

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	3.788131608921229
Encrypted:	false
SSDEEP:	24:5+SeWI/2kkWk7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5i/2ZsFLrcZwvJt2F+doTr9Q3G80
MD5:	390F39934F095F89358B73D056D90264
SHA1:	6B57CE5346B50ED88BFBB6BC57F834FB3F564905
SHA-256:	6E0278E389072437BC07A5032CD58E9E5B1B2BDB20918632C422EFA97BC43ABF
SHA-512:	6C54D94E95D73030F2FFCF8D130494CBD79FB1CEB9B59ADE0743C10F02557C3DD59CC6274B262A7E29C2D4C35DDA4B6A9A0398C661F5BD40F3B92181192B9577
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kamchatka) {.. {-9223372036854775808 38076 0 LMT}.. {-1487759676 39600 0 +11}.. {-1247569200 43200 0 +13}.. {354888000 46800 1 +13}.. {370695600 43200 0 +12}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965600 43200 0 +12}.. {764

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Karachi

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	457
Entropy (8bit):	4.396286144160272
Encrypted:	false
SSDEEP:	12:MB862dmdH35Cy6DvjeQXvjKEn6vNEhFc0bkTfb2iWToN1:5de3IjjeQ/jKE6vNNa8
MD5:	DF604BCD42A3C1E6BABD0E4FF5764CA3
SHA1:	984111F3A75EE7D8760AA2B839010545AF8EE359
SHA-256:	4E7F7ACAE8B4018A835328744F680C8054771805BB0BB07678A09737963C090D
SHA-512:	690AC3FC7CA3C66AA70F17E38C6B43FFACAB3F86040C3BA94FBFF80AC8C1AECF8192E503282109DABF3228F8DC73C732F1041C80455B8B26BDB25C4C32FA286A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Karachi) {.. {-9223372036854775808 16092 0 LMT}.. {-1988166492 19800 0 +0530}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 +0530}.. {-576135000 18000 0 +05}.. {38775600 18000 0 PKT}.. {1018119600 21600 1 PKST}.. {1033840800 18000 0 PKT}.. {1212260400 21600 1 PKST}.. {1225476000 18000 0 PKT}.. {1239735600 21600 1 PKST}.. {1257012000 18000 0 PKT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kashgar

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.967143524972358
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8s4YkyXHAIgNrYOARL/2WFKu3e2WFKjov:SlSWB9vsM3yMGSHAIgvAN/2wKulwKjy
MD5:	259662F35AA09A891C2DDF8FCFECD6F0
SHA1:	DBB3A363A34C33F0B6B0D677E43C2985E2BAF976
SHA-256:	7B2251F0A41CBADF45D69F24604834167B14D8D33B510E635719AB404CABBCE2
SHA-512:	CD7E514555D58985C774535556B66542EFC5FB7CD5891F42FE21B591612CB7EBD4B41E96593E26E9283BA1B01EF3BE0FDFAE871F5EF6ADF2286AF1E479DCB44B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Urumqi)]} {.. LoadTimeZoneFile Asia/Urumqi..}..set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kathmandu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.896398105471451
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKXIi7hvXMXGm2OHF+VT5oHsQKwMTXvv6Q6zRk8P4VvW/:SlSWB9eg/2wKYghfDm2OH0T5oHxNMzv8
MD5:	7AC6429D2A08372C71C61B4521246FEC
SHA1:	6E50F5AD1018398491453D751F8B717B618EF46E
SHA-256:	F0A0816E62036637F75081CBF17A1E6B8FBC2D86AEC3CD2E234BBBDD6EC9F109
SHA-512:	A5389A318896ABCAFE419262F6B8CA86C917788F1E2AFBC8CB1C074A52870E7A92C9F6F7D79DDE4AB0D267D870D3CCD69B3FC5FD57520352EFE36C583B493FB9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kathmandu) {.. {-9223372036854775808 20476 0 LMT}.. {-1577943676 19800 0 +0530}.. {504901800 20700 0 +0545}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Katmandu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.8363583658476745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8yIi7V5XHAIgN1AIilvWARL/2WFKSiZ1/2WFKXIi7y:SlSWB9vsM3y7gVJHAIg5QOAN/2wKSg15
MD5:	4CCC96293A33113D9ADC4130DCD19CBA
SHA1:	7BAB4B8DD6BB415A2FC86D9AB36BE2A893C03153
SHA-256:	9ACC9586B6F8B53BFE8B242283A434A9A9633D60559EBFDEE263B4C8915D50CA
SHA-512:	644E1777E01C15A728E30526F131462FCE50476A8FEDA9B99F41D95013BB8833A79437E75AA2025E2FD2E253B9AD40709DEF77E1F0C73DAAE7A9CF886A175A03
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kathmandu)]} {.. LoadTimeZoneFile Asia/Kathmandu..}..set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Khandyga

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	3.707911838150672
Encrypted:	false
SSDEEP:	48:5No6r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFYkRDhUBAc6l:r5PhtjLiII2JBC6c6l
MD5:	D7B394A9662D60D01781005FE73CC9E8
SHA1:	50B5EBD02596DC45D1F69358C5B69DD3058905FC
SHA-256:	33203D7FB7F3D1F848640ECE0642A2305E1863B4D47413075E2E7E40BD7418E7
SHA-512:	055EBA420F2F6049E803796ACCA263264B9E585E5312A86B8DF7B409C5F1CB1810F3AEDACD66CCF4605E55198947D263C240486C2A4D453D23C89802F0C66BBA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Khandyga) {.. {-9223372036854775808 32533 0 LMT}.. {-1579424533 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kolkata

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	336
Entropy (8bit):	4.614218930153471
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKvhfDm2OHEX3gYoHrXdUvvYbQLpUFdvjSVVFJLNsR/QFckVVFJLLW:MB8623tmdHNYCDWXYbQtUTvjAJBs50vs
MD5:	248F1B5A26455000C936CE8BC02C1A0B
SHA1:	0C3F8CD4E038B113E5238AC52652809B6CA27999
SHA-256:	6D464564ED2EFC9DADA1586D4FC99FE333726D2BE15A00E30C2391F588896463
SHA-512:	AF36B0B3D410305ED504726C87265ACCAF5577A9B5DD7E7DAF135420E356C651287873197431B65B5317B4BA2009274288E4F101AC1274045A8D99E2414AB132
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kolkata) {.. {-9223372036854775808 21208 0 LMT}.. {-3645237208 21200 0 HMT}.. {-3155694800 19270 0 MMT}.. {-2019705670 19800 0 IST}.. {-891581400 23400 1 +0630}.. {-872058600 19800 0 IST}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 IST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Krasnoyarsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	3.7086418466382605
Encrypted:	false
SSDEEP:	24:5Ote2CoXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEw:5B40yVRB7VfXucydm46I/CTxwh
MD5:	A59F7FFD0C3EBAD47EC5F2B89EBBD9FA
SHA1:	ACB94E28E0CF7C6606086267CEA1F63A3E755F56
SHA-256:	53B8D5E7FB1BD67FECE66A933D9BDBB773F14A8C04D316A2A1B00EC6DBC151DD
SHA-512:	7B3886B9D0A793CCEEDB2B190523922CFEBE5C82A5201C9EFA30CA4C7F63FB75C998CC7E1BD48D5D489F16E36FC0C22BD954CB7D321B3C09B36B60629C4C9F7E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Krasnoyarsk) {.. {-9223372036854775808 22286 0 LMT}.. {-1577513486 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kuala_Lumpur

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	375
Entropy (8bit):	4.4690470842439005
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wK1NSDm2OHroHvmdXjvWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScy:MB862PGmdHrCvovDTMsF/CFDMx/HHbMj
MD5:	5CFF42C943FFC92D16DACEB2872590A8
SHA1:	AEA8B1583764BE2AF7B055BC6AFAA0E486A2E35F
SHA-256:	25A8328B309B68DA85C7A800086A1E4D3C62B96AD97FEF24FC429A14C50E762B
SHA-512:	27800D0401E8D2028730B9664E9489B6A5182C394C2C05509E195D4471B4ABEFC26C82E9B818E94BD5578109728CD891FFE3C156248706A50D792D12A6CD8C96
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuala_Lumpur) {.. {-9223372036854775808 24406 0 LMT}.. {-2177477206 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kuching

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	669
Entropy (8bit):	4.074079100812583
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKPLBDm2OHXoH3UTdMVSSFVM5qGeCiKaFzsBRcerUNwGvULhMXeiCs:MB862HL1mdHXC3UBMxJJo9rphTXUzHHF
MD5:	489E706324960E86B6E174D913C72E02
SHA1:	C7D77482C0D41F3426FC269B3B6C0575EF0E8C7E
SHA-256:	6E35E560675B0B5322474900D4EC8326C504788C1F82E533B09785DEEFF092DF
SHA-512:	5CEFD44656C041E59A16481E042EA914E7C003BDE6ADF5F49B57052E91F4F732A91A244BD8BC09EF5DC2640D3210DEE53882717C5C4CBD85CCE44A93B028E9C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuching) {.. {-9223372036854775808 26480 0 LMT}.. {-1383463280 27000 0 +0730}.. {-1167636600 28800 0 +08}.. {-1082448000 30000 1 +08}.. {-1074586800 28800 0 +08}.. {-1050825600 30000 1 +08}.. {-1042964400 28800 0 +08}.. {-1019289600 30000 1 +08}.. {-1011428400 28800 0 +08}.. {-987753600 30000 1 +08}.. {-979892400 28800 0 +08}.. {-956217600 30000 1 +08}.. {-948356400 28800 0 +08}.. {-924595200 30000 1 +08}.. {-916734000 28800 0 +08}.. {-893059200 30000 1 +08}.. {-885198000 28800 0 +08}.. {-879667200 32400 0 +09}.. {-767005200 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Kuwait

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.877362838821003
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFKdQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKdQ6
MD5:	EA1DB4B80CC74CBA024B9BF3734B31F2
SHA1:	D8131C093BCA3B378BEC606CFEB56A40CB4E246F
SHA-256:	8E0C60A9AA64FB8602EDC35311F7436B04853970A21C1F6C871494A09AAD5787
SHA-512:	3B57C9CCC16AA4FE71D275D5EC6A7BC1838841023EE4408158362A7E13E7F1B345F7D95006BC8D2FC270158864E286A1A9364C792F679D5803BD82148399C199
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Macao

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.781739054385376
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8PWXHAIgNz+NOARL/2WFKf+WFKkvn:SlSWB9vsM3yOHAIg1AN/2wKGwKmn
MD5:	55DAE27AEAA74FE822338C20B6CDFF68
SHA1:	F00EB827DC29EB2063B3A0EDBC39856637C55F33
SHA-256:	4308D741C83B263C7C9FB8EC692A7B7B502135E407B265B12EA7EF92523455C0
SHA-512:	398EE6015C58BDBBEAB49B74833B938FD84DE1AC6D3B8D095CE772ECA980D9E93F4EBFFFFCEAE7F91E287C8CE4F94B1A078D8E1460C352B7C2018F99915838FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Macau)]} {.. LoadTimeZoneFile Asia/Macau..}..set TZData(:Asia/Macao) $TZData(:Asia/Macau)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Macau

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	3.9638741177777868
Encrypted:	false
SSDEEP:	24:5ReCX8Iv3nhPHCvzncCHg9PHjZzH+0HDHN1aHhHNaezHBjHeHsH65H18HDH983lY:5d8u3hfCTcaOrh6qn151Wf3Bogp+nlC
MD5:	B184E7403CB7168607D2C9E158F86A3B
SHA1:	48B003B8F822BE979FBCB08CBDBFFC617BCF99DB
SHA-256:	FBCB92CECB1CB0BC284ADC30D70C5F57B3AFC992136A0D898ABC64490BB700FB
SHA-512:	D8C5C67CAEB7C670B7BD1DACC1203C4DEE4DDB16A780F502C4440997CFCFF869E86842EF87C2CD0E0B942941C02A6BC3BDAB7CEAD78B026B68F4A031173400C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Macau) {.. {-9223372036854775808 27250 0 LMT}.. {-2056692850 28800 0 CST}.. {-884509200 32400 0 +09}.. {-873280800 36000 1 +09}.. {-855918000 32400 0 +09}.. {-841744800 36000 1 +09}.. {-828529200 32400 0 +10}.. {-765363600 28800 0 CT}.. {-747046800 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716461200 32400 1 CDT}.. {-697021200 28800 0 CST}.. {-683715600 32400 1 CDT}.. {-667990800 28800 0 CST}.. {-654771600 32400 1 CDT}.. {-636627600 28800 0 CST}.. {-623322000 32400 1 CDT}.. {-605178000 28800 0 CST}.. {-591872400 32400 1 CDT}.. {-573642000 28800 0 CST}.. {-559818000 32400 1 CDT}.. {-541674000 28800 0 CST}.. {-528368400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-498128400 32400 1 CDT}.. {-478774800 28800 0 CST}.. {-466678800 32400 1 CDT}.. {-446720400 28800 0 CST}.. {-435229200 32400 1 CDT}.. {-415258200 28800 0 CST}.. {-403158600

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Magadan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	3.7643610103361134
Encrypted:	false
SSDEEP:	24:5he9dbbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKx/y:5wv+0j6lua2Gg/3gO8UoOZU2Wc/pKo
MD5:	F62A89F441C9C17EB99F64223C815651
SHA1:	408C38A79E056FF9B03D0DA85114DC015CB66938
SHA-256:	0C6EEEB7975A95C2B0678D137E6A735238D244A37FA11078050051511DE499FE
SHA-512:	55DC72546BDC26450D5318E9D2819E32A91C27D06A7AF5432BD50F8722C69984BBAA8599055A824D2935D919F0C0AA357687DD9B47F49F213EEE21AF7458FE17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Magadan) {.. {-9223372036854775808 36192 0 LMT}.. {-1441188192 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Makassar

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.737440985553183
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wK5XDm2OHUVoHxYQTLQTvj1kc3gEpHkH8vScHr0:MB862hTmdHsCLTI6cQe7HHA
MD5:	9116C0B70AB33EC49F933EAE0238FD4B
SHA1:	BA390E8FBEAF5EA6E861AFC5A51CD4DF0B422461
SHA-256:	30D8AB00E32ECE51442C0310E650D89D6989E0809600EE334CB10C506D84BF9D
SHA-512:	499E60E8CBDA72226BCB4E241020E62B6F88E7D3E4329D260A6536EF87C02D7D61FD1BECC47D4FF308B4EB5D3E7FFBE2EC1C96FE2DEDC09DD1D973421C5FFE1E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Makassar) {.. {-9223372036854775808 28656 0 LMT}.. {-1577951856 28656 0 MMT}.. {-1172908656 28800 0 +08}.. {-880272000 32400 0 +09}.. {-766054800 28800 0 WITA}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Manila

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	421
Entropy (8bit):	4.48495488773916
Encrypted:	false
SSDEEP:	12:MB862GjmdHnCTZBCvEo6AwoucQzy4orjAbomAtoNv:5GjeCVwvB6AduXzylHAMmAa9
MD5:	0FBF0ED252638DF31826C33EB3FFBFE2
SHA1:	3496E4A5251A9BDF3AA4368297140780B6DBF66D
SHA-256:	070D61A0E39643A700ABA89A8A4BE5733BA456958966098405E11ECDFA854D76
SHA-512:	2A40E14964B357809E596DF88D8C4141ED78664BACA0A7724A7CA837EF427DC2B07C48D9DBE5787FAB0015673F5BDE002223D489334C5B91B74EEC5507A14B78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Manila) {.. {-9223372036854775808 -57360 0 LMT}.. {-3944621040 29040 0 LMT}.. {-2229321840 28800 0 PST}.. {-1046678400 32400 1 PDT}.. {-1038733200 28800 0 PST}.. {-873273600 32400 0 JST}.. {-794221200 28800 0 PST}.. {-496224000 32400 1 PDT}.. {-489315600 28800 0 PST}.. {259344000 32400 1 PDT}.. {275151600 28800 0 PST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Muscat

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.805992552335358
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/2WFKvE+H+WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/2wKLewKQ3
MD5:	8AEB5C3E81069F884A370714E8013F1F
SHA1:	4E3DD4A84627E75E84726C0CBA72CA6801280C2B
SHA-256:	011B7DE1C9F7EC241B224BC864D8AE66ACB433FBC8AD939E4DBEB12BE6390243
SHA-512:	50B1DE2615AE9B4781505DC709F9D07F6221D4E6D7B61D7BDA682377EAD9807F47FF0E933B79823D0DFD9F3647A82CFC28FB41FBB2226ED1D08B76F86FEB45DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Asia/Muscat) $TZData(:Asia/Dubai)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Nicosia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7625
Entropy (8bit):	3.7113086720696398
Encrypted:	false
SSDEEP:	96:R3pv/7V6Aj8aZaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:R3v/AauivBeRF+W35Syrwl9h5j
MD5:	2ADD0DFC1F133E4D044727234251A3DC
SHA1:	0D1502986258349E384017BA6CB8FA0AC424638C
SHA-256:	3C3E4844C70D361893EF022D6C3C8E38B243E91D40C5A726C924355476816F25
SHA-512:	70CDD53E7E44EDABF653A4F92EECBF5BB20A31DA95D65209D1CADE7DD9FC68946B8EC8829C28AE00BE5F42AAB545B9282CBBCFC5834437D6A94A179BF4FE0141
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Nicosia) {.. {-9223372036854775808 8008 0 LMT}.. {-1518920008 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {62258760

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Novokuznetsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2063
Entropy (8bit):	3.718004112421892
Encrypted:	false
SSDEEP:	24:526enddzXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFf:5l40yVRB7VfXucydm46I/CTxwf
MD5:	513B6A2AF76DAED9002C037BEC99862F
SHA1:	82D1C47BDF46B8B901C35BACACE8595C093BF5F2
SHA-256:	96A445D47D834C28480D1E2036ECA4962B35AFA494C219065D4879F71C1830DB
SHA-512:	2FE5AF4FA9D6AAB4FBD8E354789B82D39FA1B52394D3A0ABFBC6A30A531E0B7429A3D9AC7835A2843A6E9859E0255565F151FDFC87004ACB4EBD1AAD40BDA8A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novokuznetsk) {.. {-9223372036854775808 20928 0 LMT}.. {-1441259328 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Novosibirsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2121
Entropy (8bit):	3.714792994893581
Encrypted:	false
SSDEEP:	24:52sve20ruXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnF:5Hc40yVRB7VfXu0TKmtTTDOWQ
MD5:	AC8C8D768503C8334A9FBAEF4C3A9CAB
SHA1:	CA10BB99E2D7AB329229759BD4801068A3AEB6D5
SHA-256:	EF799077291F6B3B19E0AEC88F224BB592FAAD09D30740F2376D3D20F2169639
SHA-512:	34049B1AC4254F999C3E5AD8CB31ABF88AC2D972E20E19927F33CC59935354F92125A0342A413E64227E8AE29DDFC2FFE5F67AE538C89D8EBAD7FCA889321DFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novosibirsk) {.. {-9223372036854775808 19900 0 LMT}.. {-1579476700 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {738090000 25200 0 +07}.. {7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Omsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2055
Entropy (8bit):	3.6912374223526396
Encrypted:	false
SSDEEP:	24:5abexPvO1FMnFP1FCnFHnFKqenFdDnFQgOnFxjPnFITnFonFJynFAT4TBThSv0FP:5asvjdqxph01NSvPETKmtTTDO0
MD5:	3E06B20B0B62AA09FA03082FAEE4FD62
SHA1:	8886EC80528ECA13D3364138BFFE92F881768169
SHA-256:	2605CD1E26E4AB48BCB4399BB5B17BAD115A47F87BA3DD54B55BB50C3FE82606
SHA-512:	04C1B6A898D12C8EA1B0B2F6665C870434061C63CC8F7A067BFC708E9828BA2E60104B82E2025E42D51DA2F485890C4D34EC0341EF466A7942649BE64F5EEE17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Omsk) {.. {-9223372036854775808 17610 0 LMT}.. {-1582088010 18000 0 +05}.. {-1247547600 21600 0 +07}.. {354909600 25200 1 +07}.. {370717200 21600 0 +06}.. {386445600 25200 1 +07}.. {402253200 21600 0 +06}.. {417981600 25200 1 +07}.. {433789200 21600 0 +06}.. {449604000 25200 1 +07}.. {465336000 21600 0 +06}.. {481060800 25200 1 +07}.. {496785600 21600 0 +06}.. {512510400 25200 1 +07}.. {528235200 21600 0 +06}.. {543960000 25200 1 +07}.. {559684800 21600 0 +06}.. {575409600 25200 1 +07}.. {591134400 21600 0 +06}.. {606859200 25200 1 +07}.. {622584000 21600 0 +06}.. {638308800 25200 1 +07}.. {654638400 21600 0 +06}.. {670363200 18000 0 +06}.. {670366800 21600 1 +06}.. {686091600 18000 0 +05}.. {695768400 21600 0 +07}.. {701812800 25200 1 +07}.. {717537600 21600 0 +06}.. {733262400 25200 1 +07}.. {748987200 21600 0 +06}.. {76471200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Oral

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	3.708603813141953
Encrypted:	false
SSDEEP:	48:53PvalvNhQQvmRKqv0fvzQIovWdvEGvDaDv7w9hYwr:JHaBNKs6b03zB0WJEuDa77w9hYA
MD5:	A3BD0C15642AE4F001F98F8E060E8374
SHA1:	366F3C7FD4000AC23B79AB0FF4429371ED323B81
SHA-256:	933BBCD7AE0BF59A5B4A6E0EF74C237FEEDC42E6A3AEB2158131AA70FBA6FE47
SHA-512:	16D8692D3EA96D3594E6220A6989BBFBB926A66EEBEB240C4DC68BE75C69C5206659D9D341D92AE6128928FD38A5F45B445621CBBBA4E4BA8C34C3AC52BF3C08
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Oral) {.. {-9223372036854775808 12324 0 LMT}.. {-1441164324 10800 0 +03}.. {-1247540400 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {701816400 14400 0 +04}.. {701820000 18000 1 +04}.. {717544800 14400 0 +04}.. {733269600 18000 1 +04}.. {74899440

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Phnom_Penh

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.958543249401788
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKeHKLNM0WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKTNg
MD5:	EBF01E229CC41EB8B27650A3D668EDC1
SHA1:	33E1B252C1B45EAE326FCF8CC7C80C78A46F7E8D
SHA-256:	DCEE88876D00396918F43DECA421B6C9B02F84B5866A2CE16E641B814B390A9F
SHA-512:	80840600F37A256B8FD9933760FBAE7C13DE1E24EFD970E47BE8DEC731DFABF6D6FB76999BEEC775FF8C8B8719E94788ED7EEB04376A34C827ACB443F720F7E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Pontianak

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.492596995768464
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKT5PDm2OHUeoH99xV/1kc5k/MVSSFFCLkvScH+dMVSSFL1CnF4mMz:MB862L5bmdHFCRV/6c5kMxGLkHHaMxFn
MD5:	9ADB1A9E41A143A06116E24EA0A53D90
SHA1:	6E50B549E1A705C0090BD5EDE26F7DED78CDF71A
SHA-256:	AC8370AEDF5FE3FE1E80710CE117DEE23815BE377D418E4B4F3259A1930E8DBF
SHA-512:	92790B20B960AC518AB2E18F902C6E0BA887F268909F5571CAC1068F5E719CCF6943AE6902DA1B683E170658B5E7BE06C6A187C1C0A652DD052D5BD0B2A7B84D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pontianak) {.. {-9223372036854775808 26240 0 LMT}.. {-1946186240 26240 0 PMT}.. {-1172906240 27000 0 +0730}.. {-881220600 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 28800 0 WITA}.. {567964800 25200 0 WIB}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Pyongyang

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.709411633376997
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wK8cE4SDm2OHnNoH9Aw8vmVuT0vjLtcjviov:MB8620cExmdHnNCGv2Ezv
MD5:	727BBC1A1662B500F616F544A484F213
SHA1:	93C1D902D9D4AA4197C7D16C61FB784AC01D0DE5
SHA-256:	29BA17F756F5C0BBA30FEBF44E620504D04921C832BD1CB56E1B60EF288B57DF
SHA-512:	C3C91E2F180109FF33E6491722F679A1B8DCE8CD31DE006D7FF2CBE270C008E927507C953641D28EE77D139BBEA54DEA1B7DBD6C30B208DDAB1B58756C32AC02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pyongyang) {.. {-9223372036854775808 30180 0 LMT}.. {-1948782180 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-768646800 32400 0 KST}.. {1439564400 30600 0 KST}.. {1525446000 32400 0 KST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Qatar

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.851251407399968
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKK3ovXMXGm2OHPFV4YoHsQKb3VvVsRYovFFF3FRVGsWr:SlSWB9eg/2wKK3yXDm2OHoYoHxcvSNFS
MD5:	CBA9635133F88AD3B27E23B95430C27C
SHA1:	5E41232EC03BBC71B522F58CB2D05E6BFFFF1A75
SHA-256:	18CCA69F933795CE3F7DB31506EFC063E6CE1DFDCAB32AA387C398456D7F7E1F
SHA-512:	D7C43F1F9ADA54C914ADB3CB2C9063EB7044089CFC7755ACFD08828CDEBA3C116AE2BE916ABE5D561E63699B921BC52636DD0BBC2C4304F813616D320D7DDAAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qatar) {.. {-9223372036854775808 12368 0 LMT}.. {-1577935568 14400 0 +04}.. {76190400 10800 0 +03}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Qostanay

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	3.7299735983334195
Encrypted:	false
SSDEEP:	48:5DwvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQA:BMaBNKs6b03zB0WJEuDa7sFZiKWaN6TE
MD5:	F5DBE4E72FA5AB0019CC98C8E21EC86E
SHA1:	27ECB901AA07C18EA7F38235E8EFE0B1635FEFBC
SHA-256:	4191629B874C988291E8FD13E675A3ED685D677F6541313975FC4610E47F1DCD
SHA-512:	D5EFD4EFFFFE2E41909AEB7B67BD1FA6FAF4B8E9AC645518D5B33BD1B3C5084F59D47D4ED052E0D4B9F9989BDDBA3AECB3D1E67F5237914D24C01F9C95242396
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qostanay) {.. {-9223372036854775808 15268 0 LMT}.. {-1441167268 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {7489

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Qyzylorda

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	3.734572151642808
Encrypted:	false
SSDEEP:	48:5NvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWgvNSvTqvIQvyovklvqQX0:TaBNKs6b03zB0WJEuDa7sFZiKWcN6Tir
MD5:	026EC6E479EC006C4398288362254680
SHA1:	24AD03DD21DA394B3423D27211955BFD694F8E73
SHA-256:	CD6B067AA3EF6935B4E89CA36E6A03FCB97F1E0EE61A7B5D46C06BF4DE140774
SHA-512:	023AC55E118F13A31CE996C7BA155C90D47DEB6C223EEB3C0EE7B702871FF0CCA13CDF61D65FDDABE41B888CD7A74274AA5730059CC5688F8ED4DDBF8FE4ECA4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qyzylorda) {.. {-9223372036854775808 15712 0 LMT}.. {-1441167712 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {701812800 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Rangoon

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.812955128020714
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8nv3vXHAIgNnDA6RL/2WFK02KQMFfh4WFKsyn:SlSWB9vsM3yHvPHAIg15N/2wK0GEJ4wy
MD5:	BD3F294F1EDDD21467E980C9F5A0E7DE
SHA1:	11A3FC3E4489C18BDF9BFFB4C44615559D9DD99D
SHA-256:	E4D2C38D8E7377A528291A88129CDAC40CA4D40A5F1CD8ADB98228527556906E
SHA-512:	FA5FD600627793EABB83C1066BE246A47BCCE1FC57830596B9C0CDE8901B949AF178ABDE876C3B73CC3751312E8A4C03C390888B0B5A9669F511344143F83073
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Yangon)]} {.. LoadTimeZoneFile Asia/Yangon..}..set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Riyadh

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.973311159904374
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFK814PMXGm2OHFukeoHqUi9VssWYcv:SlSWB9eg/2wK81GDm2OHF7eoHvi9V1Wr
MD5:	AD3236CFF141732831732357AB181EE3
SHA1:	EAF51A63898A2048EA5FBE9BA4C001EEE37FFDB2
SHA-256:	411E31D09FFA48E44169C42661AE2F7FC142460BCAA216837D8C4740983CA7BD
SHA-512:	6CA2D89C02568580786BE98A863453ADCF4D21CAC52E5B44C4F7A05E76D29AEB3E28E353D6FB758BB553DBC8F35389462B388F61E94C68F5DB50A3E8C429336D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Riyadh) {.. {-9223372036854775808 11212 0 LMT}.. {-719636812 10800 0 +03}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Saigon

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.946090704619887
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8I65eV5XHAIgN2h6560ARL/2WFKwJ6h4WFK365ey:SlSWB9vsM3yJAVJHAIgA4k0AN/2wKl4i
MD5:	0766480A295525EE5D65F1ED32094858
SHA1:	7A2D68E1009DDD809A4A700931456C617DCD343A
SHA-256:	C695981A0DF691C3F4509999FBC52858ADC75024CCCBDEFBE1094FED17E809E4
SHA-512:	A21536FB61A64E953E8D6414FF0AEF1BC7E68A33C5DCF7090517A91FC449B96A93A4FBDF2C00682540D1193FDB29603349F5BDB455FD90045FDBCA61247A9860
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ho_Chi_Minh)]} {.. LoadTimeZoneFile Asia/Ho_Chi_Minh..}..set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Sakhalin

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2117
Entropy (8bit):	3.7276904131666577
Encrypted:	false
SSDEEP:	48:5q+3Vv+0j6lua2Gg/3gO8UoflcXRDhUBAc+:YxIa2GOT8tiXBC6c+
MD5:	295D51B8FBBE890C97637687B8F32322
SHA1:	7BB72B0EC783898DDF625D275E3BBB964D1693FB
SHA-256:	D7D0EA5CEF908442AB0D777A4B097BED18540CD5280FF63F33DD989E27E72908
SHA-512:	9B3E3BA01EAE38A00B0EE8A8FB17191CB4ED2EE9E46AE06403BA8C1193804764C86599840DC03E0C6A631456E1BE2BC560BDF6CF0450068EF78A6E494041326C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Sakhalin) {.. {-9223372036854775808 34248 0 LMT}.. {-2031039048 32400 0 +09}.. {-768560400 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Samarkand

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	879
Entropy (8bit):	3.9460497720710506
Encrypted:	false
SSDEEP:	24:5t8eZd7QvalvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKT10Sv6r:5MvalvNhQQvmRKqv0fvzQIovWdvEGvDO
MD5:	10A758996B0DF756E520541BEA9B7D75
SHA1:	137E5FD4E00CFA4B3939EF11868862B7F93D87CD
SHA-256:	35E4B905723891281D9A6A0A1FD3760A3A48136E1419C686BE31ACE83BF7AA9D
SHA-512:	7E32661731EAB2ED8C387533ACCB4853F5B6225BAC11E93247E7B06D7AA856E6A665F63718BFE395CFD00F80A4C16789D7097FFA8DAD88B1D707BF9C155C1D4C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Samarkand) {.. {-9223372036854775808 16073 0 LMT}.. {-1441168073 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Seoul

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	985
Entropy (8bit):	4.121802167517286
Encrypted:	false
SSDEEP:	24:5AemgvHzF+zg2c+z3NGmJhIUfqII8yHg/zoD:5F/nfWUBISHg/G
MD5:	A1DE6975DEA70D7241B5B3C43E1EA3AA
SHA1:	35EE563A2BCA77C761F7E878997763EA8D258040
SHA-256:	C4F82C94650572FE4D03BC1FE54CED8F4BF55DFBEE855D52DE3EA6378240AF93
SHA-512:	1639B0609115DBEA6A381986A732A5CA1523952AEF84843B4D714D5B2FF40B16C4166D8D60D31D4FC2C2BA34DED1F6DB39474336195603562265BDBF71687696
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Seoul) {.. {-9223372036854775808 30472 0 LMT}.. {-1948782472 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-767350800 32400 0 KST}.. {-681210000 36000 1 KDT}.. {-672228000 32400 0 KST}.. {-654771600 36000 1 KDT}.. {-640864800 32400 0 KST}.. {-623408400 36000 1 KDT}.. {-609415200 32400 0 KST}.. {-588848400 36000 1 KDT}.. {-577965600 32400 0 KST}.. {-498128400 30600 0 KST}.. {-462702600 34200 1 KDT}.. {-451733400 30600 0 KST}.. {-429784200 34200 1 KDT}.. {-418296600 30600 0 KST}.. {-399544200 34200 1 KDT}.. {-387451800 30600 0 KST}.. {-368094600 34200 1 KDT}.. {-356002200 30600 0 KST}.. {-336645000 34200 1 KDT}.. {-324552600 30600 0 KST}.. {-305195400 34200 1 KDT}.. {-293103000 30600 0 KST}.. {-264933000 32400 0 KST}.. {547578000 36000 1 KDT}.. {560883600 32400 0 KST}.. {579027600 36000 1 KDT}.. {592333200 32400 0 KST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Shanghai

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	981
Entropy (8bit):	4.16042656890735
Encrypted:	false
SSDEEP:	24:5Te3vvZJzHjwH6kHp7FH32AzHjZBHNHlQHuHxmHUjH6zHj2HBHeC:5ovZZO7lLpT24
MD5:	A266AA43A84FD5E4890BC77AA4E240D0
SHA1:	CD88C5D451CD7D3F50C9B36FDD47C84D20377441
SHA-256:	3AABB42D9EFE95D906B7F34640E7815919A1A20979EBB6EC1527FCAA3B09B22A
SHA-512:	13AE48F58C9AF24002F0FE4F28BF96B10EE0ED293E0DE9D29BCEBAAE102B2EA818F42CA4069544A254C95444A48604EC57E6AB2BEBDA4B5E72C82B49E61AD0A0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Shanghai) {.. {-9223372036854775808 29143 0 LMT}.. {-2177481943 28800 0 CST}.. {-1600675200 32400 1 CDT}.. {-1585904400 28800 0 CST}.. {-933667200 32400 1 CDT}.. {-922093200 28800 0 CST}.. {-908870400 32400 1 CDT}.. {-888829200 28800 0 CST}.. {-881049600 32400 1 CDT}.. {-767869200 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-650016000 28800 0 CST}.. {515527200 32400 1 CDT}.. {527014800 28800 0 CST}.. {545162400 32400 1 CDT}.. {558464400 28800 0 CST}.. {577216800 32400 1 CDT}.. {589914000 28800 0 CST}.. {608666400 32400 1 CDT}.. {621968400 28800 0 CST}.. {640116000 32400 1 CDT}.. {653418000 28800 0 CST}.. {671565600 32400 1 CDT}.. {684867600 28800 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Singapore

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.436676898144829
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKfbSDm2OHxdoHvm5vWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScHS:MB862nbGmdHDCvsvDTMsF/CFDMx/HHbe
MD5:	C3D13D921E4C6E475910E5080B761C32
SHA1:	8C5AE73C4098D03908E5D567FD7C4D827601D718
SHA-256:	05C76B58A4E356FD358E24FBC71FAE98DCB18C441C8D8CBB13A18D4F6E406062
SHA-512:	3A620597469D31577ECAAA098C95C244F0C288ABACE9E8964D8641154C1893967EFBD7211A41751D0D4CC1B0B9A2286F11738EFB7D01F110A4826BBE1844A2EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Singapore) {.. {-9223372036854775808 24925 0 LMT}.. {-2177477725 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Srednekolymsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	3.7913177223006698
Encrypted:	false
SSDEEP:	24:5HJeidmbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxwy:5HSv+0j6lua2Gg/3gO8UoOZU2Wc/pKf
MD5:	B4FA38E884A85F6BD47C8BB02BB0500C
SHA1:	1DD135B79CC0D81C048D7B2C6BE0CF71171DD19E
SHA-256:	705D6D8360C2DCD51E909E39E1910FE876145220D151031612DA36B247207395
SHA-512:	2D32AAAF1BCC865B5F2810BFE0FB82BE98140BB5F2ECA1DA7FD148A3074DA127B81242F17B8BA9C9E259B61CBB123FD1513CCE6A85C8D7679ADFC0D689B552BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Srednekolymsk) {.. {-9223372036854775808 36892 0 LMT}.. {-1441188892 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Taipei

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	4.062084847879695
Encrypted:	false
SSDEEP:	24:5X2eIvZPzGzHjZBHNHlQHKn3HnHNd9HiHkHBHaHLHMtyH9Qm+zHFOzHZ32HZvHiR:5Xi1ypBvt1mwO3Kq46T
MD5:	AECA800C8F2A679D0B19E5BB90AFD858
SHA1:	2C7DCEB709F9A4312C511971FE1E6A9DC1FBD0E8
SHA-256:	389C9D3EE2970665D0D8C5CB61B8B790C5FBDDC0DF0BF2B9753046F5953A477F
SHA-512:	C2D6BB4FEB5848D0704647D26F94C0BD8CD7E834AA2187EC9C877E80157E9CC225BBA3BECEE0148894C8639105D292AB50EE95830992BF357C632ACF001E020F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Taipei) {.. {-9223372036854775808 29160 0 LMT}.. {-2335248360 28800 0 CST}.. {-1017820800 32400 0 JST}.. {-766224000 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-639133200 28800 0 CST}.. {-620812800 32400 1 CDT}.. {-607597200 28800 0 CST}.. {-589276800 32400 1 CDT}.. {-576061200 28800 0 CST}.. {-562924800 32400 1 CDT}.. {-541760400 28800 0 CST}.. {-528710400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-497174400 32400 1 CDT}.. {-478688400 28800 0 CST}.. {-465638400 32400 1 CDT}.. {-449830800 28800 0 CST}.. {-434016000 32400 1 CDT}.. {-418208400 28800 0 CST}.. {-402480000 32400 1 CDT}.. {-386672400 28800 0 CST}.. {-370944000 32400 1 CDT}.. {-355136400 28800 0 CST}.. {-3394080

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Tashkent

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	878
Entropy (8bit):	3.9280321712564845
Encrypted:	false
SSDEEP:	24:5geQqdNRvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10Sv6r:5+EvdJqxiF0rvK50Sv6r
MD5:	DB59DB8E401E12917B7367D5604D3DE6
SHA1:	7CC7C5C1DB551BD381B833C81746201D36BC59A9
SHA-256:	4445F3F892C7267A6867009CC1A3F0B0548D0240408375A9D15360B28993C2A9
SHA-512:	2C7AE63C408A9F06F973AAC16845E1DBE92D15A421BBBE420914F21155AD5E57CD058D7E4427E43185E023D2FF475EBF9D74003ECEF004FF4E5F9D5681ADFB80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tashkent) {.. {-9223372036854775808 16631 0 LMT}.. {-1441168631 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Tbilisi

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	3.6815162494646034
Encrypted:	false
SSDEEP:	24:5yBeqvIdZlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPqUsx9Ul4N:5MmsUf8mFpNWFnytO6VnYK
MD5:	C376C9ED66F6CC011E063D3E8E0DCED1
SHA1:	13C6345F8CB0EC79FE7C78B156C5737BCB66E49E
SHA-256:	B637BB0E49144C717E99E93540CB2C4D3695D63B91FE42547F2F0AA006498693
SHA-512:	FD60192CBEDC91C5D6B3B5E6F19DEDCAE14DCF48DCAE6D4865A8F0BBDC01CBF8DAAE92C4C46C353AF5B3EEE36CCC87B23F193DDF221132F5404C42507B708364
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tbilisi) {.. {-9223372036854775808 10751 0 LMT}.. {-2840151551 10751 0 TBMT}.. {-1441162751 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {694213200 10800 0 +03}.. {701816400 14400 1 +03}.. {717537600 10800 0 +03}.. {733266000 14400 1 +03}.. {748

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Tehran

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7250
Entropy (8bit):	3.5278500339429972
Encrypted:	false
SSDEEP:	96:z73zxgC3kvOR0xV1oLp9ZUj8nZjcJ5NIOFVp7ufbIL74f6IQTExJQtcAL:vryO2H1oLp9aQZyDmIVEPW
MD5:	359B270670A5FF61BBCE3D07F1BAA5AB
SHA1:	5B6D01C931D31D92299EE4455F76E69EB0C25A96
SHA-256:	A78655218A749F4ABCA436BE818E84D3277220FF3E69BE20A786AADF8AC744F9
SHA-512:	DFB0C7452AF6124A3742042CD97E7B9C0A84A4E338E00AF6DD66C971BC4D1324D3947A3A8601778F026E50367D942C10513FA1D73742E7006E91BF35E90260BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tehran) {.. {-9223372036854775808 12344 0 LMT}.. {-1704165944 12344 0 TMT}.. {-757394744 12600 0 +0330}.. {247177800 14400 0 +04}.. {259272000 18000 1 +04}.. {277758000 14400 0 +04}.. {283982400 12600 0 +0330}.. {290809800 16200 1 +0330}.. {306531000 12600 0 +0330}.. {322432200 16200 1 +0330}.. {338499000 12600 0 +0330}.. {673216200 16200 1 +0330}.. {685481400 12600 0 +0330}.. {701209800 16200 1 +0330}.. {717103800 12600 0 +0330}.. {732745800 16200 1 +0330}.. {748639800 12600 0 +0330}.. {764281800 16200 1 +0330}.. {780175800 12600 0 +0330}.. {795817800 16200 1 +0330}.. {811711800 12600 0 +0330}.. {827353800 16200 1 +0330}.. {843247800 12600 0 +0330}.. {858976200 16200 1 +0330}.. {874870200 12600 0 +0330}.. {890512200 16200 1 +0330}.. {906406200 12600 0 +0330}.. {922048200 16200 1 +0330}.. {937942200 12600 0 +0330}.. {953584200 16200 1

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Tel_Aviv

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.876713308636272
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/2WFK+TT52WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/2wKsswKR
MD5:	40B15013485EE2138A3DCB915F9121E7
SHA1:	3ADBE38686C7CA1FDE3DDD12BE908F39BFD1E228
SHA-256:	07537A30E6236D9E334DAFD5C4D352D25FDEF95D6DC7496F5D93EFAB74D9EBB1
SHA-512:	DA3B7B44B3BEF07CA8AA5253BF684A838181D8A15D7CCF0447A6B5F5BAE28D155CF65BCFB6286EB36C0B9F4FDD1FE862A3297ADB6FC33532B9F766334283D725
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Thimbu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.906503135441824
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8kNZ4WXHAIgNqFNKARL/2WFK9Z752WFKvNZovn:SlSWB9vsM3ykZ42HAIgc3KAN/2wKf126
MD5:	081862B6FB33389BEC9B0E6B500AA342
SHA1:	AF9467BB87C4C28921DF62A87B81223052F9FF4A
SHA-256:	37459C17B59639DF62B3F3943751902CE6AAF1F11B7630069DB45052EBEFB5B9
SHA-512:	CAF6F1C928528C4471229A2EF2944623545626532986628E6CE38884535286A0B38BA88C1A295E8B11322475D6BFAC61BF89786A76330C1A0C729339A3532BAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Thimphu)]} {.. LoadTimeZoneFile Asia/Thimphu..}..set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Thimphu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.887493603495978
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKvNZJMXGm2OHEQUTFnoHqVaJKuc/v6Q61V9gmZVFSTVV:SlSWB9eg/2wKVZJDm2OHEfnoHDKuc/SC
MD5:	F239452984CCA9F23E97A880652C39E6
SHA1:	52D25282D03B79960F152D21E7492EE26DAEBBAA
SHA-256:	B797C74E3840298C3CD8149FC8AA4BCE839EFE79E7C3310986FF23C965607929
SHA-512:	1044BEDAE04FCA7BD62937AFCE70F6C447583A90DD1596C3029A64A8251E3F73C106F4D940548DD38E895D67FEFDCD196B257E11437DEB399085EE80C345AA50
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Thimphu) {.. {-9223372036854775808 21516 0 LMT}.. {-706341516 19800 0 +0530}.. {560025000 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Tokyo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.470556147950505
Encrypted:	false
SSDEEP:	12:MB862ymdHOx5CvAoK3zoiIxtoFDIe+zT0agbov:5yeOCvARzzCOVa/gby
MD5:	3CCC15B63A882DB1B7459A51CD1C8165
SHA1:	77A3EFE6E4EE524B9EC6F51593DD7521FD7B8DAD
SHA-256:	3DA522FA88541A375D53F30A0B62DC4A305FA0315FEE534B7998C9E0A239450A
SHA-512:	15238E96DABAB5D2B9FFD25B3F50417ED32205FA69239D6F6B28DA97A378D669FD409164964D0DD2A5B1D795C8F60E8D4EB15924046348C3D6010646A536E07C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tokyo) {.. {-9223372036854775808 33539 0 LMT}.. {-2587712400 32400 0 JST}.. {-683802000 36000 1 JDT}.. {-672310800 32400 0 JST}.. {-654771600 36000 1 JDT}.. {-640861200 32400 0 JST}.. {-620298000 36000 1 JDT}.. {-609411600 32400 0 JST}.. {-588848400 36000 1 JDT}.. {-577962000 32400 0 JST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Tomsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	3.695316005718174
Encrypted:	false
SSDEEP:	24:5CeLz/XJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEno:5H040yVRB7VfXucydm4IqtTTDOS
MD5:	E95DE93CBCE72C5E02D7ECFE94C96308
SHA1:	59A49EBFE544D97545BADFEFE716BB5659C64C20
SHA-256:	6B64A01D0F0B5EC7A1410C3BD6883BA7CC133E9F073D40E8BFECE037E3A3FA24
SHA-512:	9E33DC9C1C6D60F3226263C484AF46A14AAB31F838516A0D69BA08F8F416EF10D09697E8D7ABAC1CE1F5BCE8AB0C2635D99FBE70C89ECC268DED0DCE89E67466
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tomsk) {.. {-9223372036854775808 20391 0 LMT}.. {-1578807591 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7647084

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ujung_Pandang

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.897140749162557
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8pYFfXHAIgNzGRRL/2WFKPQOrFJ4WFKov:SlSWB9vsM3yWFPHAIg0RN/2wKPQOrFJD
MD5:	F6AE33D706C36FDD8A21F44AD59F5607
SHA1:	94D6EC7A437249AEBE2FA4AF8AFB029A620368C0
SHA-256:	732751845ACEDBFFD3C6170F4B94CB20B25BFDCFCC5EEA19F4BE439F5C5B573A
SHA-512:	2314AB2B154887842211C9A570BC1323D9B4375FF60C96296835DB001E8A277CA62D40B8562BC34EDDF281D96D5325640B79F7907558C6E0319C7D2A76BE239C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Makassar)]} {.. LoadTimeZoneFile Asia/Makassar..}..set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ulaanbaatar

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	3.7728141273024374
Encrypted:	false
SSDEEP:	24:5IerIvusF7cCGK6zoCjZte3kzMjsBw0oZzlL98oysHqGzJvqE+ksabzdX+YjL:5VujmUCei46oljFC67
MD5:	A4647294401D2B54ABAA8E509BF05A6F
SHA1:	BF804CC38996D7715E3BA9BAD715D7ADBED781B9
SHA-256:	A56A26981163A717CF388A423CFE7A2BAD1BE8652BE2E338670CBC0C0A70E5E9
SHA-512:	B43157FABDE016FA6636CAB7B06CC1DEA53526B42FB46BB41DC4B7E48188D191C325BEF0D170B125E885F321C4316746A8D478D798828E2DC4A51C71DA4A610C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ulaanbaatar) {.. {-9223372036854775808 25652 0 LMT}.. {-2032931252 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 32400 1 +08}.. {433782000 28800 0 +08}.. {449596800 32400 1 +08}.. {465318000 28800 0 +08}.. {481046400 32400 1 +08}.. {496767600 28800 0 +08}.. {512496000 32400 1 +08}.. {528217200 28800 0 +08}.. {543945600 32400 1 +08}.. {559666800 28800 0 +08}.. {575395200 32400 1 +08}.. {591116400 28800 0 +08}.. {606844800 32400 1 +08}.. {622566000 28800 0 +08}.. {638294400 32400 1 +08}.. {654620400 28800 0 +08}.. {670348800 32400 1 +08}.. {686070000 28800 0 +08}.. {701798400 32400 1 +08}.. {717519600 28800 0 +08}.. {733248000 32400 1 +08}.. {748969200 28800 0 +08}.. {764697600 32400 1 +08}.. {780418800 28800 0 +08}.. {796147200 32400 1 +08}.. {811868400 28800 0 +08}.. {828201600 32400 1 +08}.. {843922800 28800 0 +08}.. {859

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ulan_Bator

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.728285544456033
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8TcXkXHAIgNrfcXORL/2WFKhrMEBQWFKucXB:SlSWB9vsM3yXHAIgTN/2wKhrMEewKX
MD5:	D2EAEA6182FB332CAA707B523F6C8A9D
SHA1:	3BFC654E2B3BCF902AF41AEEC46772C84FFF3890
SHA-256:	D17FDAF17B3DAC3A1310E2332F61585598185E64CED799ABD68249EB5B698591
SHA-512:	E16BEE28BFE3AFFFE6F0025C09D0D65001F38D5045AAB1B554E4D3A66A88273F985B7BAA11F8D26E76E5ABC9F559E3E4B794CC939AAD5FF012A5A47924D08CB3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ulaanbaatar)]} {.. LoadTimeZoneFile Asia/Ulaanbaatar..}..set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Urumqi

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.006390440264841
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKjhfMXGm2OHEVPoHsWA0GVFSTVVn:SlSWB9eg/2wKjJDm2OHEVPoH3A0CUX
MD5:	D6245CAAEC9BA2579F4CEFFF196A9369
SHA1:	4D182953F2CEEFF3583265F977B14F40C1A2FB43
SHA-256:	C445B8030DEDDDED0AFF5CC692CC323B63BE8C14BBD42DC3FDE90AD4F9D14785
SHA-512:	A32C477B6FAA79247907D1C4E2DF400B05AF4B529277C4CE12B33097872311E3F579115DC8CBA93DAC936928FD574414F3473A9CB7C8E85AB57CCA57489B60F8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Urumqi) {.. {-9223372036854775808 21020 0 LMT}.. {-1325483420 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Ust-Nera

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	3.773734429231407
Encrypted:	false
SSDEEP:	24:5petrlfgLv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxKG:5Ysv+0j6lua2Gg/3gO8UoOZU2Wc/pKF
MD5:	5ADD78E4AFCBA913D078A8790861A2DE
SHA1:	BB63A762D5D76C0FD3CB9AB2BCDE95718E1C99EB
SHA-256:	9D639C0FC69B3BEEBC96969092F9590EB48E7946E901B225BF245E165973B9A8
SHA-512:	7C2418FD1F96F101B83E2ABDF2551405C6E429DBBF30A2FA7CD2477E2CE1CEEBB790C51B28AEFF043BA7A7A914CEF3C812668058D69225B9FE9475C56508453D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ust-Nera) {.. {-9223372036854775808 34374 0 LMT}.. {-1579426374 28800 0 +08}.. {354898800 43200 0 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {764694000 43200 1 +12}.. {780418

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Vientiane

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.858039387006872
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKgTjEHp4WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKgsX
MD5:	D23A09C84A5368FBB47174BC0A460D14
SHA1:	045A72FEA79C75E5F0029BD110E33A022C57DFAB
SHA-256:	18F5E4FE8247F676278AC5F1912AC401DC48DF5B756D22E76FF1CFA702F88DA7
SHA-512:	404EABC2FC162E18C678CED063249C7FF4C28653880EA1903CE846FD191CD1C5B61E0610736F250B79BBAC768B1AFD6B9A8824D56D74591A95D7301B47D48387
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Vladivostok

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	3.7094518963173035
Encrypted:	false
SSDEEP:	24:56beOUYQ7FyDy3le3i96VwAmnuBNuTw6vl9O8nfipRkwhUZDAcD:56cYQBIy343dVNUIukElcXRDhUBAcD
MD5:	5C0C094B088D0212182E7B944197D4FE
SHA1:	CF43A511FE9CD295207DF350704462E09D4D5278
SHA-256:	2558C96E25359C72F168DAC6FB3C16C54F8FD7D0724EEB1671156D4A1F42AC6C
SHA-512:	5D659EBDC8C2B06C964B083ECC78B4370A4658590D83F020CD23910C44E2D8DAFE69F61E8EB569E1905E89F38CD03ABE6B92F6CE36CF0B1EE0732A7645AFA65D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Vladivostok) {.. {-9223372036854775808 31651 0 LMT}.. {-1487321251 32400 0 +09}.. {-1247562000 36000 0 +11}.. {354895200 39600 1 +11}.. {370702800 36000 0 +10}.. {386431200 39600 1 +11}.. {402238800 36000 0 +10}.. {417967200 39600 1 +11}.. {433774800 36000 0 +10}.. {449589600 39600 1 +11}.. {465321600 36000 0 +10}.. {481046400 39600 1 +11}.. {496771200 36000 0 +10}.. {512496000 39600 1 +11}.. {528220800 36000 0 +10}.. {543945600 39600 1 +11}.. {559670400 36000 0 +10}.. {575395200 39600 1 +11}.. {591120000 36000 0 +10}.. {606844800 39600 1 +11}.. {622569600 36000 0 +10}.. {638294400 39600 1 +11}.. {654624000 36000 0 +10}.. {670348800 32400 0 +10}.. {670352400 36000 1 +10}.. {686077200 32400 0 +09}.. {695754000 36000 0 +11}.. {701798400 39600 1 +11}.. {717523200 36000 0 +10}.. {733248000 39600 1 +11}.. {748972800 36000 0 +10}.. {7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Yakutsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	3.7081033128260934
Encrypted:	false
SSDEEP:	48:5h+r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2j:K5PhtjLiII2ZFlgm
MD5:	E43E5F0EA7C4575525BAB130984DCDCC
SHA1:	2D715749469FEA51A8E25D1F4F8DC4FF9178817D
SHA-256:	3BEF13638C46F16435D326C675907E61BB68C8173153CED3359E983BE0E413E5
SHA-512:	27954FEC865031BC363CFDE94E97B3B19836A6F777646EA4AAB12ECCAEE6D60A0C690711EA192B917AC717F94A01D1EF64BAE97DF968069CC12415971B070498
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yakutsk) {.. {-9223372036854775808 31138 0 LMT}.. {-1579423138 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {76470

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Yangon

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.692243303623333
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKs5XDm2OHGVQoHvZN6FCDx+UIFDVkvScHbY/s5UIAy:MB862KTmdHGuCvZNNkkHH3Sy
MD5:	D45766D30074719C9A88ACE8BB53204B
SHA1:	69B333DFCCCCEB66DD0F7DC28B272BB10769B6B0
SHA-256:	2526557810747E78E713AE09BC305621A80FAEECF8D441632E7825738D4C79CB
SHA-512:	5255DEED72D7D13862A4D6BED7E0458C099D2EF5A1B41536CAA7C0E65A61DE8B8D1AD62AD44559F970B6613ADFB3862778D1CC99B9A05CB5BBCA7F0202B5A5B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yangon) {.. {-9223372036854775808 23087 0 LMT}.. {-2840163887 23087 0 RMT}.. {-1577946287 23400 0 +0630}.. {-873268200 32400 0 +09}.. {-778410000 23400 0 +0630}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Yekaterinburg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	3.704641905144701
Encrypted:	false
SSDEEP:	48:5ievNhYvm1qv7vXIovPvSvlDvtvuovKKvKcNvHvAvivBvqvvEyv8vlvEv+v4v+v+:/Nupj40H6l75FKCKcZP8qdyEaoBAWkW+
MD5:	D4DABA407BB8A10E4961D1DE5D9781D1
SHA1:	6933DE65336331BD90E2BEC6AEA0609B16DAEDC9
SHA-256:	2C78699EFC60758B8F8D0D1DEEDFDED5E65C65EBF3082B23E60BDEA8BF8FBCFE
SHA-512:	459E2187FAA66414F5CE934C335F563DFD2FA5316B86A54D1A29123A0460AFD65B7CE46629BD6A070A14CB6873A28A2F2803DE5FF4F29EA610712EB07FAD303F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yekaterinburg) {.. {-9223372036854775808 14553 0 LMT}.. {-1688270553 13505 0 PMT}.. {-1592610305 14400 0 +04}.. {-1247544000 18000 0 +06}.. {354913200 21600 1 +06}.. {370720800 18000 0 +05}.. {386449200 21600 1 +06}.. {402256800 18000 0 +05}.. {417985200 21600 1 +06}.. {433792800 18000 0 +05}.. {449607600 21600 1 +06}.. {465339600 18000 0 +05}.. {481064400 21600 1 +06}.. {496789200 18000 0 +05}.. {512514000 21600 1 +06}.. {528238800 18000 0 +05}.. {543963600 21600 1 +06}.. {559688400 18000 0 +05}.. {575413200 21600 1 +06}.. {591138000 18000 0 +05}.. {606862800 21600 1 +06}.. {622587600 18000 0 +05}.. {638312400 21600 1 +06}.. {654642000 18000 0 +05}.. {670366800 14400 0 +05}.. {670370400 18000 1 +05}.. {686095200 14400 0 +04}.. {695772000 18000 0 +06}.. {701816400 21600 1 +06}.. {717541200 18000 0 +05}.. {733266000 21600 1 +06}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Asia\Yerevan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2029
Entropy (8bit):	3.6487650030366106
Encrypted:	false
SSDEEP:	24:5O4GeuadYlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUUUl2ue/:5xKdsUf8mFpNWFnyLCPYmPJSi3sh4
MD5:	2CFA7C55D0731D24679CA5D5DC716381
SHA1:	2BB66783D75C71E76409365757980FBC15F53231
SHA-256:	20871FA6AA959DDFB73D846271B4A568627B564CFC08A11BDD84B98C2F2019A3
SHA-512:	CAB10A48859B2C0B2CC7C56E0AA530AE7E506A4986BADC5ED974D124BD46DB328B50C423F83FCFD52D31962A249EEFC10351798B86D51EDA500F412C8D42E6BC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yerevan) {.. {-9223372036854775808 10680 0 LMT}.. {-1441162680 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 10800 0 +03}.. {733273200 14400 1 +03}.. {748998000 10800 0 +03}.. {764722800 14400 1 +03}.. {780447

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Azores

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9879
Entropy (8bit):	3.557602151081988
Encrypted:	false
SSDEEP:	192:K35nZPOUYySoluItljncxelTMwtrayE6x5sETNek/CyNzybxYKmX6SXL/XbEcygI:K940pb6cL/b3Ldr9Q7TMq+ML
MD5:	E7F2A3EE0362E9ED3ECBAD24168AD098
SHA1:	98832274F6D9B641B809123D1272A1C04EEAA177
SHA-256:	6B3609BE4E93D21A2AB492594EDD387931E2C787E8471C9F2D3A677F34002D8F
SHA-512:	C48A76F8251AE455C759CB98802E40B3BEF716FD8E7441B6DE0242942C913367E3572B7C871082E97CA9BE67EC7DC37F8D01C438965217AC0EC36AD508DCE0D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Azores) {.. {-9223372036854775808 -6160 0 LMT}.. {-2713904240 -6872 0 HMT}.. {-1830376800 -7200 0 -02}.. {-1689548400 -3600 1 -01}.. {-1677794400 -7200 0 -02}.. {-1667430000 -3600 1 -01}.. {-1647730800 -7200 0 -02}.. {-1635807600 -3600 1 -01}.. {-1616194800 -7200 0 -02}.. {-1604358000 -3600 1 -01}.. {-1584658800 -7200 0 -02}.. {-1572735600 -3600 1 -01}.. {-1553036400 -7200 0 -02}.. {-1541199600 -3600 1 -01}.. {-1521500400 -7200 0 -02}.. {-1442444400 -3600 1 -01}.. {-1426806000 -7200 0 -02}.. {-1379286000 -3600 1 -01}.. {-1364770800 -7200 0 -02}.. {-1348441200 -3600 1 -01}.. {-1333321200 -7200 0 -02}.. {-1316386800 -3600 1 -01}.. {-1301266800 -7200 0 -02}.. {-1284332400 -3600 1 -01}.. {-1269817200 -7200 0 -02}.. {-1221433200 -3600 1 -01}.. {-1206918000 -7200 0 -02}.. {-1191193200 -3600 1 -01}.. {-1175468400 -7200 0 -02}.. {-1127689

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Bermuda

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8784
Entropy (8bit):	3.833553120942514
Encrypted:	false
SSDEEP:	192:ZRBHksL3zq6bCvyjvspNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/+:ft0CC
MD5:	B04E22B9B42722013941169B5D04DEA2
SHA1:	32B96A7D9504D5022A6C4E2D310E95B5F062947F
SHA-256:	099C3BEFBA3B4C00AE19BC53D475A52B32FAC9B36EC823C8EAEFC7D00F78F388
SHA-512:	8B93BCA1E923B7A43F2EB0889216E8FF991D13CB8D25BD300310ED7CD8537DBD858E8F422C9B52AE2F52F7C1CB450EF0B7C5C1B3AE547C9C1E18E2A851569DD5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Bermuda) {.. {-9223372036854775808 -15558 0 LMT}.. {-2524506042 -15558 0 BMT}.. {-1664307642 -11958 1 BMT}.. {-1648932042 -15558 0 BMT}.. {-1632080442 -11958 1 BMT}.. {-1618692042 -15558 0 BST}.. {-1262281242 -14400 0 AT}.. {-882727200 -10800 1 ADT}.. {-858538800 -14400 0 AST}.. {-845229600 -10800 1 ADT}.. {-825879600 -14400 0 AST}.. {-814384800 -10800 1 ADT}.. {-793825200 -14400 0 AST}.. {-782935200 -10800 1 ADT}.. {-762375600 -14400 0 AST}.. {-713988000 -10800 1 ADT}.. {-703710000 -14400 0 AST}.. {-681933600 -10800 1 ADT}.. {-672865200 -14400 0 AST}.. {-650484000 -10800 1 ADT}.. {-641415600 -14400 0 AST}.. {-618429600 -10800 1 ADT}.. {-609966000 -14400 0 AST}.. {-586980000 -10800 1 ADT}.. {-578516400 -14400 0 AST}.. {-555530400 -10800 1 ADT}.. {-546462000 -14400 0 AST}.. {-429127200 -10800 1 ADT}.. {-415825200 -14400 0 AST}.. {1

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Canary

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	3.8064107143060752
Encrypted:	false
SSDEEP:	96:KXVuHfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:KXVQbkIaFF1w0us4qE3+sSGjT
MD5:	8ABD279386C50705C074EEE18BF5AE59
SHA1:	C392231DBE744F5942DA4BFAC8AD0ABEBAEA0BF3
SHA-256:	2026944DCDEBC52F64405E35119F4CF97EA9AA1E769498730880B03F29A2B885
SHA-512:	3095759D01AC7EEA25E427CA38E8A0395BEFA7250E7A0C1327BF9D61F07F4570CDF7313FBE6695973EB0DD66D201C6C63591CC0DA8A1E0029926DC7056F4C95B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Canary) {.. {-9223372036854775808 -3696 0 LMT}.. {-1509663504 -3600 0 -01}.. {-733874400 0 0 WET}.. {323827200 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Cape_Verde

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.637993677747699
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2RQ7RfDm2OHDoH1JlvQV/FFrR3FcykVvQV/FFf+nmwV:MB86267RLmdHDC1w/FH3FcyL/FomwV
MD5:	1581C6470850E0C9DB204975488B1AF8
SHA1:	6933ED13F18AD785CEDF0837F86EFAC671297A85
SHA-256:	2EA59ACDB5BBDD3C6ABCEEA456838A5CA57371A3D2BB93604B37F998ED8B9D4D
SHA-512:	9FFFA013D82CEFF6F447521C19270ECDD71152F23670164423E6013FEC46253C62D2CB79B42630BD786BD113F27369E746CA981DD17E789F7571F473B47247C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Cape_Verde) {.. {-9223372036854775808 -5644 0 LMT}.. {-1830376800 -7200 0 -02}.. {-862610400 -3600 1 -01}.. {-764118000 -7200 0 -02}.. {186120000 -3600 0 -01}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Faeroe

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.709193799640151
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqLG4E23vXHAIgvMG4EeRRL/2RQqG4EZrB/4RQqG4E1n:SlSWB9vsM3yCPHAIgvoRN/2RQ1rB/4Ri
MD5:	601EB889A87F9CAD6F1DF4D1AB009FAE
SHA1:	EB43C253A48755442A67A2408D7E3295549F831C
SHA-256:	64FB8CAD17CD36666C7027AAD01344FEF659B13699EEF1942365842F8ED2170E
SHA-512:	9CFC4A446ED6A3BEF6C26AE57324F10A970EE2ADD6933130447FAD6A3DB538841F2490DD461AF5776FACD9BD2CDC4A83247DFA6B34802AE844DDC6D4C37B28EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Faroe)]} {.. LoadTimeZoneFile Atlantic/Faroe..}..set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Faroe

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6796
Entropy (8bit):	3.804838552487436
Encrypted:	false
SSDEEP:	96:96ufXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:/bkIaFF1w0us4qE3+sSGjT
MD5:	F97CC7EB9C52D00177BFF4715832FCD5
SHA1:	CD9DCBB5E6ADD6EA91C8F142957EC229FC7F6DA3
SHA-256:	795F438E7F01342D5F25ECCDD09FCE65C03C5D2D561B9B5191301D57EC16B850
SHA-512:	9586289FEB6C597160011A47432F0AC40000483FA2E579BD89046EFD33E98DDAD652B792FD80CEDEB4CD87B6439A7B473F25F1B7375BC75353CBAF9F77E1084E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Faroe) {.. {-9223372036854775808 -1624 0 LMT}.. {-1955748776 0 0 WET}.. {347155200 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600 3600 1 WEST}.. {811904400 0 0 WET}.. {828234000 3600

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Jan_Mayen

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.975859213900122
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2RQqG0EHEcAg/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2RQaK8Avn
MD5:	6EB1E51CDB90E841DC151004E98E80CF
SHA1:	CDB1FFF4FDBC7837E10E3725F09626345A82716E
SHA-256:	9152D10450CEBCE4AAEA3F3C8A50E4077A881E0B06B193A5886F06A453803112
SHA-512:	252648AA76AC0F08ED9BA3CB82E930101B1D2CE37EA979670671909CA8E2C7D838C35A449B0C7C2EF7BBF08C746475EC83403651CFB203E2F56C395CE2640933
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Madeira

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9709
Entropy (8bit):	3.80455694200614
Encrypted:	false
SSDEEP:	192:hZUiLbMsf/ss0qKd+aKyUXtOZHY1SCOcesoQivoKbFVCdm1rXWNXyCXTOuUbkIaq:hZZDQX1rWJysukysLE3+sSGjT
MD5:	AC6647F9B53B5958214EC3F3B78A4D85
SHA1:	7355622AF99296F069F73899D5C70941C207F676
SHA-256:	B2A0D0DDC26806A05B2BE806CA3F938DB12A3FA40110B8B21FD3F04EFED3A531
SHA-512:	07569CA4D5DC6D57D91D6FDC370671A7546B73BA653D094E1B501D33570F7700727AD7FF2A083BC79E9EDE807C47E7A5604BEF5803F290B2F277C51DEF10FA6B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Madeira) {.. {-9223372036854775808 -4056 0 LMT}.. {-2713906344 -4056 0 FMT}.. {-1830380400 -3600 0 -01}.. {-1689552000 0 1 +00}.. {-1677798000 -3600 0 -01}.. {-1667433600 0 1 +00}.. {-1647734400 -3600 0 -01}.. {-1635811200 0 1 +00}.. {-1616198400 -3600 0 -01}.. {-1604361600 0 1 +00}.. {-1584662400 -3600 0 -01}.. {-1572739200 0 1 +00}.. {-1553040000 -3600 0 -01}.. {-1541203200 0 1 +00}.. {-1521504000 -3600 0 -01}.. {-1442448000 0 1 +00}.. {-1426809600 -3600 0 -01}.. {-1379289600 0 1 +00}.. {-1364774400 -3600 0 -01}.. {-1348444800 0 1 +00}.. {-1333324800 -3600 0 -01}.. {-1316390400 0 1 +00}.. {-1301270400 -3600 0 -01}.. {-1284336000 0 1 +00}.. {-1269820800 -3600 0 -01}.. {-1221436800 0 1 +00}.. {-1206921600 -3600 0 -01}.. {-1191196800 0 1 +00}.. {-1175472000 -3600 0 -01}.. {-1127692800 0 1 +00}.. {-1111968000 -3600 0 -01}.. {-

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Reykjavik

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	3.716074665066009
Encrypted:	false
SSDEEP:	48:5Fhytu1phYdTclBoLB+Q1utqZu97fKnt91ItLjxkRq2fE4/JQjJuj4csf5J1R8yO:jhytu1phYdTclBoLB+Q1utqZuZfKt91x
MD5:	FE3467015B8B226CB9D8077CB1ABF81B
SHA1:	665083E753C6860755D669F30DF55333F2740127
SHA-256:	E77B9D50AF6C2550CA0517B4A6DE64A8A159AD0C77F1294C4212B6E20221B099
SHA-512:	661CA9C1DEDB9CE459215C48AE1409787B39EA025DA897FE8DA5532966FEC28BF86DF4B2794F7DDACFC01064CB9A11737592018C9B5C05045934D237FB1C428B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Reykjavik) {.. {-9223372036854775808 -5280 0 LMT}.. {-1956609120 -3600 0 -01}.. {-1668211200 0 1 -01}.. {-1647212400 -3600 0 -01}.. {-1636675200 0 1 -01}.. {-1613430000 -3600 0 -01}.. {-1605139200 0 1 -01}.. {-1581894000 -3600 0 -01}.. {-1539561600 0 1 -01}.. {-1531350000 -3600 0 -01}.. {-968025600 0 1 -01}.. {-952293600 -3600 0 -01}.. {-942008400 0 1 -01}.. {-920239200 -3600 0 -01}.. {-909957600 0 1 -01}.. {-888789600 -3600 0 -01}.. {-877903200 0 1 -01}.. {-857944800 -3600 0 -01}.. {-846453600 0 1 -01}.. {-826495200 -3600 0 -01}.. {-815004000 0 1 -01}.. {-795045600 -3600 0 -01}.. {-783554400 0 1 -01}.. {-762991200 -3600 0 -01}.. {-752104800 0 1 -01}.. {-731541600 -3600 0 -01}.. {-717631200 0 1 -01}.. {-700092000 -3600 0 -01}.. {-686181600 0 1 -01}.. {-668642400 -3600 0 -01}.. {-654732000 0 1 -01}.. {-636588000 -3600 0 -01}.

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\South_Georgia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.011466665416709
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2RQqGtlN62/EiMXGm2OHXT14YoHvhFvdQVIyV:SlSWB9eg/2RQrlo2MiDm2OHXqYoHvTFS
MD5:	3B310BB8C90CA716DC1AC5A697ACA9CD
SHA1:	CD583F49478DCDAD91EF78539502C6FC62945C1E
SHA-256:	51BFABCB3388107753A3C1A8CF31118E6627132BAA09B9878D9E7CEDBEBB4886
SHA-512:	F593B7A1FAF0EA6B42D5EE86C20C9A8F5CD7ACD9B30EF7755E45ECAFEA8752C32E4CF4BEDF531F494E59D9F0C49CCC6FCA077292E20794AA265DFC0A56DFE579
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/South_Georgia) {.. {-9223372036854775808 -8768 0 LMT}.. {-2524512832 -7200 0 -02}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\St_Helena

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.880390141563645
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2RQqGt4r+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2RQr4rV
MD5:	2C73A963F515376A46762CE153AAF5C5
SHA1:	996C3C93DFAD89EA80AC5DFA1DFBD7CECD9ED28D
SHA-256:	1C9CA8966FC8BD0BE70F4A187E17E56FB99139BC88C392E82BA2E23E23111C54
SHA-512:	35A9ADC047DB058D71C21FC4ECB57CD14B0D9BA4416506763D1800D72CE6C9E81636F332AAD3533616F05C86F90A60416BD4065C5F832A51AA3DC186218BDCAE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Atlantic\Stanley

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	3.662522763865322
Encrypted:	false
SSDEEP:	48:506KSBSdSs2SbSwGSyPU3lSsS5SGScSo/SkSuShSceS3SBSc7XSiSgSwSd/SJkS6:JKU+Ew0FU1TuhrR//tOIoOjXZfDWSkPR
MD5:	77C7ECE4FCBE150069B611C75E8DAA0E
SHA1:	22F4E5F15BCA92D8456B70BB36230F2605CA5E1C
SHA-256:	F0E99EF01F140CD5AAFE16803A657922207E6F7F6AF10B0AE795790916C302C4
SHA-512:	6FB57E8499A587292AFAFA9BD003721572393D5268CAF956230DA76983A112B27D6731BE561A22CCEF84935F43AC988B667C2DC404C157EA8D0E7830FC1A2AB8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Stanley) {.. {-9223372036854775808 -13884 0 LMT}.. {-2524507716 -13884 0 SMT}.. {-1824235716 -14400 0 -04}.. {-1018209600 -10800 1 -04}.. {-1003093200 -14400 0 -04}.. {-986760000 -10800 1 -04}.. {-971643600 -14400 0 -04}.. {-954705600 -10800 1 -04}.. {-939589200 -14400 0 -04}.. {-923256000 -10800 1 -04}.. {-908139600 -14400 0 -04}.. {-891806400 -10800 1 -04}.. {-876690000 -14400 0 -04}.. {-860356800 -10800 1 -04}.. {420606000 -7200 0 -03}.. {433303200 -7200 1 -03}.. {452052000 -10800 0 -03}.. {464151600 -7200 1 -03}.. {483501600 -10800 0 -03}.. {495597600 -14400 0 -04}.. {495604800 -10800 1 -04}.. {514350000 -14400 0 -04}.. {527054400 -10800 1 -04}.. {545799600 -14400 0 -04}.. {558504000 -10800 1 -04}.. {577249200 -14400 0 -04}.. {589953600 -10800 1 -04}.. {608698800 -14400 0 -04}.. {621403200 -10800 1 -04}.. {640753200 -14400 0 -

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\ACT

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.862270414049974
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjpMFBx/h4QWCCj1:SlSWB9vsM3yI9kHAIgmON/2DCeMFB/4d
MD5:	2EF41863430897F45E0CBB51E6A44069
SHA1:	8E9561060E9509FAF235E5E033FC9C2918E438DB
SHA-256:	DF7CBDDCBB2F5926A07D19A35739E5B8DCD9733C037F7D1FF95753C28D574674
SHA-512:	9D3A37D64DCCCA28093C30FAB595690D021FACEC15F351A77CA33A779D645D305A2FA031869F0DE3B0404C498C2C321D3D02E4DC592D3C632F6700F5DCB54900
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/ACT) $TZData(:Australia/Sydney)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Adelaide

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.894755849491153
Encrypted:	false
SSDEEP:	96:j8SY62BXovlCyRL8pJXa4NyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:j8X3Xzgl3PaN8asiQ/Uv9UnvtCaRs
MD5:	94E1A0C4326D09AF103107E64625CC6C
SHA1:	C026565F020EB158309549D98313632BAA79205F
SHA-256:	5C43D3152982BCFD5B9F51D0E909CF3A558BED1C270FEFFE030531D38D6F91B7
SHA-512:	CA08A8BC0EB740D59650FE0A9E56D9E169348AD0994F2BFFD6CCFBF9CC42E82F892FB719E80C4E2084B5702E9725C651359EE3066BD71BB19397EA83B6A68430
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Adelaide) {.. {-9223372036854775808 33260 0 LMT}.. {-2364110060 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1 ACDT}.. {320776200 34200 0 ACST}

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Brisbane

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	674
Entropy (8bit):	4.32071371733564
Encrypted:	false
SSDEEP:	12:MB862ELmdHLOYCvSi0xT0ryRIvUr0obZv:5ELe6dvSi6L
MD5:	900B39F1D4AB93A445F37B6C0A8DE3D9
SHA1:	DE82800779DCB8094C395B5024BD01FFA3C3BB8C
SHA-256:	0D3C39EDAB34A8DB31A658A1549772F7D69EB57565E40AA87B707953A2D854A4
SHA-512:	8D115D1D14FE6FF21A4AE77E3AAC075E6A877214E568956B9A4FD2E75A46E458CAA5AE26B483F128B4C62960D73BD7543BC32F22B760059423B3D9ABCBA24B6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Brisbane) {.. {-9223372036854775808 36728 0 LMT}.. {-2366791928 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Broken_Hill

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8437
Entropy (8bit):	3.902306256303896
Encrypted:	false
SSDEEP:	96:QZSSY62BXovldRL8q75aANyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:QZSX3X2QfPaN8asiQ/Uv9UnvtCaRs
MD5:	1553DAAB804A6C9BB15D711554980D3B
SHA1:	5E3161B1FBB4C246DCB5E11ABD94095121CE38ED
SHA-256:	734F295BD0B558BDF6178DE62151B8913699D08AB2B1D101C55B8DEBC410074C
SHA-512:	06B21886070E39E390ECBD18841B7FDBFCA2C7C8573495D2BAA2B92EB113CD1C73C18D73C49DE3C49572CBCBCBED2FAD3248BC651BEB825A1E089B1DEDEFCBFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Broken_Hill) {.. {-9223372036854775808 33948 0 LMT}.. {-2364110748 36000 0 AEST}.. {-2314951200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Canberra

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.851279484907769
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjnSV1+QWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DCcq+DCyB
MD5:	8944D3DF8FBECC03A8FB18C3B2DA3B53
SHA1:	6B17B38D6560592CA49840C47DB9BDA7E79F9F76
SHA-256:	5FE3CED97293FE0573D5ECE0CEF59CE5DDB4C57BC568AE7199E77B01D3ADE17C
SHA-512:	907D8BB7EA840E0B3AC683884F2F709A2C06D67CE9258BE46400A0DA63581A9B1403A44FA43E1059BE8F5C7E06F9FA05C176309AD6295317BF14F0E9FA5741E4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/Canberra) $TZData(:Australia/Sydney)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Currie

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.79231670095588
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DCkx+4DCVDy:MByMjUQVv8At2s4Ky
MD5:	0C1DFC0877CE8EB08007B7C2B7AF2D87
SHA1:	02F835BE2DA4FCA79DC2A6959BB4EB6ACC8DF708
SHA-256:	1DD4EC4ED4F854E2EF6162B2F28C89208710F8EC5AABB95FFA9425D3FBBCAB13
SHA-512:	358347045915B7D10940DB15E49528D0C636BEC1BE70129847D0B9D034F9E96E847394D88358E87D98A9E581605A3C2AB917B85FDE1296F290B4194BB7E3FA46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Currie) $TZData(:Australia/Hobart)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Darwin

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	437
Entropy (8bit):	4.508468081487136
Encrypted:	false
SSDEEP:	12:MB862pmdHPCvZUjMWpXgda/gd026Xgdvgd+v:5peKvZqMSX+4+56X+v+Q
MD5:	A81864B2C0BD7BF81F4FA21F17800059
SHA1:	518AC9E040A17083ED3962F4FBB47D1D83764FF7
SHA-256:	AC004FD4B3C536406991EC13EBB3E64E0EC0C7B264BC18C0700C8FA545868155
SHA-512:	3C24F4C2CC3072B3E820FCC1C68A747DCCBB9481FE743C1555783CC932DCBA44FE4851A732D24EABF62E845474D4E1278F120A04DB7549A18C7C49C31FB8D425
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Darwin) {.. {-9223372036854775808 31400 0 LMT}.. {-2364108200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Eucla

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	759
Entropy (8bit):	4.110997549215461
Encrypted:	false
SSDEEP:	12:MB862EmdHvOYCvV2mV22wF2nUV2CF2+V2pCwF21UF2biV2cHVKF25V2VF2cV2tFq:5Eemdvg2wQCKZ4j5c0LVmtH1iknohwQT
MD5:	1BC8DBD2E24606EFA49F933034FC0EEF
SHA1:	A511695A1B87A689C6BFF65257C11D3962FDDA3D
SHA-256:	79D0C770A304360DB33F3D1EF7B3935F1E4E8125893E0DCE683AC35A51302CFB
SHA-512:	A839D390D70F22FC833322029B732F3AE68FF48793B07005041BD12322DD6E5D5E5FF31787AA004A507A57F8FC245133891F266C4EF19D49F085E6B412E5B04C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Eucla) {.. {-9223372036854775808 30928 0 LMT}.. {-2337928528 31500 0 +0945}.. {-1672555500 35100 1 +0945}.. {-1665384300 31500 0 +0945}.. {-883637100 35100 1 +0945}.. {-876120300 31500 0 +0945}.. {-860395500 35100 1 +0945}.. {-844670700 31500 0 +0945}.. {-836473500 35100 0 +0945}.. {152039700 35100 1 +0945}.. {162926100 31500 0 +0945}.. {436295700 35100 1 +0945}.. {447182100 31500 0 +0945}.. {690311700 35100 1 +0945}.. {699383700 31500 0 +0945}.. {1165079700 35100 1 +0945}.. {1174756500 31500 0 +0945}.. {1193505300 35100 1 +0945}.. {1206810900 31500 0 +0945}.. {1224954900 35100 1 +0945}.. {1238260500 31500 0 +0945}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Hobart

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8734
Entropy (8bit):	3.8515786470328823
Encrypted:	false
SSDEEP:	96:aOqigkx6WsYyS39nQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:aOq05hnQiAmcOM6e0pj
MD5:	5E04BF8E1DEBFCC4130FDD1BBD67B2DF
SHA1:	796AADCE7BB2FAF5E6FC916C941A4E3DCAFACC9E
SHA-256:	D813F6A97BEFC22CA4F24C59EB755D269B9C68A449CC7CF0D2C61F911860EBE7
SHA-512:	3A69CF1D1F57D6BD39E5F4DAF76BBB06A749D42BEB29452A0A5BDAA68F5DACC0DF176EDDA7A083F5B5B84FC651926C09D46CAAD2F6C4F1595AB9CCA1A958D653
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Hobart) {.. {-9223372036854775808 35356 0 LMT}.. {-2345795356 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-1646640000 39600 1 AEDT}.. {-1635753600 36000 0 AEST}.. {-1615190400 39600 1 AEDT}.. {-1604304000 36000 0 AEST}.. {-1583920800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AES

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\LHI

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.912882643701746
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIoGEoPHAIgjGg6N/2DCkx/2DCPGUv:MByMjeXV6t2a8v
MD5:	425DC7B1E31F4AA41DAD74E3C9AE3562
SHA1:	D92A3269F7BF5EC00F082C64CEF6E20C43017180
SHA-256:	4D84E4040FBC529C9E0366BB74D0CFADEEEEDA0DFCC6C2C9204DED6C6455CAC3
SHA-512:	F3031F16C0D00D9F8A38CD378F599EB3E63F4FF85F120DB38E3013E93F08E6F512D969F164BBC88CD625910FB3E086F3352E5B8FFC1373C3CC98F363FB3FD3F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Lord_Howe)]} {.. LoadTimeZoneFile Australia/Lord_Howe..}..set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Lindeman

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.249672335529665
Encrypted:	false
SSDEEP:	12:MB862gtmdHVCvCi0xT0ryRIvUr0obbty/ywtUj3yv:5gteMvCi6Xlt8
MD5:	504A422280E0459A2126E7CB02F527E6
SHA1:	EF61B98EFB1E44EE59020E99A69EA67D6B8ACFC2
SHA-256:	01B278309353849CC2FDF62A30E2FF483833D5713CF5E329252738BE6F2C0A84
SHA-512:	BFDAAD56D817CD3AAB17DFD0A33EFDD422645BC542ABE269C0F8520E33796DF4F19EAB2E40BFC6C4AF93EF654239B8F2E285639B4662040D865B9C340A23CFAD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lindeman) {.. {-9223372036854775808 35756 0 LMT}.. {-2366790956 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}.. {709912800 36000 0 AEST}.. {719942400 39600 1 AEDT}.. {731433600 36000 0 AEST}.. {751996800 39600 1 AEDT}.. {762883200 36000 0 AEST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Lord_Howe

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7764
Entropy (8bit):	3.5615258807990537
Encrypted:	false
SSDEEP:	96:pmz39IyKxb/JbcD9gKniAF23QbNS1fEGXALNbbT2JFJ/FaKaTQ9ZJhRVK:p+cpVKniAF2AbkFKL
MD5:	10F983F4683CDE13A1228AC0B04D8513
SHA1:	45378BA5949BE53D698108F50FECFF50C9E3D296
SHA-256:	76D1F1ED67B8F8D6903789C2FDDF79590A83677972D416F5F3C9687614EC6238
SHA-512:	D60D802EF215A33750E4F859657BA12A67084B1E9FCF1B4A7CEEE7B9D816BC2C6670775D93C88EC8380CDD7790AD574133D6F90F0828F848313C26583B2F196A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lord_Howe) {.. {-9223372036854775808 38180 0 LMT}.. {-2364114980 36000 0 AEST}.. {352216800 37800 0 +1030}.. {372785400 41400 1 +1030}.. {384273000 37800 0 +1030}.. {404839800 41400 1 +1030}.. {415722600 37800 0 +1030}.. {436289400 41400 1 +1030}.. {447172200 37800 0 +1030}.. {467739000 41400 1 +1030}.. {478621800 37800 0 +1030}.. {488984400 37800 0 +1030}.. {499188600 39600 1 +1030}.. {511282800 37800 0 +1030}.. {530033400 39600 1 +1030}.. {542732400 37800 0 +1030}.. {562087800 39600 1 +1030}.. {574786800 37800 0 +1030}.. {594142200 39600 1 +1030}.. {606236400 37800 0 +1030}.. {625591800 39600 1 +1030}.. {636476400 37800 0 +1030}.. {657041400 39600 1 +1030}.. {667926000 37800 0 +1030}.. {688491000 39600 1 +1030}.. {699375600 37800 0 +1030}.. {719940600 39600 1 +1030}.. {731430000 37800 0 +1030}.. {751995000 39600 1 +1030}.. {762

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Melbourne

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8341
Entropy (8bit):	3.8532171550973526
Encrypted:	false
SSDEEP:	96:Yyigkp2EUyn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:Yy3VnQiAmcOM6e0pj
MD5:	40D06B80A4A0DB415270EFD9698B97BF
SHA1:	1999F0E8C7EBAA11BD21D64D9E07FA911F13C64C
SHA-256:	F21B9EA51C0D41BAD0420FE0601E5A4B491FB895856F4BDDF6541D704469D92F
SHA-512:	E47D597CC85D177CF2804C44C216EB4C5B74472457F15F697704311A847BF8A051DCAFD26FA61DD689555F35640151E26F25D5DC5319EFEFEA62AD86657A4A95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Melbourne) {.. {-9223372036854775808 34792 0 LMT}.. {-2364111592 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}.

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\NSW

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.893713405897538
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjREeQWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DC5eDCyB
MD5:	80B7CDD1EA5A5308CE84C038180005F2
SHA1:	B7CA15B58ADA8CA3EB74B7971073022D57D8EE70
SHA-256:	73D7C9E207E61ACF8DF7242BDCD84488189033E22A84873A953B65DE02FA1B0B
SHA-512:	F627F5FF335600AC9158D6A0D3694AB7E70180177449C17B5605BBF7B1B7F8FB447A9C207F4E1BCB627074DB47B8A66F5D78E03C6DB8FA17F8BDD6AABB331665
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/NSW) $TZData(:Australia/Sydney)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\North

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.830368875485429
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjbvvXHAIgoXjbBvRL/2QWCCjsrQWCCjbi:SlSWB9vsM3yIFHAIg2N/2DCZrDCl
MD5:	14CB7EA1C028F457345EBEB8ADDC9237
SHA1:	208BF676F56533BA271D1B98363A766DF17CF6F2
SHA-256:	A983C9CAD7E542CAED43B083E68CD2B782959A4B54015F374C29250D3ACF9B8D
SHA-512:	099F65E5FA705FD7257CF7B8E103905EE313C6D082844F69CCD3F318E3E7F4098B29F952FA0AA28655E1FE290A0FB2E809911088315889DE7CAAF0E04698C2FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Darwin)]} {.. LoadTimeZoneFile Australia/Darwin..}..set TZData(:Australia/North) $TZData(:Australia/Darwin)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Perth

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.31793586514766
Encrypted:	false
SSDEEP:	12:MB8623mdHCBdCvmlXz6zezzOz4iaLYvzkzi4zm5fVcBhg8mfev:53eCB0v4+e3Oz4iaLYbkzi4zxhfqw
MD5:	01B1A88867472AD60B8F5C0E1648E3ED
SHA1:	9975EA750458E8061DD8A83585675CB7E4910CA6
SHA-256:	FC1B54CA261074E47A8A486FEAC12DD04D46166D1D2B44163BD8791BEC32D275
SHA-512:	20BDFBCD1A5038C81552EBD955F3921DE3447A1F30E64935937768B2B98735AE53049601DCDD2D519646C78E6D03289EB465CFF4F2DADEA7D89A329504C6C475
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Perth) {.. {-9223372036854775808 27804 0 LMT}.. {-2337925404 28800 0 AWST}.. {-1672552800 32400 1 AWDT}.. {-1665381600 28800 0 AWST}.. {-883634400 32400 1 AWDT}.. {-876117600 28800 0 AWST}.. {-860392800 32400 1 AWDT}.. {-844668000 28800 0 AWST}.. {-836470800 32400 0 AWST}.. {152042400 32400 1 AWDT}.. {162928800 28800 0 AWST}.. {436298400 32400 1 AWDT}.. {447184800 28800 0 AWST}.. {690314400 32400 1 AWDT}.. {699386400 28800 0 AWST}.. {1165082400 32400 1 AWDT}.. {1174759200 28800 0 AWST}.. {1193508000 32400 1 AWDT}.. {1206813600 28800 0 AWST}.. {1224957600 32400 1 AWDT}.. {1238263200 28800 0 AWST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Queensland

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.803539644461131
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIaWhSHAIgPWAvN/2DCoRWJvFBx+DC7WN:MByMjL9t2rOvFel
MD5:	401B6B2E30EF17BE20212645287EB94B
SHA1:	67D15A45C61122CE680B829FE0FA3A1C501A8C8F
SHA-256:	DDA669B9BFB3E08FC23CE67030148B9E4740824ADD8DE02580D6AFD31CE05BAB
SHA-512:	F4348F8F4FF261C47854725AEE4E14E7E334B3C31496E5C46B0E0041551CB6861380E684E8888AFE9DA7E8E97236AC322B9CE2738EF245E9D46C9681665F83A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Brisbane)]} {.. LoadTimeZoneFile Australia/Brisbane..}..set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\South

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.752918480727309
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIDRpGSHAIgSRrN/2DCa7QDCuRpyn:MByMjdpQYrt23QHpy
MD5:	D226A0718185854DFE549E00856AA8D5
SHA1:	94EE96FAE259D90C2FDF169DD95BD82B3171FFAE
SHA-256:	D9DCFDC377901EC0C0FEB9CEA743C2C1425273F69A1BAA7BF3B74FEC5885B267
SHA-512:	7EE29A7235CAAEF4889246B7A2241CA9A0D5D2B2E1D56B20141247C93B8736F17280F0D46004AC4588E137D1E76F661C779C906BBFC2B5F8FA73C19F7657F952
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Adelaide)]} {.. LoadTimeZoneFile Australia/Adelaide..}..set TZData(:Australia/South) $TZData(:Australia/Adelaide)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Sydney

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.847525715050911
Encrypted:	false
SSDEEP:	96:AZJigk42/yn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:AZJuVnQiAmcOM6e0pj
MD5:	C0F1776E011C4C86B7709A592E7CA1EB
SHA1:	1CA528D529BF4995E145D6E0D87A8752A3577E7F
SHA-256:	FC453486325ADE1D31F14087B76D4936F3A6D551ABD1DB6FCAC129BDB043951C
SHA-512:	F872182962C2615A35F012ECAB30C88F07C6BEF0261207AD52706DB22D8CDD0DA65723CD801FDA7C548C5EB0ECFC39DD66CC17503BAA3BBB77BFA35D20650E4F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Sydney) {.. {-9223372036854775808 36292 0 LMT}.. {-2364113092 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Tasmania

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.777331394201868
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DC3neDCVDy:MByMjUQVv8At2+eKy
MD5:	9C58D9EFBB03472BBDA76CE2FFAD4BB4
SHA1:	30959E3681B64AE26F7FA3957887896C26AF7F19
SHA-256:	C94FA7A7640CD00963EE8FF1A3D9DCDA2075408739D998EDBF7CFC998DB764FD
SHA-512:	2D6B778217726691F2CB4A4995A8B1AB08DDB7FE4570A3FD04EF54F718F455EF3CBD4EEF1A1BCC99A2088C82A6E89DB455BAF1327CECD6BF608837E50F14A6C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Victoria

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.818875198673406
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIvFfkSHAIgoFNNvN/2DCzyQDCMF4:MByMj9fKaNNvt2xQz4
MD5:	0B144A2E47C81354BC510BC741DE5150
SHA1:	A7396F1741F02C6C208FD1286362E4E0720198B8
SHA-256:	DBEF9C5BDD290FEC5FA740D697143332D3CA1FC373CF1DF736F1883AC9BA3298
SHA-512:	562B029591F9ADB8C324BA56E849B2B524E91B26D3DB441510194882A8E1E63E6948D041874A00A0A76F29925A1CEAC53DD2AE5D7F23123B6FE919346CBFD8CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Melbourne)]} {.. LoadTimeZoneFile Australia/Melbourne..}..set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\West

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.831654343064909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjXFeyXHAIgoXjrWARL/2QWCCjH0QWCCjQ:SlSWB9vsM3yInHAIgOWAN/2DC00DCt
MD5:	5F5916CB038876BE27AA5E2AD74EE085
SHA1:	18AC21B638188B542455BA3DA91F958DF1724E68
SHA-256:	75ABB7F20C4A0B618138AA190AF33CEAF2A6D2C707DA6C1314E4BFF2F9904F58
SHA-512:	ADFD83E292AC1BB5E19255A9B2DA0E3BB9323A5F9B92D458DE34C291D7F9B6CFBBF62AA3351FB320E54F34305DD485ADC72134D21AFA6A27B2B8B7D93DCA2113
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Perth)]} {.. LoadTimeZoneFile Australia/Perth..}..set TZData(:Australia/West) $TZData(:Australia/Perth)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Australia\Yancowinna

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.918079927018121
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIcKlHAIgJK3N/2DCkuM0DC9KM:MByMjcKeJK3t2kVSKM
MD5:	BEDEA56FCE4B2F0A3F3E9319856A5560
SHA1:	9FD0FE998A003C6B4CCCD00A977153347DE07F55
SHA-256:	55A9264D0414644A1BE342106AE86086A6659596DC9322A74FC4D1DDB41F7C60
SHA-512:	7C438B72262B99EDEEB31AC95E0135BB722A3B0B049278B6DE67DB5FB501837FB9C03785233B538E83F4B56104F6EA3B3DA0F7C2275E0F78F232161840AA4C63
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Broken_Hill)]} {.. LoadTimeZoneFile Australia/Broken_Hill..}..set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Brazil\Acre

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.888429541699473
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7thteSHAIgpth9RN/xWh490th4:MByMYdIp7tQ490I
MD5:	A8A7A10DA4321819ED71F891480770F8
SHA1:	930674EF7711542D7F471A59C1870D4576E027FD
SHA-256:	2F594239A434052D36053A2B3EAB134EADBAD06EB6737E67CF72166DAB157537
SHA-512:	C6AD1869A713DDE0E4DE53F7894E5CE0B7AEFDDD7C5C3D83BB5B92FB7D8E20B373A6694045053E1AE8EA98A7B7D0C052EF2C21310E47DC650A7A399A5F73D586
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Brazil\DeNoronha

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.875339623736144
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0wKy4oeyXHAIg20wKARL/1bIAJl0IAcGEwKyovn:SlSWB9vsM3y7/rDSHAIgp/AN/xIAE90j
MD5:	E0D0EFBEC37E27532B49FF6DD9893DA0
SHA1:	9C00993A885AF448E48201A46E17629A7A602FC6
SHA-256:	A676562A90FF8587A775F6F0E3BE05D870456A56D25B5330816BF9043C8D475B
SHA-512:	AB0E6907F9C0002CA5C050A0069AF013B14BADA08CA4553C96B302C078DF7629D5D7EDE4A19A53DEC6E7B9E6D9857F14EC7A1DB9BC11F2EEC9FFBAC70E129EEE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Noronha)]} {.. LoadTimeZoneFile America/Noronha..}..set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Brazil\East

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.948480276987682
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0tQJXveyXHAIg20tQJE6RL/1bJHIAcGEtQJXy:SlSWB9vsM3y7tIGSHAIgpt36N/xR90tF
MD5:	FCCB5F44903E1B988A058E5BBF5E163B
SHA1:	E1CC03DD4A804C7305D8B0C12D8451D08AE262EA
SHA-256:	961FB3AB99A63B1E9704B737EAB2D588B5A39D253A213E175CC678BEDFFD498D
SHA-512:	F31C80E4AD6EBE6CB8A3382E0052DC47601D073E8F81375D50241105675AA3AB45433FFD0534524D9992ABE1086C6671D85FF7C72B0D6766EB9984426F608B77
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Sao_Paulo)]} {.. LoadTimeZoneFile America/Sao_Paulo..}..set TZData(:Brazil/East) $TZData(:America/Sao_Paulo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Brazil\West

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.902113962502196
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0znQZF3vXHAIg20znQv5RL/1bbAWVIAcGEznQe:SlSWB9vsM3y7zn+PHAIgpznSN/xn90zN
MD5:	9F4B43F4F27D0B7EAC0C5401A1A794B4
SHA1:	2A8543B994E93E54BD50EAA78463905E6A8EBE74
SHA-256:	0500C9A248C8CE9030EA30D0AF9DD95DC465480BAF60646C0B7C511FA23C6D1F
SHA-512:	0ADAF708ACFBD80F4704951EEBC24AD144FD5856997A429279E804F3A7F7F9A8FED41DCEE85BFB1ECDBF1E05137E87E7430186474BCF5DE42067FFC74746F048
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Manaus)]} {.. LoadTimeZoneFile America/Manaus..}..set TZData(:Brazil/West) $TZData(:America/Manaus)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\CET

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7736
Entropy (8bit):	3.7984816540097843
Encrypted:	false
SSDEEP:	96:09+xKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt7:9Ss41sFpM5vwA6Efv03TBZLl
MD5:	6DB983AD72FB2A88FC557BE5E873336F
SHA1:	C64E988010087ED559A990B3D95078949C9B4D72
SHA-256:	E2AEA7CFD428A43D9DB938BCC476623ADC1250BD8057013A7FFF5F89D7FF8EFC
SHA-512:	C0A646F80FB2FD42D9146A4FD36CF5A7F62016684F8D5AF80453EC190F4AEA65EDADC5BCF071AE746ABFB43B29C27B2743F2152B6986D41BFDE1617CA774A7C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:CET) {.. {-9223372036854775808 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766623600 3600 0 CET}.. {228877200 7200 1 CEST}.. {243997200 3600 0 CET}.. {260326800 7200 1 CEST}.. {276051600 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\CST6CDT

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	3.8095769056779916
Encrypted:	false
SSDEEP:	96:e3HgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:eQaUqtfA604qSBgI7DBch
MD5:	A6F88C55E8613A27DE3E6C25B0672910
SHA1:	3B593CC17BF153A6209FC5AACE7B88DA9603BD44
SHA-256:	73A9841F233AA657AFB6CED8A86A37D55FE5582DD996B9B28975D218BCCC078F
SHA-512:	526A922B1594A2800B03F363F7BFEC29203D4A4F2B49C5F2618469F59176CE4F8AFBA0616B226AC39D308DB05DE7147714D9B6CDBB2EA7373A041A4D47F50E2E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:CST6CDT) {.. {-9223372036854775808 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-84384000 -18000 1 CDT}.. {-68662800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Atlantic

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.804821796604604
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/0nalGe2IAcGE2NEOyn:SlSWB9vsM3y7UEOXHAIgpUEqA6N/0af9
MD5:	33A04963E70EBF29339204348E0DF874
SHA1:	456C0DB88ECE4D180EEE5AE5AEF5FBEB6E977D00
SHA-256:	6DC6354D761CBE7820C9186568CAB87AD48CA925507F6A740357195B60E16D87
SHA-512:	DF8F46827760BD7EC922C6837E0B6649B4FBD220B79E6F1B67FE3DD8CB3D2D035ECDAF4CF6CE5BDE6DC79C6F7B6EE2B9787AF08A97845CD0D647720A2E78D7EF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:Canada/Atlantic) $TZData(:America/Halifax)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Central

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.863241040396457
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0po/vXHAIg20puFvHRL/0nPQox/h4IAcGEpoyn:SlSWB9vsM3y7pYHAIgppuRN/0d490pl
MD5:	97E50CE9FBA3F1A6DFCF333F9E6D592C
SHA1:	EE472C411079E788DBF32FAC9C5B7EE121960DC2
SHA-256:	DB32E83949D62478D229E9FB57BB1624D21B3A9CCEE4CD55335F8262C01D820A
SHA-512:	D547E3DC03848A677BE67F7CF4124E067F76EE09BB724A5B10F028BEA72C1526B17678A035B2C53F69498E9ECAACD3C5445D42B7FE58DF706DD2C5F2ADA05A73
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Winnipeg)]} {.. LoadTimeZoneFile America/Winnipeg..}..set TZData(:Canada/Central) $TZData(:America/Winnipeg)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\East-Saskatchewan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.90775999333305
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7hzi2HAIgphznN/0L5d490hzyv:MByMYhiXphntyQ90hyv
MD5:	E4114CC94C5C1DDF98535BF2B25BF109
SHA1:	212BE0FEF7039C0CDB8AF509927F4C03D8F72D22
SHA-256:	27CCEB515F9B2AB2D441F7C1533064AD13C89A6A009C3F2F14842B217075E231
SHA-512:	06C946DC79190F1C0FAF7F1F41BBEE4EE2A40910913896DE5AA94BC848DAB60F4F40A999CA4218FE1AA499854CCDD9379C937A9DEF273B2C7A352D8CAB8A5FE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Eastern

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.758562813220951
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/0nbHboxp4IAcGEqM:SlSWB9vsM3y7RQtHAIgpRQPN/0Dboxpp
MD5:	4365BEFA3D50EEE20843EF97A095E512
SHA1:	7756049B4CD6459742686925E9516E64A9727306
SHA-256:	22844994AE893F3236A091B050E932E84A5218EC0D01F72595E17CCC471FA564
SHA-512:	CB265E79DF926026BEBF7158590369ABE5353C759540F509ABBA2A7ADBE59A705BC2AB936F400614BE610EDB761DE9A2B1E179A0A8B0A87E595392362C2516AA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:Canada/Eastern) $TZData(:America/Toronto)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Mountain

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.8181126338833655
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx07nKL50vXHAIg207nKLyRRL/0nNYLo/4IAcGE7nK1:SlSWB9vsM3y77G2HAIgp7bN/0W8/4908
MD5:	FA0D0024AD72CCE4EC7229FA897FB1B7
SHA1:	4373A07F2674FE974189CC801987652AA97F0204
SHA-256:	D7A203E60FF19DCDEAAD14121720DE51DA73392D25B40FFA301C1935CDF89517
SHA-512:	82EF7F429604A69734B04D298B4C9C9AC3BE57B9DD8C4CECF59C7AB3470BDFBA0505886C4E6AA3864F5EC7FBB4C69C54CF153A6417376828234833013C29A0C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Edmonton)]} {.. LoadTimeZoneFile America/Edmonton..}..set TZData(:Canada/Mountain) $TZData(:America/Edmonton)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Newfoundland

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.998628928230972
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7tgYJHAIgptVN/0xdBx+90twv:MByMYnKpTt590g
MD5:	A2DCCB8BFC65DD4E7C3BB7F10DCEFF11
SHA1:	6FD2F4FAE06C5D4D3F189A167A98AA76497569DD
SHA-256:	87F42F45FD7D059CA47650D445420DE8320F3A7C1CBC7671FBFA8A8881274433
SHA-512:	F42E32C5BD785BA914E5054784BF67DDF951460A708290D1899621CEEDC63475B584FC052A86A3B6D45BF3C651D42427FB6F9CE2A2A33764DFFF731053BECC16
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/St_Johns)]} {.. LoadTimeZoneFile America/St_Johns..}..set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Pacific

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.887587766811186
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7ZLgXPHAIgpZLgFN/0N290ZLgK:MByMY13p1stx901/
MD5:	68900CE38FE0E40578323BBD3D75184E
SHA1:	9D5EAB5CBCD495DD46974207FBE354A81DD2070F
SHA-256:	5C4FD46054B190A6D4B92585B4DAE4E3A8233EE2996D14472835DDD264911DC6
SHA-512:	3EF53F0FCD8D88A1B977886BDFAA03D7B84EF021AC6BEDF7C571BFBF2242BFC3F3EB6A6B6A9C2F6852AF412A96DFBC30F3BB25A6619CBCD8736F3DF5B64DE1BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Vancouver)]} {.. LoadTimeZoneFile America/Vancouver..}..set TZData(:Canada/Pacific) $TZData(:America/Vancouver)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Saskatchewan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.887593462838566
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/0nogS64IAcGEsAzEB:SlSWB9vsM3y7hzi2HAIgphznN/0Hd499
MD5:	A4237BDCAF68B0EFECA97178F3DEE724
SHA1:	A9CBC02B5545A63A0C9B38C8FA7FA2DE6D483188
SHA-256:	46BA00AE3A07A4DC83D6CB517D87C9CBBA491B3421FE9AD6C74CAC5695EB73F7
SHA-512:	832BF256BE8CB2DD205DDE50017448D5830B46FF4DCA77BDB852067EE0C9DF9977014F2A3E3DD6944336158D8EA377CFBBE519EE5B56FB26EB64325B45476B9D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/Saskatchewan) $TZData(:America/Regina)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Canada\Yukon

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.889486451014262
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7peR2fkSHAIgppeR2rN/0CF/490peR24:MByMYkGk7pkOtBQ90kB
MD5:	490D99BD5465CBF5A8FE28F33180B8A6
SHA1:	4783295C31A804BE98145270ED28956A0783E655
SHA-256:	A1B1AF37DC89C6BA663E4E967A18409AE4E0FA9EF1B908D0461368DA31001C09
SHA-512:	9F6B4F204A21B69E1DFCB766C0671D3736414C73269DCEDCDB4FC3DBA869BBA1511DF6B5061F8964F0AF9C3816133D04E5DFB8A6AD07CA06E7712787A8FECC5A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Whitehorse)]} {.. LoadTimeZoneFile America/Whitehorse..}..set TZData(:Canada/Yukon) $TZData(:America/Whitehorse)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Chile\Continental

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.812019117774239
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7tfEJkHAIgptfEJo5N/0rHM490tfEJB:MByMYE9pEOt4X90EB
MD5:	6EF54792279C249B16877100682F1806
SHA1:	A62629EA055207D917740E3AEF4F0B005EA49CC4
SHA-256:	5B40167DD0C0B5C293861070C4AC249F78DDF8BAD798DD0165E3AE894C9B9570
SHA-512:	3CF93003C3EA2B4386660F0C87074F9AE2BAC4EE72D88451DCB1EA8B79502D2187B1608B6D5CE8D7EDC00AED99CF9DB7B006EB6ED2A2B5009F2C0E757D282D74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Santiago)]} {.. LoadTimeZoneFile America/Santiago..}..set TZData(:Chile/Continental) $TZData(:America/Santiago)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Chile\EasterIsland

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.808907056781067
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG7ZAJWXHAIgObT7ZAiFvRL/0bxOdBx/nUDH7ZAZv:SlSWB9vsM3ycJAUHAIgObJAiRN/04dBn
MD5:	2EC4FDD1EFBAF1D9F9DBAC8B1B5EDD09
SHA1:	FECED8EBC7B666628B7B45C9694FCB3A0B20A42A
SHA-256:	1E2DA1862E0E0F131B7C6EB12FAC5F920852C61C162993A30BC843A464A5AAD4
SHA-512:	74D61141505BAF1ABAD61FB91941C63C169EFE3C85829FEBB4D29A72EA54D1A07EC84E2E9B48E963E65CBF7663245459FAD288D620B1BEFFE682A2D1C243794D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Easter)]} {.. LoadTimeZoneFile Pacific/Easter..}..set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Cuba

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.857134440822812
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx02TEMVFfXHAIg202TEyRRL/0lIAcGE2TEMy:SlSWB9vsM3y76EkHAIgp6EyRN/0l9068
MD5:	3FB16EA4A9B0529220133C4A7B05215B
SHA1:	BD56B6E76A92A5925140CB5CC3D940E1DE90993F
SHA-256:	6F4F2D7F5BCA4E5183460C0153D2B98F5239A99F149DE6638B311C73CEDB1329
SHA-512:	690EC1BCE7FA979BD55725B8ED6DF042BB331CAD332827B2C64B31F107539934AA5A30268B1F03D52697528E68A1BA72E4D56B5199A68B1ED897B75FAFB33A8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Havana)]} {.. LoadTimeZoneFile America/Havana..}..set TZData(:Cuba) $TZData(:America/Havana)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\EET

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7440
Entropy (8bit):	3.695300167191082
Encrypted:	false
SSDEEP:	96:CgDIMcVbf+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlt:KlfyDjivBeRF+W35Syrwl9h5j
MD5:	34339D40AC889DCB5A09D10F123175AD
SHA1:	57E1F70FA8999106FA3874A9CE1E75A7ACBC81E9
SHA-256:	64E284F9F7A36CC0A352809141D76E73A99344A9F30CFFEA254CBB9D2C589ADA
SHA-512:	2DCF16D9D7593FC3E5844E18FD689AADA157866490CFD37A38A47F747DDA189822055F6DD470CA2D77040D2C5A2527512880C22ED8EC16D9424EDF3DC228AFED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:EET) {.. {-9223372036854775808 7200 0 EET}.. {228877200 10800 1 EEST}.. {243997200 7200 0 EET}.. {260326800 10800 1 EEST}.. {276051600 7200 0 EET}.. {291776400 10800 1 EEST}.. {307501200 7200 0 EET}.. {323830800 10800 1 EEST}.. {338950800 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 E

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\EST

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.924838898127838
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yLbNMXGm2OHLVva0v:SlSWB9eg/ylDm2OHLVi0v
MD5:	B221E7141FFC9DEA317F64F81C7BB4E0
SHA1:	B13BBDE790B169D8B9075275523F319D5173E2C7
SHA-256:	6344BE02529C1CC5F7B5FE14B7E9BBCED4DDE68A24B824601EEBCAE207ABFDF2
SHA-512:	FFFA733476D6C7DCF49C0B88C9F5E381DE2B69BAEDF6C7B1D91C6F45CE2D36E06D40F25B6BB65D4B5D650471BB52CD2EC3F68703DAB4BD5414F8D3F831D92BD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:EST) {.. {-9223372036854775808 -18000 0 EST}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\EST5EDT

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	3.8091719283634853
Encrypted:	false
SSDEEP:	96:R+kNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:RXoSItON0HY2iUmUFLqU
MD5:	4578FE48781599B55F4BCF5560019789
SHA1:	4EAA7134621DFDEBFD1405F5CC58227FA7E80C3A
SHA-256:	0BE6161403BC5A96BFAB174F2C3FCBA8A677D4349699B408E9872B9DD0FE15CE
SHA-512:	9ACC2EF396F635D22E3DF6B785831AD74B510049F1BE85F996467A5BBC0DF49A28B2FC3E4CA0CA9DC8FC2C29EA50D909F0B153265B107445D3052E81D9A4D50A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:EST5EDT) {.. {-9223372036854775808 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-84387600 -14400 1 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Egypt

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.862365884559795
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsPHV5XHAIgNGE7TRRL/yCh0DcPHy:SlSWB9vsM3y7fHAIgNTRN/yg0DH
MD5:	ACD69F34396296BA553243267D06CEE0
SHA1:	9575FFE5E7833B9532F17AC5413EA9DB23F07ECA
SHA-256:	936B6484469351DEF8FAFE8EC180862729F5E43BDE4E53E2E9636E221B54C3C2
SHA-512:	149D23FF35747127E9A2F4056D09472E8E689970BC795D5411C5BF621D949ADDEBDA68674D375A248A63106ABDFF6C54A8AFE5385C45BE2916CAED0C30F7C4A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Cairo)]} {.. LoadTimeZoneFile Africa/Cairo..}..set TZData(:Egypt) $TZData(:Africa/Cairo)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Eire

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.901791318009318
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV5QH+o3vXHAIgoq6QHFRRL/yMQs/h8QanQHuv:SlSWB9vsM3ymnQeoPHAIgonQzN/yM/hm
MD5:	E9C2C97EB65526F1D4BE1AD7385336FA
SHA1:	09E4000CE320F779E2DFCA2FFD6B9258FFBA6CE4
SHA-256:	B78A833337EFEC8B5F64622F1BFDA21FCB79CF290E9CF32A54B206EB20C6FDE9
SHA-512:	EAEC097B58BF466CC7D6C0C6297628AF910CC308AC822565FD6CDABF96CD4EC57D4CC724FE782B6C1B606DFF9424013F6A890A871339577F7CB68BBB3C425E65
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Dublin)]} {.. LoadTimeZoneFile Europe/Dublin..}..set TZData(:Eire) $TZData(:Europe/Dublin)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.928744204623185
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDMbNMXGm2OHvDwy:SlSWB9eg/yRQJDm2OHsy
MD5:	9C08898081382F52CE681B592B8E2C8D
SHA1:	165944424740B1FA9B4B3B8E622198ABD0BDA0F8
SHA-256:	66B0DF8888883BFF44B18728B48CDF24AAED0BB745D601F3422C4F2D4063E0AC
SHA-512:	86EA639F999169F2FBA2457BE5042463A1938031268CCA71FDD03CCBC6194932937BA58B49FBED461E055E9AA668FF6EBF391AA7EC603C0A425416DF2E6CC84D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT) {.. {-9223372036854775808 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+0

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.910789466104329
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDOm7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRSw8RQy
MD5:	333F2BFA92742A49BB88F11C7CD896A9
SHA1:	BB5BEC010C36427AEEBDDA2FB72083E22A3F5073
SHA-256:	64466EA3759301E88C29AD1A833CDCBBC495EB4A5A3AC45E7B2987FECD6702BD
SHA-512:	E2270F4B57C5F1C849726259B886E8644DCF497FA0D034AD48885146BEDC70DC8899900DA9AC01F2609A2DA881E10F9042CCBF75A3F5DA7344D7E92F1B070806
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT+0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+1

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.980500771169276
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOveyXMXGm2OH1VOwVn:SlSWB9eg/yRSvPDm2OH1VOwV
MD5:	A7C3FD06D1E06F125813C9687C42067C
SHA1:	515622C0B63E977AFBFC78AD8466053C4A4A71A6
SHA-256:	3BE1EC71D2CC88FA9A3DB7DC0476475F33FE5BCBE6BC35C0F083859766466C32
SHA-512:	548DA608CFCA5B8539652F94CA2040D624602D2DF64B2C8CCDB8B219B9B384E01386CDF95F3BF77409DF0584FA12A3B73D56D13107D98BEB4C2555F458B3F374
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+1) {.. {-9223372036854775808 -3600 0 -01}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+10

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.965033464829338
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOPFNMXGm2OH1VYU7vV:SlSWB9eg/yRSPXDm2OH1VYW9
MD5:	FF71149E56D4CB553D0ED949B5F4C122
SHA1:	3459B47E0EEC80D7A29512CA4F3F236C89E86573
SHA-256:	E61E826E6FBC2396EF152640698098F4477D4FFDFE5F791F62250C3EC5865304
SHA-512:	43B0CC8BD7F1EFC80C3F14F115D651EADD5743B17B854C2FB7AC25995138D3DF8792915C2952B80F35784A7115F8FB335ACE171479B24C668190AC175523DB21
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+10) {.. {-9223372036854775808 -36000 0 -10}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+11

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	5.002239901486653
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOeJMXGm2OHaBByVn:SlSWB9eg/yRSsDm2OHa7yV
MD5:	08AABA917A8D6B3BB3D0DD1637F5ABFC
SHA1:	D1D704F0250D4CBD450922A02D021E0000FBF5CF
SHA-256:	143528946275DDC8B894218D3F1BE56C950F740828CEC13166C3D7E8E1B6BB7E
SHA-512:	F37AE54864A613C830308CB94AB7CEA9534A86A53B52B4A2C28CEEFE6F5BC0518143AAFD77A6DA5EC55D392F5BD34FCD4B5BE51794B1A386ED783B9BA89C10C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+11) {.. {-9223372036854775808 -39600 0 -11}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+12

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.97889339723103
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDONdNMXGm2OH3FNyUFFv:SlSWB9eg/yRSNDm2OH3XyMv
MD5:	7374B66D6E883D7581E9561C3815EB92
SHA1:	235E96A7420DF6733F3CA368D4A2D57766656043
SHA-256:	A93EAFAC2C1089C608C8536127D0E8B53D8C7CFD13AE7DD69339E12A89F803C6
SHA-512:	9BA59B17F20D65DFF1A5A2D557B535F69B04C172AECB15F88CA3484D74CC7D53894985C08653CF13D868BCBD5E7E5041E0CB2F457B5B603F3851198E552E33A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+12) {.. {-9223372036854775808 -43200 0 -12}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+2

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.922268982357521
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOcF3vFNMXGm2OHnFQVIyV:SlSWB9eg/yRS0fXDm2OHnFQVb
MD5:	FDDC663E40F8FFFE27959E94625725DF
SHA1:	EE3FBC1F6C8BBCF1BDC9E5DB4D2EA1A57E2E9BB3
SHA-256:	AD5833153446960BDE0653A22AE2111BF80CFD61C3010993CE87B81D40C75C72
SHA-512:	A1B2A153834FEAD7DC27C0918E1B1CB905671F82850C1CAAEBD89F5535703FB259F02F699EA7F82F3044E37668EE93DFA4D4EB862CD437AFF0DABA84867B1963
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+2) {.. {-9223372036854775808 -7200 0 -02}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+3

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.949132511023475
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOFfMXGm2OHBFVGAvFv:SlSWB9eg/yRSlDm2OHBFAKV
MD5:	5C6F16F2CFD46030688066F9BFBE675D
SHA1:	1DB5F36584822EB92E75B9AC9F440FD671BD90AE
SHA-256:	C7BEE4C71905EDDB40BAF42C0CD0DC70BB9F298EAAB8B9367D484B8431DD084A
SHA-512:	FFB2C4CD8EA7DE165C3D989454898FF2023D1A1E3B2B34EC23B1B71EFA7BF2538488DA0069E59F1152B8933D2263B762D2D7C56ADBED826C33FC0BA6672E34DB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+3) {.. {-9223372036854775808 -10800 0 -03}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+4

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.971627677226461
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOqJMXGm2OHBvGQy:SlSWB9eg/yRSQDm2OHBON
MD5:	E35244C1A6084C7BC1D79E437677C55C
SHA1:	898619DA4B8B9AC72E69C7BD30DEA2ADEF9440FE
SHA-256:	26D1EF512CC5797FC63BA2B83C7D6271025F4D4F5C904D9FA8E97F053393D9A7
SHA-512:	0687758558C4C5FF7802F3A57212694A1515761A8337D4B75FFE81434D2AD8A221B005DEC36BF013F2FC3DE1E46DFBED36352811EB7C5A5AE3A167A2E314F57C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+4) {.. {-9223372036854775808 -14400 0 -04}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+5

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.956438091983076
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOJNMXGm2OHLVvyV6Aov:SlSWB9eg/yRSDDm2OHLVKVg
MD5:	7C560A0F3C42E399AC1247CB6C516DC6
SHA1:	C314B09D4E369C69C23A8DC1FB066FD0CFDC7211
SHA-256:	054910BDDFC44D9B806BBD3008C30547FA57ECD3C043418C406A725158144688
SHA-512:	FCE8431B759BD5359847734FD98D9D91394916235B2AF587FC927D5F3196FB283E241A6A9200EA852F9265ECEF81402FF6ACD0FA3A4AAEF6DF9DB1B056B3A9EF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+5) {.. {-9223372036854775808 -18000 0 -05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+6

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.974743300958087
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOAkSMXGm2OHvTmULyn:SlSWB9eg/yRSbSDm2OHviX
MD5:	EEB1A3E0FD3339E332587D19C116D4EF
SHA1:	5DBF046031CD354B1EF88E46D3FED74706D21AC6
SHA-256:	D53BB247E0E429A6243AB9A9BDCAE1EE1CF5F271D79748A843631906AB63A988
SHA-512:	07BDF9056DC335C773684E634B1D389FBD139464D4597DE862B7EAC096676A093934682BF911F4E68F299789931218C0E431F0CC6BEBD7275B5FC8015EDD0942
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+6) {.. {-9223372036854775808 -21600 0 -06}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+7

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.930134062078826
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDONeyFNMXGm2OHrXVYVny:SlSWB9eg/yRSNPDm2OHriVy
MD5:	F92B31548D6BF8CCFA326C0CA6E205A0
SHA1:	3FFC6C214EDBCBE9C2509306CE73B429113E1C8A
SHA-256:	6BA5779E35D581B409F53B14B6E28ECC16F536FFEDD45DDBC8DAE4B8C28F66E7
SHA-512:	317872E986099D02AF083397AE936854043D54CEBF45A70672F02DDC9E2F3B27BC3FA80902F9675131C51A09BBD3C2BD1CD437330935CEA113C643769E0DF20C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+7) {.. {-9223372036854775808 -25200 0 -07}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+8

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.915798027862021
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOOF3vXMXGm2OHmFvGpn:SlSWB9eg/yRSqfXDm2OHaOp
MD5:	B31B15E6006F8DF0D7627D6C90FF39AF
SHA1:	7C4137BE11DA84771DF6DC5EBC32D5E5E87E060F
SHA-256:	CA87559B154B165E83482AEE3D753BA8E38ABCA347A005E8504C566433CF4CB3
SHA-512:	220F7E7379EABBC8ACD7ADBB7A4AC8E93E4B268F8F1C0965B7E6A09735EE86E293EF1C492990331EEB4176B8301A91EC20579756B962AE45C858A96C09349CCD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+8) {.. {-9223372036854775808 -28800 0 -08}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT+9

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.95764928386407
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDO3fMXGm2OHNms:SlSWB9eg/yRSPDm2OHNms
MD5:	5B10173EB7119F1219250763504A3526
SHA1:	A845021437C4638079040EF27AEF163C865FF8F8
SHA-256:	A0987A1D078B0993FB3B07208E3F4538A2319DCDDDEB2FAEA32FC463DEAFB8DB
SHA-512:	D213285D0A723B7771263122AFA269C2ABD0325A97D32C3870341255C06597DD6851C22860CFF42BF54E3FF5A36FC88C306F3BF1C69E7BD7FD7F69FE7601ED1A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+9) {.. {-9223372036854775808 -32400 0 -09}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-0

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.898210849752128
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDIyHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRUyJ8RQy
MD5:	5AFB7F12BA056619252D48904523DFA9
SHA1:	CD6E6681C8302BF38095975DF556BD14959FDAC8
SHA-256:	EFF27B3DEE9306641FF344801E06BB33FF768CDCCFE2409FA8AF752FF6D39F66
SHA-512:	2869BB347F42667A3D174816466B15916FC61FCB5A6A1BE1DD750C5C1751602FEE0FE5A27651B7A19C9F6764872DD0F00D3D5AA16CA1A743DBA09646D25A4EB2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT-0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-1

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.979902281541545
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDI/fMXGm2OHMKUrn:SlSWB9eg/yRUXDm2OHtUr
MD5:	4000096844091488200125FC8F50E2F5
SHA1:	9FFEAE66405CFB254180C7DBE185288791DFEE5F
SHA-256:	B4BF883FBE9246EF4079179A746B1F9E59F2C77D4F598794B60732D198DC6044
SHA-512:	25C69E04018C2978A2E5748F0D3C61157453D998C16FA4B3C257A6515B87F5FD2B754893B47604BBC60AB60B60BA162BF2D1463E616E72CB8713C736F1B4D428
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-1) {.. {-9223372036854775808 3600 0 +01}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-10

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.964101313797091
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDINFeyFNMXGm2OHMUUMy:SlSWB9eg/yRUN5XDm2OHXFy
MD5:	AE6601FACF6BE1E68083F8D353901181
SHA1:	8B3BFA307D2A94BADD3A1A5E42545D6F7C620BCE
SHA-256:	EF3046D7789CAE069B5473D053F3EF0157248F8A359A1282EE02BA613A75FC94
SHA-512:	1859E6A2CB94EFEE7CD5C17803AA4F2DEEBE4DCF43D3B1EA737DF00BA86ECEC79D296D75E69D5829DECB48380B6B650724104FFA7959FD18FE032DF7D002A88B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-10) {.. {-9223372036854775808 36000 0 +10}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-11

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	5.00162575418652
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIVSMXGm2OHlVVtyn:SlSWB9eg/yRUVSDm2OHlVLy
MD5:	D864BA451C9E441BF47D233626C57B99
SHA1:	6C38E6F8BA292575C496124572D187F97C9F8E73
SHA-256:	CCDEADBD18BE81E59A669A460A14AFCBFF733C3A5D164FC2B6B93DEAF009B78A
SHA-512:	5C16BD1189F3FE6789CB3630C841FD168EC87D0498EE6FCC4C8D635F8CF4BCAF0558B44F859C37E418F6BC5A7F6693D6EF1DD218A1DB6DA2D54FF55916685119
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-11) {.. {-9223372036854775808 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-12

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.978079707159482
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIjbNMXGm2OHwvv0UIoAov:SlSWB9eg/yRUjJDm2OHwvv0YAov
MD5:	C3E7748C7CB9D8A7F7FA5170D5098983
SHA1:	54F5374A32173BEC6EDA430745DCD18749ABC233
SHA-256:	23B61B18C653E25F7245B0BB6E04AD347E038585B145962FD1EEACE26F118D54
SHA-512:	4783A7CD4C94CCC67C1C71F9C5D9CD99A3918EA4792D8CE2443ACE8F034B9023EBC02405B5DEAB919AA35FD1FD29D8980774316AC96D32ECDEBEFA15BBE6878D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-12) {.. {-9223372036854775808 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-13

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.994320173226919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIaMXGm2OH1dNv7Dy:SlSWB9eg/yRUaDm2OHty
MD5:	224AAAA8A31C283F50149A090E3970D5
SHA1:	E7E4876EC2474FEFD82D4B174CA8E3A3427062F5
SHA-256:	A9F1AD5A7CB5ED43C5E6E8A7A9B887329890ABB75B9FC9483B8543A367457EBE
SHA-512:	6EE0C6F519AAB2DAA3F7D802F0F838BA9F6BF1D56530000D3C9EA4FDA81DCB9832A3285E36208F29EEB23C27EC5BFD3438DC272929A7531268B7C0626A65D6A5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-13) {.. {-9223372036854775808 46800 0 +13}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-14

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.9895752453470585
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIxhfMXGm2OH0FVtXvFv:SlSWB9eg/yRUxJDm2OH8jNv
MD5:	8ADF71739DCADE63433B7BF8321EAC77
SHA1:	AA6BDE83FF0D8BCFDE0426160250F2D17D3AF81D
SHA-256:	A37A7160027BD38356764C4D1AA5B9B17F8D5DC3CFB81EF2ED399E44C41734CE
SHA-512:	AEE3929DE269ADB5265A54841F041E41595359C101539F6309A4E737E3F5DF0BC91560781C7118975398C29A084113682C78F66E07E2E4AC5EAC8DFC33C4F0ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-14) {.. {-9223372036854775808 50400 0 +14}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-2

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.921164129348819
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDInWNMXGm2OH/VXF9:SlSWB9eg/yRUnSDm2OH/Vb
MD5:	CABB864F4E76B90928F5C54CD9334DEB
SHA1:	4818D47F83F16B9F7612D1E979B2440C170ECDB9
SHA-256:	7211BF8329B2388563ED8FA8C5140099A171B8A303A9473E9A6F3AF0C5D239CB
SHA-512:	1FDCB05D675F1D28CB52B9F5EAC7EC52FDF2CE7E7411740A6F8FB5E9D443ED636CE268E3AF9E08605CC3E13A49B2D86FF4EA6A85F518D5C79E263BA94263361D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-2) {.. {-9223372036854775808 7200 0 +02}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-3

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.948161547682094
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIYyXMXGm2OHkNsWYcv:SlSWB9eg/yRUlDm2OHkKWYe
MD5:	4AE5F29A13A86E4A7064E9200668E43B
SHA1:	2460BD1BB0FF3A3C774A5C7CC3DA10235DA06B0D
SHA-256:	BFC86D65B0B94725DCE4C88EDC4300141ABBCA4B6CDECF037C437DF49F0C1D6A
SHA-512:	190DC38B4A20F964C967866507086317D85D979DFCFA415D1569C485C6476024922BC6E7103273C41889D9D7B22E97933F286FCF4D341248077C1BA777D0EE3B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-3) {.. {-9223372036854775808 10800 0 +03}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-4

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.970850637731657
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIQXMXGm2OHkVsRYovV:SlSWB9eg/yRUQXDm2OHkSN
MD5:	BBAF760E27C02D176A675AC3CF2D1E6D
SHA1:	E524FAA7D424A1C1545D1D8EC00169125A68E8E5
SHA-256:	02E2EEAF88EE179EF63DD29ACC7384A4B46DE1E3A151C1F3A5DD31BBB5A05AEE
SHA-512:	6AC7CC0E52E7793C7F2D3DDA9551709DEAE654C1182EAD7108D04F1BAAAB7E1C473B6E8A3A126B0E421D8A246294A03B2EE9E070330924502DF2869CC61C37F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-4) {.. {-9223372036854775808 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-5

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.955530107787899
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDI7tNMXGm2OHM0VQVFv:SlSWB9eg/yRU7PDm2OHnVQVV
MD5:	17F64A5969D3755211E60C0A9F83974F
SHA1:	FEFA84725EFAE6405F43797296C342B974F2D272
SHA-256:	3A2C75DCA11D1167126F0D44A8682420FAF75B0B82B3DCFC35A9F028A9A759E8
SHA-512:	77DBCD8284A470E4869976E2E8A5EDE28104283F120C863785A6B2E64CF87E06243196817C0055A9B32D6FFFE94A25772F67D58BF8E885F7EC06C34FABE38766
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-5) {.. {-9223372036854775808 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-6

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.973993120288556
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIg3fMXGm2OHETNSTVVn:SlSWB9eg/yRUgPDm2OHETMX
MD5:	51CAF7956E133C8A9788AE0B8C6145AB
SHA1:	47F8B49DF9ED477BD95F908693A483AE4FDE881F
SHA-256:	D22C87321373EC0EFB0F312925476CD0747323EF303E17621A871BF814C8ABB1
SHA-512:	EC4B4BE74C1BA64DEC8EF11DAAA338C52BD67D55E8A2352FBC6C83FA142F8DBE424CC1110E9A9D9A891E1E858D1FFA6D1E3B997D41BBB374556FA1F9A708559E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-6) {.. {-9223372036854775808 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-7

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.928999319005163
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIpdNMXGm2OHAXUVSYovV:SlSWB9eg/yRURDm2OHAXUVSYyV
MD5:	56D88B54CA33B43E2E7D3EA6AD3A4D6E
SHA1:	9351E0C001C5D83325281AF54363D76D65548B7D
SHA-256:	70CB3A766A2E84148B68613D68687D263D3592ED4B6E672797FB20801ECA8231
SHA-512:	32B58AD16F64590903C7AB49BA4890DAF6F1F3D33187A7654D3DA88A1C0047483EAA58B2498D824A30116E235FCC8F8FB3FADD57F86396240E5D92B2CA337027
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-7) {.. {-9223372036854775808 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-8

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.9145396982864895
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIlSMXGm2OHN/VsdYLyn:SlSWB9eg/yRUlSDm2OHUp
MD5:	E462AD5E0C046EA6769EDB4B2C80F4D4
SHA1:	6DDB94485648622875E0927BA1E8CFE67CEC1382
SHA-256:	80C85D59416CEC91DB3DAC5FDD2FD7B91D6FC74A37BBBEF6FF58F6F6816E8FC9
SHA-512:	42734FD2DA8BD6E0BC271FF1375A31DEB72EED85AB5EA6E1E0F81EE4E3E7E74380FFC98FAC30409684F736DB580AAAF4F62DB4757AA35C10383584F6144EF363
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-8) {.. {-9223372036854775808 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT-9

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.956751740978211
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIeyXMXGm2OHENScFAy:SlSWB9eg/yRUPDm2OHsScr
MD5:	98F70EC1B1AC7D38CB8D01705FB0CA56
SHA1:	EDAFA132E48935ACEB8E72D3FF463E4FC857C1A9
SHA-256:	57395BB968AFA5A041EADA4B684B82F0379A9333F9522D69F069A79FDEA2B8D7
SHA-512:	97B8D7603D6B54C075B005B905B2A7A28B8BEA67894F055663C44D2BF730BB937AC8EF5B2DF182BDD2D9EFFDBD135DF9467C813AEE39AA6B34256908A12DC011
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-9) {.. {-9223372036854775808 32400 0 +09}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\GMT0

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.886484135647838
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDVMFHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRC1p8RQy
MD5:	F879FB24EA976394B8F4FAF1A9BF268C
SHA1:	903714237EBD395A27EAF00B3DAAA89131267EE5
SHA-256:	AB742F93BE44BD68AB8FE84505FA28120F1808765D9BAED32A3490AF7C83D35B
SHA-512:	F5EE4C331E37036516F2A1BF12F2E088B2E2C7F6475127BF4E7B4937F864550D64D570BC855B6058D4311755E8696EC42095A36AEF13BB29E62192EE0AFB6EAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\Greenwich

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.911342539638601
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRp+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRp6BURQy
MD5:	CDD2DE9CF0FECFEA0CDD32DAC32DCDE2
SHA1:	311CD4C6E819E18BAAACC382F81359BC208E2F73
SHA-256:	F89167B6117838D9679C0397496B6D96D3A7BEAEF0BD99406ABACDBDB658FBCC
SHA-512:	1AF061D07D2F579A089905B6B259AABD7C58F4FA0CD379EE54206164F0DCAEA5C720FB1F5E76F5782F8613E62D8F83BD55F1848D5D7A73D4A5C9F7BC6B9F5DB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/Greenwich) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\UCT

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.838936002050477
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRKh8RFB:SlSWB9vsM3yzTHAIgm6N/yR68RX
MD5:	0587EB7D1B1C684A4A0F90D3CB0959C8
SHA1:	3F2840AE512774494D9A0B6357C52CCB7DBA5265
SHA-256:	0856D14DBBC53D46460BCD530BD070E9E8966D1C96BA01BA556E215A98C09CD4
SHA-512:	DE38EF28893853219AC24AE4A522307ADAA1502F6D0C129219FAD9D75CFCE03A505C3E0758CFF2D2D4F7101414A5F7E4FC1C1B119B667E6A9C89B60DDA641E86
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/UCT) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\UTC

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.903699772785336
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRF3yFNMXGm2OHvL:SlSWB9eg/yR9SDm2OHj
MD5:	3D3F94B6AC5FA232E509356C703D9177
SHA1:	502B8EE9D4A1EA75A91272181AC87B9B6ECE1F84
SHA-256:	4D74D9EC2397B1708FEF47806294B0BCA26679F3A63149AE24E4E0C641976970
SHA-512:	205A761A01C577F602236CB5C9938C834B7F3F9F681B94036B0A86101119893EF87D206D0C3F7737075ED833D4E35E374ACAE6605163E9C37B705D99BEBC928C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/UTC) {.. {-9223372036854775808 0 0 UTC}..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\Universal

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.874807282103623
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRYzXDJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/yRY7VMr8RX
MD5:	65E28EFF342B625E79175793FD38F9FD
SHA1:	08B11474822E670DEAB8F0EA168BAED7D5E3DBE1
SHA-256:	A2B62C5914DE169A68A018A5B47C1253DBCA10A251862D17B0781ECFD19B6192
SHA-512:	79641D0E05F81BFB80034937D34E74B7483A790F33C1F9A0FA92C6A7913AC8C03036CFDEFB43850B84EFB3DD3C4A39022DC8F22E5B5DE6353586A546E03A5789
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Universal) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Etc\Zulu

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.874356623237119
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRaQEBURFB:SlSWB9vsM3yzTHAIgm6N/yRYaRX
MD5:	EDABCAC858EC9632D5D8DCCFB28F4D6E
SHA1:	E5BEF1367A97A1900749CE6B1E01CF32F582BDD9
SHA-256:	BBD6E93206FF3B7017AFBE63905B4C932C422B582F3CE2A79A7B885D390EE555
SHA-512:	3A22364D423F2F970123561408018A2B72F43C4978836D3B6DF7517217445605838DCB8DDBDA204FD01C49A4A7D5ADAD4CA8BDA7C3B412D54750BAEAA589B683
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Zulu) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Amsterdam

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	3.899679308991091
Encrypted:	false
SSDEEP:	96:UvV6eHuZ+y+2KDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:SVJUSs41sFpM5vwA6Efv03TBZLl
MD5:	262A99D2D471F855C2A3C96CACB0C431
SHA1:	2CAC8BFAD1A626A189413203ADA2E2B753A6DA69
SHA-256:	5808F77CAB37ED4F52F0A02FF0B75EA194F8799A2165695CA3650579CAD498D9
SHA-512:	6DC3BD4177292C07390CD0EC2F672FB6846CEEFA1A2C57B2C8E84CE43C90486544350DA998A5E36CA7A02C46859B4183D829B26013E01071014C6E2849D6573C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Amsterdam) {.. {-9223372036854775808 1172 0 LMT}.. {-4260212372 1172 0 AMT}.. {-1693700372 4772 1 NST}.. {-1680484772 1172 0 AMT}.. {-1663453172 4772 1 NST}.. {-1650147572 1172 0 AMT}.. {-1633213172 4772 1 NST}.. {-1617488372 1172 0 AMT}.. {-1601158772 4772 1 NST}.. {-1586038772 1172 0 AMT}.. {-1569709172 4772 1 NST}.. {-1554589172 1172 0 AMT}.. {-1538259572 4772 1 NST}.. {-1523139572 1172 0 AMT}.. {-1507501172 4772 1 NST}.. {-1490566772 1172 0 AMT}.. {-1470176372 4772 1 NST}.. {-1459117172 1172 0 AMT}.. {-1443997172 4772 1 NST}.. {-1427667572 1172 0 AMT}.. {-1406672372 4772 1 NST}.. {-1396217972 1172 0 AMT}.. {-1376950772 4772 1 NST}.. {-1364768372 1172 0 AMT}.. {-1345414772 4772 1 NST}.. {-1333318772 1172 0 AMT}.. {-1313792372 4772 1 NST}.. {-1301264372 1172 0 AMT}.. {-1282256372 4772 1 NST}.. {-1269814772 1172 0 AMT}.. {-12507

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Andorra

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6927
Entropy (8bit):	3.8182041031531897
Encrypted:	false
SSDEEP:	96:CA34elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:CI41sFpM5vwA6Efv03TBZLl
MD5:	D897DCA686A03495EB2C3323FAB0BEAD
SHA1:	1433BC303DE92F7B36F881C8595A42B35E0814FC
SHA-256:	F0B48DA7CA3659450D87CC0DDFDDFD28B464543DF1EE40D935C44D5CD7C9B9B3
SHA-512:	A1C4AE1E0EC26B159B0F5D058A7A77B8774F611A4D3C6AECEDD7186957D6BD9F15CDFCBA248FCC8A4B4146BD72CD7D66B9F88A2BF7CDEF416F1831A2F335D48C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Andorra) {.. {-9223372036854775808 364 0 LMT}.. {-2177453164 0 0 WET}.. {-733881600 3600 0 CET}.. {481078800 7200 0 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0 CET}.. {733280400 7200 1 CEST}.. {749005200 3600 0 CET}.. {764730000 7200 1 CEST}.. {780454800 3600 0 CET}.. {796179600 7200 1 CEST}.. {811904400 3600 0 CET}.. {828234000 7200 1 CEST}.. {846378000 3600 0 CET}.. {859683600 7200 1 CEST}.. {877827600 3600 0 CET}.. {891133200 7200 1 CEST}.. {909277200 3600 0 CET}.. {922582800 7200 1 CEST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Astrakhan

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2063
Entropy (8bit):	3.679377249443024
Encrypted:	false
SSDEEP:	48:TvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDOP:rCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
MD5:	CB860328FA96A14055BF51A3B2D35A08
SHA1:	CFA49DC861F4AC3D29A78D63D71C2D6D83D68F84
SHA-256:	4B5FB0AF225974D117374028285F20A02B833FF4136E6BFAE7B65E6D6D28829E
SHA-512:	960152826F4245012462E53F80B69B0C45C27D75D46C70D485674CA19071DF268671C7691B614BE53B9E7BD8CFEC5D24F3DCF933F2F14D827F2A32EB347D7540
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Astrakhan) {.. {-9223372036854775808 11532 0 LMT}.. {-1441249932 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Athens

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7954
Entropy (8bit):	3.7252594544513795
Encrypted:	false
SSDEEP:	96:1D/8QdzFu+f+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:Z/8ohvyDjivBeRF+W35Syrwl9h5j
MD5:	8B2C99E1CD04D7559709FDF8D382343C
SHA1:	C595D5159C742B815AF89EC8604376E01291F9F1
SHA-256:	47353319419505AAB205C23F8C97EA0B12E5DED2113147794F77B67349AFF52F
SHA-512:	227CA21A3B6160357988582E261A62AE7B09D46D479EABFAC8039185D710EFA765CD1694F4388EBF8800978A1E1DB69F6AF9BB9BF82C0FCD66E883930E1F8249
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Athens) {.. {-9223372036854775808 5692 0 LMT}.. {-2344642492 5692 0 AMT}.. {-1686101632 7200 0 EET}.. {-1182996000 10800 1 EEST}.. {-1178161200 7200 0 EET}.. {-906861600 10800 1 EEST}.. {-904878000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844477200 7200 1 CEST}.. {-828237600 3600 0 CET}.. {-812422800 7200 0 EET}.. {-552362400 10800 1 EEST}.. {-541652400 7200 0 EET}.. {166485600 10800 1 EEST}.. {186184800 7200 0 EET}.. {198028800 10800 1 EEST}.. {213753600 7200 0 EET}.. {228873600 10800 1 EEST}.. {244080000 7200 0 EET}.. {260323200 10800 1 EEST}.. {275446800 7200 0 EET}.. {291798000 10800 1 EEST}.. {307407600 7200 0 EET}.. {323388000 10800 1 EEST}.. {338936400 7200 0 EET}.. {347148000 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Belfast

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.876296755647751
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQahs3QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/y72
MD5:	7160C6EE32380846653F016AE8AFD52A
SHA1:	DE7805089639C54893F2107FA67342DA72A79BBC
SHA-256:	557023674F6E8376707517103EE69C1DEBBE53CDD4BCAB11E763CC53B9CB1908
SHA-512:	FDBDECBBDB0C419226E2604608FD2923CFB06E4B6948493208FD83FD796880E81F6147C0FAFEB572079C9C916831B7B055620EC939164CCA1DAF76897BE60F2C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Belfast) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Belgrade

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7309
Entropy (8bit):	3.8204712502914653
Encrypted:	false
SSDEEP:	96:lp+/4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:lY41sFpM5vwA6Efv03TBZLl
MD5:	02A003411B61A311896A6407B622152A
SHA1:	3B8BC6D1AF698CE7BB14A08307F5A4295EB8ED03
SHA-256:	74B225511B518B0CED972CBB33D694697712CCB96A6D81E0F50ADA28CF6E2C92
SHA-512:	9E03B3EB1E528E5B1ADBA09F808E73BF9C4314EDCBF6F96E46844D51A5F425BED3EE8FD5BA8706C46A7FB9882485F119F81996F2EAB7E1E9B598978C402DDE0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Belgrade) {.. {-9223372036854775808 4920 0 LMT}.. {-2713915320 3600 0 CET}.. {-905824800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-777942000 7200 1 CEST}.. {-766623600 3600 0 CET}.. {407199600 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 360

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Berlin

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8020
Entropy (8bit):	3.820756136386754
Encrypted:	false
SSDEEP:	96:Pi9+qFR274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:PQs41sFpM5vwA6Efv03TBZLl
MD5:	84027C3C8315BD479B38DE11F38E873F
SHA1:	6E92A2A9734A9C6B02ECCD99F114D667C909C5BA
SHA-256:	7E7111F06288069B52A4E1CA0B016216DF9328FB3B1560A740146497CCDD4D24
SHA-512:	5FFDE523021FC0C490261F55999204C9CE6C8C274888525EA6EE7C01BC5CCABC7A3877FD454B4167D81F4B89BACB087E8BA6AB0BAC46C2874ED9257BE2092340
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Berlin) {.. {-9223372036854775808 3208 0 LMT}.. {-2422054408 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-776559600 10800 0 CEMT}.. {-765936000 7200 1 CEST}.. {-761180400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717631200 7200 1 CEST}.. {-714610800 10800 1 CEMT}.. {-710380800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Bratislava

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.943205109348136
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVtXrAeovXHAIgoquXrsY6RL/yQahcvEB5yQazXrH:SlSWB9vsM3ymzbAeSHAIgozbsY6N/y7c
MD5:	C69AB60BE74D4BB7E31BE4E5ECCD8FD2
SHA1:	9DD0BA6171080F074858EF88ADA2E91C1F465619
SHA-256:	1D7C539AAA1E3AD5EF3574A629523B5B781F1A91D352C9B39B8DE7316756026E
SHA-512:	C273B97CCFB5F328EB7A13CCA3126DE8D91B3876CBD248990C0BE063DDBE5B0F31EA138E31A1C5C43B1ABCF42EA511448E6DC589EB99E8172D7C2A68BA31A8E7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Prague)]} {.. LoadTimeZoneFile Europe/Prague..}..set TZData(:Europe/Bratislava) $TZData(:Europe/Prague)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Brussels

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9223
Entropy (8bit):	3.8450929464870804
Encrypted:	false
SSDEEP:	96:RhcSQnG1Czyc1+FdDKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcM:Rh8zyc4Ss41sFpM5vwA6Efv03TBZLl
MD5:	E6C1153C3F71C8C005D7A46DDF6461FB
SHA1:	CBDF7D5D36AF57D83859C910B493464617EC9571
SHA-256:	1402A2072ADC9EBB35F4C0368D2E9A7A11493626C667C022614FFB7CC05B6CB6
SHA-512:	8B1B47678F75DBE59DB08E034F0701BD11FF4FD3AD0304C8ABF45E848F717D2787B8E47558D3C334D369E0938C633DC217178D3EAE6486CEFBE25CF1668479F6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Brussels) {.. {-9223372036854775808 1050 0 LMT}.. {-2840141850 1050 0 BMT}.. {-2450995200 0 0 WET}.. {-1740355200 3600 0 CET}.. {-1693702800 7200 0 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1613826000 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585530000 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301263200 0 0 WET}.. {

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Bucharest

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7974
Entropy (8bit):	3.7264631277913853
Encrypted:	false
SSDEEP:	96:vMSsQMAz5CXNU5paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:vMS1kdUoivBeRF+W35Syrwl9h5j
MD5:	88DB5686937D3499A8142413B2CF2EB5
SHA1:	E37BAD2127553600D0E38A43053D1B07B2498DA8
SHA-256:	C560D45104A8DD73FC7370B5AC1615E22043DBC93DFB46A9ECC6468C2D38B19A
SHA-512:	375B8A63CFF2E278CD8C78BF9DBC86288FFB1AD57DAED00CD2199F0B05F4FBFA7D17D93C6458B20B86F6D05F3E3A49D594E60AC97DDB47141E21D7CDE10F8456
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Bucharest) {.. {-9223372036854775808 6264 0 LMT}.. {-2469404664 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {296604000 10800 1 EEST}.. {307486800 7200 0 EET}.. {323816400 10800 1 EEST}.. {338940000 7200 0 EET}.. {354672000 10800 0 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Budapest

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8287
Entropy (8bit):	3.8244305880244567
Encrypted:	false
SSDEEP:	96:rHw0+D5xp4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:rQXj41sFpM5vwA6Efv03TBZLl
MD5:	11468F958796F971ADD5FB1A0C426D78
SHA1:	3FA58BEF391BCF7BAC6A124D093B6505B4EAC452
SHA-256:	B58F3E9066B8B57EB037D509636AA67A06ACC8348BE6C48482D87CDC49844A4E
SHA-512:	0492EABD6EE16392C00A196AF38995E5F9E55E30A82A50EFFB381DC978E9E63E801555CDC219869E6251BD51115972F742D8A7D9524372B8B11702AE4B28BFB7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Budapest) {.. {-9223372036854775808 4580 0 LMT}.. {-2498260580 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1640998800 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1600470000 7200 1 CEST}.. {-1587250800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555196400 3600 0 CET}.. {-906775200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-778471200 7200 1 CEST}.. {-762656400 3600 0 CET}.. {-749689200 7200 1 CEST}.. {-733276800 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-686185200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-492656400 7

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Busingen

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.952483060656419
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQahDZALMFB5h8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/y7D17/f
MD5:	CED145F8D9B231234E021D2214C1064B
SHA1:	7B111DC24CA01C78A382CECD3247CF495D71CD34
SHA-256:	F511A80AB70FF93A0EB9F29293F73DF952B773BB33EB85D581E4FB1FE06E4F05
SHA-512:	E2323C04BF99909ABA9A09A66F9B4696519B5F9FE3AF178FB04D5E0053F41CAA8B937DC4148954ED093D317F454E0547786BEC934F2ABF22A60AAA6A24E63BF9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Busingen) $TZData(:Europe/Zurich)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Chisinau

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8096
Entropy (8bit):	3.7635458172251406
Encrypted:	false
SSDEEP:	96:jXSsijEpkv2XkN8qc/OyEie8hF5WQ9VX/Zs1cw27oXqdCA5XqjqFLigTE9s5VpJ:jXS+WeUqKie8hF5f9PwdXM9
MD5:	E7F52393523729CA3916768B3F3B4E55
SHA1:	1524A3E610DCD33AC0006946BAB2929CA7F5A33F
SHA-256:	2BD1C0AB412A5E9C97F533C4D06B773D045215B92568A4E89ADC93C7462D62EC
SHA-512:	218674ECD9FD6C1A1C83EE69AFE6AA5AD0D5A8BB59FF497FDF2573B7CF52DAE98ECE0815CF99668CA4E172FF67D220B227369865076333B3EE802A8839C65279
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Chisinau) {.. {-9223372036854775808 6920 0 LMT}.. {-2840147720 6900 0 CMT}.. {-1637114100 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {-927165600 10800 1 EEST}.. {-898138800 7200 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-800154000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Copenhagen

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7722
Entropy (8bit):	3.8237774522471564
Encrypted:	false
SSDEEP:	96:vFKb+vS74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOR:vFKX41sFpM5vwA6Efv03TBZLl
MD5:	F9BC892F4BAE6712718C75AA5A07E1C7
SHA1:	D7BDB30B9E10A7B6FABB5A257F9F6C538C1E3371
SHA-256:	C6ABC78AD0F03F903E04DB41067B555F9E589E321E253A01ED819189C6FFFC0E
SHA-512:	A8F8BF7ED070A5DA021BC0A5F87003B7DE433EA66B38A09CA6BDC5F4DC964D35758AE325B0687694AA5F712EF563D1EB8444D11CBDD8332457AB8BBFF8602363
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Copenhagen) {.. {-9223372036854775808 3020 0 LMT}.. {-2524524620 3020 0 CMT}.. {-2398294220 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680490800 3600 0 CET}.. {-935110800 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-769388400 3600 0 CET}.. {-747010800 7200 1 CEST}.. {-736383600 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-706748400 3600 0 CET}.. {-683161200 7200 1 CEST}.. {-675298800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Dublin

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9810
Entropy (8bit):	3.7669748644882417
Encrypted:	false
SSDEEP:	192:fbxxHZiMU8EKTy74jT56XdEN1+UZBdMN186LPR:fbzZiMUZ6y0jT5bZHMN186LPR
MD5:	726F01B47BB99952639200AB73E29425
SHA1:	FF38CF353CE007BE871A27DDF836D198D21F167F
SHA-256:	930F4E37B6D60B6701CBA95EEA1F6053D85E5F9DE6BBE287A0D43E24B9D63FB0
SHA-512:	CF3567BCB23C75527F154C987FAFAD09A5E84E0745A3DB55D268688E5BB37D4E17E2D71EF608FA9C1CA99066BD384108AB9F8C7AD5CAC9A95BC6A541B0135699
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Dublin) {.. {-9223372036854775808 -1500 0 LMT}.. {-2821649700 -1521 0 DMT}.. {-1691962479 2079 1 IST}.. {-1680471279 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1517011200 0 0 IST}.. {-1507500000 3600 1 IST}.. {-1490565600 0 0 IST}.. {-1473631200 3600 1 IST}.. {-1460930400 0 0 IST}.. {-1442786400 3600 1 IST}.. {-1428876000 0 0 IST}.. {-1410732000 3600 1 IST}.. {-1396216800 0 0 IST}.. {-1379282400 3600 1 IST}.. {-1364767200 0 0 IST}.. {-1348437600 3600 1 IST}.. {-1333317600 0 0 IST}.. {-1315778400 3600 1 IST}.. {-1301263200 0 0 IST}.. {-1284328800 3600 1 IST}.. {-1269813600 0 0 IST}.. {-1253484000 3600 1 IST

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Gibraltar

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9509
Entropy (8bit):	3.8837074152297704
Encrypted:	false
SSDEEP:	96:QTOKVA1oCobz0W4x2+ZE74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNA:QyoCvTZ641sFpM5vwA6Efv03TBZLl
MD5:	D04F8EDDA1C3611692FB91E317CCADFE
SHA1:	1C483FC95459EC6F1D5FE4DD275879A9EBCA1718
SHA-256:	0524A31131405347C1D5D86C5EE38A2064AB055C030AB3B43F25DB3B28FFD8D2
SHA-512:	4E2E18EBDE2765F2251B1FE41EF8E6AC79875617348974A28619F5E59EC0467239C682CCE8DEBD7A698BE2F00252C77D1F7FA50B6CAFF920B3BE53A0B836F815
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Gibraltar) {.. {-9223372036854775808 -1284 0 LMT}.. {-2821649916 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Guernsey

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.879252060643389
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQakQAL/yQavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yYU
MD5:	07AF23DA01CB963EA9E57534E34E7704
SHA1:	1C4A214FF3B722E80C0ECACA0FFD5DFF302F6AE9
SHA-256:	F7046808A8E80B7AE449D1A49AE3E480096736B7D3F554A240C7DFB10F82076A
SHA-512:	713860D340C0EBA5EEF873ECB9B28CCDE9BFAD31B6A8626EF507E96585F5CC1091BF8D8A2DB7E5CB532E44F4561FBAE1797141724EF934755B69919FEA09A78A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Guernsey) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Helsinki

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	3.7258352536809705
Encrypted:	false
SSDEEP:	96:OsR0uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hzj:OkyDjivBeRF+W35Syrwl9h5j
MD5:	7FF902B06FA79F14553670A70E77FF8C
SHA1:	0105051541F38956EA6192BD0C7ED4047668005E
SHA-256:	5B5C0A9261A414EA8DC34F594EE05BEE16F695488B230857D2B569A6B603BC39
SHA-512:	551940199783A0FF9D73695B77B10300644F50E91D6B02FE79BB0CD4B78C7BA88CCE56F4B9408EC146361BF408F52D01A1F435183360C801EA5E219FB718247F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Helsinki) {.. {-9223372036854775808 5989 0 LMT}.. {-2890258789 5989 0 HMT}.. {-1535938789 7200 0 EET}.. {-875671200 10800 1 EEST}.. {-859773600 7200 0 EET}.. {354672000 10800 1 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {410220000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 EEST}.. {717555600 7200 0 EET}.. {733280400 10800 1 EEST}.. {749

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Isle_of_Man

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.914274131294981
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQaqpfioxp8QavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/ycS
MD5:	F9A0F19FAF3131D8A70C50FF21B365B7
SHA1:	7FC2B5302FAD06BC4C633CD22A80A7D40073FFF8
SHA-256:	2F1151B0528A5325443379D4E7CCE32C00213722AD9DF764E1DC90198084B076
SHA-512:	6D04DF4480FE132A6641C4BF7E01936E2E4A71A3A6C2AB9F7DA7A9D8A4B836BC66EE2BB597B8C318D07A06F72C05B07E6785B53308ED9BC1103AE6DBDD0FF24E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Istanbul

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	3.814835316757376
Encrypted:	false
SSDEEP:	48:Qi0p05zvSPBUUl0ZFzo4ay0CREDcxn6nH78BV0QbCgkCPviiM0H7hdli80+j7x9L:Qiq66OFEIFMssCfMsXV3heM2MRlA0
MD5:	A8256656B971F58CB991BC270BF93B26
SHA1:	189796E1B8E29A7A7B8B0E143DD9B44BAF217AB2
SHA-256:	08061A80FC0F1EF375EEFE784EACDF0812E289FD67E8613BDEC36209985CA1D7
SHA-512:	1F11308B5BAC1F3DB75CAC7322BBEA6E51C6B4A2A3450F1DB84DE6AA127F0F1BAA7DAB409FAF1288C100BDA77DA6FA1C6E3C0BA962F9406D1445D7C9E2AA3A60
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Istanbul) {.. {-9223372036854775808 6952 0 LMT}.. {-2840147752 7016 0 IMT}.. {-1869875816 7200 0 EET}.. {-1693706400 10800 1 EEST}.. {-1680490800 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1440208800 10800 1 EEST}.. {-1428030000 7200 0 EET}.. {-1409709600 10800 1 EEST}.. {-1396494000 7200 0 EET}.. {-931053600 10800 1 EEST}.. {-922676400 7200 0 EET}.. {-917834400 10800 1 EEST}.. {-892436400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-764737200 7200 0 EET}.. {-744343200 10800 1 EEST}.. {-733806000 7200 0 EET}.. {-716436000 10800 1 EEST}.. {-701924400 7200 0 EET}.. {-684986400 10800 1 EEST}.. {-670474800 7200 0 EET}.. {-654141600 10800 1 EEST}.. {-639025200 7200 0 EET}.. {-622087200 10800 1 EEST}.

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Jersey

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.8801202136140915
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQap6cEBx/yQavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yzx
MD5:	FE10770868A75F4F8D76C5E23D99AA81
SHA1:	30AC768BA47AF7A53831F5142B58ECEC41933621
SHA-256:	97EB33915ED7C9C34144F8F42357FAB2262B3CD45287F3CFFD26C33D65F7651E
SHA-512:	1D82DF45AB0CCDFBFAD0431C668794996E01776800F34DD4131C5287D37291657A749D497AA5B0AB81CAFF3190896633FBFF456BFFEB7E93A3420AA841E54842
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Jersey) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Kaliningrad

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	3.941165221943348
Encrypted:	false
SSDEEP:	48:coNlj+X2uxhuHJkw0QqXknzaVV04v3TfdGY3kNmneVuNlh000sGpdh:coN9+1EpkwCXkSV3A8qc0
MD5:	104CCB93300F40BAF8F4D7CC882EFC05
SHA1:	EA83F3C3791BD6F083844939DC405B248E738FE3
SHA-256:	2387D26DF5429DF9867F42F7D4F872DC146643B4B3CC57DA7298C18561DE8BFE
SHA-512:	12724C5BBEE0835626A98B66BF55C3DF1311F07018C70D76FC5C50E7E7BA5C4A9F064D9EDC376CC3B06C4FFFECA3FAF5B66948615A03DFECA7C361E326D950EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kaliningrad) {.. {-9223372036854775808 4920 0 LMT}.. {-2422056120 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780368400 7200 0 EET}.. {-778730400 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-749095200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Kiev

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7453
Entropy (8bit):	3.762620506765216
Encrypted:	false
SSDEEP:	96:j3C1LyEpkvIpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:j3C9VWdivBeRF+W35Syrwl9h5j
MD5:	1F0C92A6E5C6BAD82AD7E35814ACC388
SHA1:	F29C94DF4EE211481051186BBE5CD77EEDC6C33F
SHA-256:	08B137B7B933393F8F4574615A370013288E5297937B5C59D4179744273FAB26
SHA-512:	88E8B89439022D219D752340E28C21E461D8E288DA135DA4765C87037B610515E6D9E1B716707025B5BAE652FA2F2A89577949C8A923E5C8667AA6CB5C1BAD7A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kiev) {.. {-9223372036854775808 7324 0 LMT}.. {-2840148124 7324 0 KMT}.. {-1441159324 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-892522800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-825382800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {646786800 10800 1 EEST}.. {686102400 7200 0 EET}.. {701820000 10800 1 EEST}.. {7175

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Kirov

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2029
Entropy (8bit):	3.668326642402654
Encrypted:	false
SSDEEP:	48:FFvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDM:FhCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
MD5:	57BB199152815B12FE4491C92FE25186
SHA1:	7BC5ECDE9EFADE812AF40CB92CCE5323FB57C78D
SHA-256:	60884D4B8B17A9AB8FB5697DA95F62E570755348109C661D783D56CD047BBE9E
SHA-512:	2043FDBA860E8F6578F7E26A80C7787B82C7D15188327923EC36D153FDF9BEEAE063012ACE4309B76DB9DBA2DFFB7404DE370BA85023CCE93159FCAD3B9B92B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kirov) {.. {-9223372036854775808 11928 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {78044

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Lisbon

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9878
Entropy (8bit):	3.8275310275285723
Encrypted:	false
SSDEEP:	192:j76abXsyZLEjx82YbtIaFF1w0us4qE3+sSGjT:j77bXsyZLEjx82atysLE3+sSGjT
MD5:	0DA331C2A815739E6758797BD24554EA
SHA1:	3829C441E908BEFDC4ED6AB65FD4ACD0C97D5E1B
SHA-256:	9FAC9812411F88014779D34722F3E0D2750E45BF21595DF1AE14CB9CCFD3F33F
SHA-512:	FEBBA05F64AC1F3066AF6351493DD89768154FD171D447503DAEDB90D16858BEDBCE4A74E24AC0C37B5FF191692AF44AADDE4A92E752F88C48DA646352AD9A0B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Lisbon) {.. {-9223372036854775808 -2205 0 LMT}.. {-2713908195 -2205 0 LMT}.. {-1830384000 0 0 WET}.. {-1689555600 3600 1 WEST}.. {-1677801600 0 0 WET}.. {-1667437200 3600 1 WEST}.. {-1647738000 0 0 WET}.. {-1635814800 3600 1 WEST}.. {-1616202000 0 0 WET}.. {-1604365200 3600 1 WEST}.. {-1584666000 0 0 WET}.. {-1572742800 3600 1 WEST}.. {-1553043600 0 0 WET}.. {-1541206800 3600 1 WEST}.. {-1521507600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1426813200 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1221440400 3600 1 WEST}.. {-1206925200 0 0 WET}.. {-1191200400 3600 1 WEST}.. {-1175475600 0 0 WET}.. {-1127696400 3600 1 WEST}.. {-1111971600 0 0 WET}.. {-1096851

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Ljubljana

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.948438246006353
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQavPSJ5Qahs0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNl
MD5:	56C6C95484FEAF9BAF755683E7417B58
SHA1:	A43176BEBC5B4D7144A7E1109E0AAEFD95C21EC6
SHA-256:	713A842197516D618F2D86977262542A1CA334D7DF6026539FA2F2980DBF4CD3
SHA-512:	566B6DF2D76A8A4D3405C4785C7A471A23D65CD8838831BD0DEDF5BF194E8A3B304CA9920CB4A8EC9D6CD60EAA9BE0335E38D9547A4D23C7E4E5E5A39A09DDAC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\London

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10211
Entropy (8bit):	3.826887992237191
Encrypted:	false
SSDEEP:	192:GNoCvTZtcf80KYiK3BG0Myj9TYQOeMAwbccM0Fp:GNNTZtcf15iOBG08eNwbccM0Fp
MD5:	0625C99E16D3C956DED1C0C0F867DEC3
SHA1:	6ACDF0DB619B63E21EC89046B9320A85FBD3397A
SHA-256:	D04C4E25DF4DE1C1CFE1EF84B3B6DD746CF08A271AB0958F22C7D580A3ED10E6
SHA-512:	07AC42F0635DF01CC0AFD13F9668B143D4943BA0E4C377D254B5AF034D9DDBAB77BA813187E9AB73D2EEAD86EBAA26DC15599FD74FC82EEF287F5A6AB9C01635
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/London) {.. {-9223372036854775808 -75 0 LMT}.. {-3852662325 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Luxembourg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9139
Entropy (8bit):	3.8497931755359303
Encrypted:	false
SSDEEP:	96:TkR06ZldaKsc1+FpbdKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiT1:wxRscASs41sFpM5vwA6Efv03TBZLl
MD5:	789594ED1BB0EDA605DFB567C1E7FE9E
SHA1:	66C7116CCBED0917A429BB277CF4E0B3361A5B41
SHA-256:	380E49D38F6ABE946A90A9343A277ED28492EB800747D6D14F4639FD3EA80EDE
SHA-512:	62CC68E72E79B7A377EAFE92B64D829CD5B9651FCA6782DEF4886C91BB9DF5FCFCD0CF8C5C7628F49E8C523A4AF917DA2745ABA56107683CA014C3E0254E780E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Luxembourg) {.. {-9223372036854775808 1476 0 LMT}.. {-2069713476 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1662343200 7200 1 CEST}.. {-1650157200 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1612659600 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585519200 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552258800 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520550000 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490572800 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459119600 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1411866000 3600 1 WEST}.. {-1396224000 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269813600 0 0 WET}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Madrid

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8517
Entropy (8bit):	3.8326167134909177
Encrypted:	false
SSDEEP:	96:k5m01LdXKc0TJp+bwS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:+DaNVLSs41sFpM5vwA6Efv03TBZLl
MD5:	63263380F57B756A1DFA3796E4188CD3
SHA1:	8EEE707AC4FEA1C098C81AC2D289A46239121A5E
SHA-256:	5337C9843C56DEEC6B91C4468C76EC1C896E80421B72B583B69DE5579063E09A
SHA-512:	ACA4830020715C471741E27EB2292ACF002D2CD7EDCD1061978B64967EB447F61AA095F960D8A75A01B9B87558D83FF409F30BDACA83E063024F1E2381FA64C4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Madrid) {.. {-9223372036854775808 -884 0 LMT}.. {-2177452800 0 0 WET}.. {-1631926800 3600 1 WEST}.. {-1616889600 0 0 WET}.. {-1601168400 3600 1 WEST}.. {-1585353600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269820800 0 0 WET}.. {-1026954000 3600 1 WEST}.. {-1017619200 0 0 WET}.. {-1001898000 3600 1 WEST}.. {-999482400 7200 1 WEMT}.. {-986090400 3600 1 WEST}.. {-954115200 0 0 WET}.. {-940208400 3600 0 CET}.. {-873079200 7200 1 CEST}.. {-862621200 3600 0 CET}.. {-842839200 7200 1 CEST}.. {-828320400 3600 0 CET}.. {-811389600 7200 1 CEST}.. {-796870800 3600 0 CET}.. {-779940000 7200 1 CEST}.. {-765421200 3600 0 CET}.. {-74849

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Malta

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8724
Entropy (8bit):	3.816380386871747
Encrypted:	false
SSDEEP:	96:KAGvi2GmkwwnpH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZN:KLsww141sFpM5vwA6Efv03TBZLl
MD5:	9B09D6EED8F23BAFFB62929C0115E852
SHA1:	4AEF15333C73C2836C09D818FD0E20440D7C4780
SHA-256:	C5C240BAAECE8235D1FBDD251C1A67CB2D2FC8195DD5BBE37FF9CFF0445FCDA2
SHA-512:	43AA3492BD335A290C6EFEE275B47EA18E544199E37A9BBAE2E350D42BDFF42F0E9ED461A4BB1824CA33F84A90D4060906844A3E22DA49C9821E4CB460832D6E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Malta) {.. {-9223372036854775808 3484 0 LMT}.. {-2403478684 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812588400 7200 1 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 3600 0 CET}.. {-81997200 7200 1 CEST}.. {-71715600 3600 0 CET}.. {-50547600 7200 1

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Mariehamn

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.959733196757503
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV1AYKjG5XHAIgoq2AYKjo0ARL/yQausWILMFJ8QaC:SlSWB9vsM3ymrAdjGJHAIgorAdjo0ANn
MD5:	C1844961691214F6E6DF6487788A7758
SHA1:	6D08E9FB7B8602A80622148BFACD9676F45F0E2B
SHA-256:	6136C3CFA4A767E7C9DDA23A283AD98B72E9868F192E6A8E3BFE6396F6989BD1
SHA-512:	B2D1EA51AC5B34792AC02820A9D60FD41F3B91AB6505896476FCB0DC339B8DC1DE9E2C89A7627F69E16247661AE8040D789FFD2F8F1CD59F243B57C4845B450F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Helsinki)]} {.. LoadTimeZoneFile Europe/Helsinki..}..set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Minsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	3.9354590900153172
Encrypted:	false
SSDEEP:	48:K8cVnR7xhuHJkminzaVV04v3TfdGY3kNmneVuNlh000sGpde:5mnRtEpkmiSV3A8qcN
MD5:	9C10EAE9FA0DE192C5FD4F76E12606F0
SHA1:	AFD5650410EC3E6ED564A8B2ABF91709D090B4AD
SHA-256:	8C95EA696EA578DEF726502AC181AF475A676030878F56B4E2D667757BBD1C49
SHA-512:	3B9ED6B68858485B9A46A0863B7D9D3C1E4C5BBA269457F24A9A12C274F0F9B35E63D8C25EB53E7200DB57DD35ACCB7FD7D8AB005FEE2C4D7FC6E72E8CF57194
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Minsk) {.. {-9223372036854775808 6616 0 LMT}.. {-2840147416 6600 0 MMT}.. {-1441158600 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-899780400 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-804646800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {670374000 7200 0 EEMMTT}.. {670377600 10800 1 EEST}.. {

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Monaco

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9186
Entropy (8bit):	3.856050322706834
Encrypted:	false
SSDEEP:	96:2d4STO1C+4qoM9JfKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcot:wvp+hSs41sFpM5vwA6Efv03TBZLl
MD5:	859DF194457CED25EA3EC247CDEA5025
SHA1:	970579F53446EBE50438CC3582D88094C7D7DEEB
SHA-256:	654B92E8B9E8FBDC967D094B48110908F458454D7057F680AC745B9C8D48FCC1
SHA-512:	3E589FC8CA5E0B0F7F6F17A6983813460AB7E07B9B631D8380836F00A8288FF80650D4139B2A6DEDFF245DE571C7726E087DFF3E6F5F9E7E9C9DFE72B839DC7A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Monaco) {.. {-9223372036854775808 1772 0 LMT}.. {-2448318572 561 0 PMT}.. {-1854403761 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Moscow

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	3.942836780611272
Encrypted:	false
SSDEEP:	48:7fnjazk7e+LxhuHJkvVineTeCTU50x0Y7:7fnjazk7eoEpkvVieTeCTUax0Y7
MD5:	4547D47E9364ACAFB2A4BEE52D04BFBB
SHA1:	1E7F964692F81D49AEAF581FE70AD22D4E36226B
SHA-256:	31F9C3C2F17B3EE4FA6D9EE6A86BF407AC0377DE4D666C65E86CE5AC591F829F
SHA-512:	7F1D7C80A1BF611D5440EEF9085DA6CDED86B5EF4C2737C105640030E5AA998A0951182E72DC224190A25DA8846CDE856A78EBAA8876AA0B18B1CBCADBB060FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Moscow) {.. {-9223372036854775808 9017 0 LMT}.. {-2840149817 9017 0 MMT}.. {-1688265017 9079 0 MMT}.. {-1656819079 12679 1 MST}.. {-1641353479 9079 0 MMT}.. {-1627965079 16279 1 MDST}.. {-1618716679 12679 1 MST}.. {-1596429079 16279 1 MDST}.. {-1593820800 14400 0 MSD}.. {-1589860800 10800 0 MSK}.. {-1542427200 14400 1 MSD}.. {-1539493200 18000 1 +05}.. {-1525323600 14400 1 MSD}.. {-1491188400 7200 0 EET}.. {-1247536800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Nicosia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.7873368289068905
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq85GKLlXHAIgNwMGKLZRRL/yQatHefeWFKYGKL8n:SlSWB9vsM3yZdL1HAIgGMdLZRN/y3HeA
MD5:	BE82205480617CF07F76BA0DF06C95BC
SHA1:	46D2D8D9FE4FB570C2A09BC809B02C8960F9601F
SHA-256:	FC93B7516933EDFDC211AC0822EE88BF7ACAD1C58A0643B15294F82EB0F14414
SHA-512:	F490A70053A6011D80FB0A4E96D2871BFEEB168690E21C4EC31F2F5C0E24A67C706528C81322A1D48E71242F0FFA277550192925FDE5B1F34BFCB308290E11FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Nicosia)]} {.. LoadTimeZoneFile Asia/Nicosia..}..set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Oslo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7922
Entropy (8bit):	3.818430983275607
Encrypted:	false
SSDEEP:	96:MC+4twRQqvSO774elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:MXRQqvSOv41sFpM5vwA6Efv03TBZLl
MD5:	9923D3F3C50D2BD96BD36558FBCD8E92
SHA1:	56584B8B9CB27B0ADCAD490C029EE58308C4D7C5
SHA-256:	5A28B5CEC79B57D4856E3F05615245E6F74DF6388B48BF3F605B792CA3BD972D
SHA-512:	1FA928EA5F468F2B4AA40B6B73CE6E42267832413B333C399431FE08C6CB4FD4BDD7E3DB15682C76E5EDEB5849224F1EE5B9667E68A8C5C89AF09B075E4F7755
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Oslo) {.. {-9223372036854775808 2580 0 LMT}.. {-2366757780 3600 0 CET}.. {-1691884800 7200 1 CEST}.. {-1680573600 3600 0 CET}.. {-927511200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-340844400 7200 1 CEST}.. {-324514800 3600 0 CET}.. {-308790000 7200 1 CEST}.. {-293065200 3600 0 CET}.. {-277340400 7200 1 CEST}.. {-261615600 3600 0 CET}.. {-245890800 7200 1 CEST}.. {-230166000 3600 0 CET}.. {-214441200 7200 1 CEST}.. {-198716400 3600 0 CET}.. {-182991600 7200 1 CEST}.. {-166662000 3600 0 CET}.. {-147913200 7200 1 CEST}.. {-135212400 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Paris

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9152
Entropy (8bit):	3.8506895725632746
Encrypted:	false
SSDEEP:	96:fySTO1C+4qoMYOKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdi:fdp+3Ss41sFpM5vwA6Efv03TBZLl
MD5:	9CAF8C5C5AF630E7F782C0480DD786E7
SHA1:	9FBEF9EEDD8BAFB48B17E3AC388CFEF8DCD10CB0
SHA-256:	AE61491C4A587F56426A9F2118E31060276F2B0231E750C461781577551CA196
SHA-512:	F809744BB597184A2815758A27B6A07C515C65DB96CFFB3625FD059DEBBF05EE903E999483B3459C7C8D3991824746F8530CD1378F8A63B1F54F60CFACE9F89B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Paris) {.. {-9223372036854775808 561 0 LMT}.. {-2486592561 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800 3

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Podgorica

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.910162937111088
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQazKIGl1/yQ0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNK
MD5:	52C36955D6BD1D9FE9CB64822D04B6DB
SHA1:	D5FF82EC486409E6FB314AD5ACE608577C9632CF
SHA-256:	B87630FF459DE07EB16CD0C2452660772E3FFC4EEB8419EA77A013B6F63A5900
SHA-512:	ABA49D3F05A41A4982600E4DA5C225D8994251F447401EE6FE8478E008BCD5D41C057034185B5CFF805634D571F3CC98EFE98093ABC8E6271351E11A4DA1E7AD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Prague

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8038
Entropy (8bit):	3.8240363895915914
Encrypted:	false
SSDEEP:	96:Kr9+neXAS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlh:KnASs41sFpM5vwA6Efv03TBZLl
MD5:	828134FA1263FEFA2B06A8B2F075F564
SHA1:	4B332DE6E0855F8B9517F7098A3FB439671FC349
SHA-256:	5D3AFED5C1B07C6C6635D6BDEB28A0FB4D11A61F25F26C91227B2254BE5F4AA0
SHA-512:	9AB1462CDBD7F13F0CECDCCC2D91A85D8C0576B71508F935D26638C25ED023CF8FF4BA4FFDA402B308E6142B135D1B9D88700A519DBE2381E8E945329A5354F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Prague) {.. {-9223372036854775808 3464 0 LMT}.. {-3786829064 3464 0 PMT}.. {-2469401864 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-777862800 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-746578800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-728517600 0 1 GMT}.. {-721260000 0 0 CET}.. {-716425200 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654217200 7200 1 CEST}.. {-639010800 3600 0 CET}.. {283993200 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Riga

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7658
Entropy (8bit):	3.7750218768791806
Encrypted:	false
SSDEEP:	96:eq+cEpkjXkSV385aNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:ePWjUS7ivBeRF+W35Syrwl9h5j
MD5:	0D3C919F60081388524BD5DB22E6904B
SHA1:	6691EAB901C8B57D2F2693120A45A67799D05FCB
SHA-256:	8B64A42BAFD90F9255CACFDBAC603D638DD7C18DC27249F9C9B515E1DA634424
SHA-512:	62A2820B8C1C5468AC1F1BB626F9AAAD0BA1DEC5B73740F00FE4DB8CFA3F2BCF9947968E693824FC8770BA20AB962F93F7E5E345AE8A85F99CDB18E2B510308E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Riga) {.. {-9223372036854775808 5794 0 LMT}.. {-2840146594 5794 0 RMT}.. {-1632008194 9394 1 LST}.. {-1618702594 5794 0 RMT}.. {-1601681794 9394 1 LST}.. {-1597275394 5794 0 RMT}.. {-1377308194 7200 0 EET}.. {-928029600 10800 0 MSK}.. {-899521200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-795834000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {6

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Rome

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8813
Entropy (8bit):	3.8168470239811736
Encrypted:	false
SSDEEP:	96:hhGvC2GmkNXEq74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:hUsF41sFpM5vwA6Efv03TBZLl
MD5:	C4F49446D3696301EDB339691DCB2FDB
SHA1:	537963A77B9BE9BE6B997A812A6E6DD120F6F247
SHA-256:	DCD2D9144507311E573568598E1FFD0E0574FB677AA0DAFC5641D80A19EB6E58
SHA-512:	1F0A9A549FA0995C51E90AC392671E3F09744B268F1EE6A27CA7E3C41C2B02A4BA0F98369BE40BA482FBA1FED8F1EE712F0B3217AD86164D1AD498E369C24D76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Rome) {.. {-9223372036854775808 2996 0 LMT}.. {-3252098996 2996 0 RMT}.. {-2403565200 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-830307600 7200 0 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-807152400 7200 0 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 36

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Samara

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2118
Entropy (8bit):	3.664269700453612
Encrypted:	false
SSDEEP:	48:7PvCAs6kKR6aQmF1cSNWrI+AjQnTRYZ/YF0LUdt/LkajuZbIJltiabs2Tb:7HCAs6kC6aZF1cSN4I+AjQTRYZ/YF0Lw
MD5:	965D987F6576F66A08871697144D4CDB
SHA1:	AF7226DF81C2B3C3A5832F59FC708A6BCBF389CA
SHA-256:	8F395352AA05D35E7D13380E73659A0D5B56FFC17E3F4E40E4F678A902F0E49B
SHA-512:	B82E0CFA5EDA0FCDF03609AE439255F8937A7E9EFA0AFE15EA8877316782AFC74514BCD2B4F06F1B5F0F3C5A64A933D73CB50D5AED2BB1491BD6CACBB77B10E8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Samara) {.. {-9223372036854775808 12020 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-1102305600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 10800 0 +03}.. {687916800 14400 0 +04}.. {701820000 18000 1 +05}.. {717544800 14400 0 +04}.. {733

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\San_Marino

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.955758257767983
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQawELDX7x/yQaxE:SlSWB9vsM3ymx5PHAIgoxvN/yt/yrE
MD5:	D253DA6880630A31D39DB0CFA4933ABD
SHA1:	E5798DAAE574729685FE489F296B964BC1CCF2E4
SHA-256:	B6856A0E38C2404F7D5FA1821559503F8AE70923A562F0D993124D131515F395
SHA-512:	CFB6005F3E8D1C585AF36EB7A8C9F49760EF6F446C97E7804EB61EFD0804424C4FB6AE81B71C5A867274EF89A17DAC0D2A0FF882A0F6AEA1D5FFD51593726C5F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/San_Marino) $TZData(:Europe/Rome)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Sarajevo

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.937834327554967
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawEX3GEaQa5:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNZ
MD5:	F7C7DAE9C5D371EF9EE1F490246ED3CC
SHA1:	40C388FE2A55078C8E0524A4385B3F8846960E24
SHA-256:	BC00D953C2F3E55E40EDA13838AB66B9E9D0BDAD620E4EB917637761ABB06FB1
SHA-512:	EB22C59F4D58D96797A718FC59B010795F587626E456D44A3E6398E0FBF4ECD97BCDC151BC1359151798B5AF2964FE5708233F8ECD0D344C3E27629F2645687F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Saratov

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	3.6638125261109824
Encrypted:	false
SSDEEP:	48:yFvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDQ:yhCAs6kC6aZF1cSNcjXgV/ApDFjDQ
MD5:	CC4D7C478790588D232568CAB12D8E67
SHA1:	07A7CFCFFFF91D124EDFC99F5053BAFC79FBB12B
SHA-256:	AB90363DEE5077C39EC55FE8E519593FF08223E5A8E593F6CCE01FB5B8B35BAE
SHA-512:	23944D20624C942CFDE58F1019160D64401BD0AFB8C3EC49F904038482FAA6741812548C860A2DAE050B8D17A7E08ED9C6EBE7FF19393CFA46D78B1D21B1CACA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Saratov) {.. {-9223372036854775808 11058 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {780

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Simferopol

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	3.9502615086649637
Encrypted:	false
SSDEEP:	48:wM2wE0xhuHJkN+2kCnbdSisa0ewEKGfUslIYtq8X:UwEAEpkuCgaNl7
MD5:	1953A171614196D2FD2CA12FFE6F70D4
SHA1:	20958D5888F94C1FF2C90DDB97915435095AA67C
SHA-256:	4186A873A6218FF746957A0AAED1D61FC28FF5ED6D44BF38F36B5120A21C06C6
SHA-512:	35A628EBB2C2068A7DE07175494E195D75ADE30CB4B8BFE7EE7EA0A3B30F68BF6E0F21590A0A2DA0E02B944473545A5887BF95692A9C9E9DCD08CB8D542D142B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Simferopol) {.. {-9223372036854775808 8184 0 LMT}.. {-2840148984 8160 0 SMT}.. {-1441160160 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-888894000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-811645200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 7200 0 EET}.. {694216800 7200 0 EET}.. {

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Skopje

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.953089768975736
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawOgpr8Qahr:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNO
MD5:	0BF8ADBB63F5D6187C75FF1B0BAC761E
SHA1:	7DE15E767D34812F784CE6E85438A592E2CBA418
SHA-256:	52F20858433261B15797B64F0A09CEE95D552EF93B5DAA7C141BFAB6D718C345
SHA-512:	27D395635427C8FA1A4E0063A32F482701D2CC7C7724B4A06E661D4A419D23E219672888D37367FE5E70B6872914EB9EE034AE359DCB6A4C4CE05CA34C3589A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Sofia

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7654
Entropy (8bit):	3.727428614069594
Encrypted:	false
SSDEEP:	96:8lmG4+K7Gjz5CXNUatpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:8lmGWwkdUasivBeRF+W35Syrwl9h5j
MD5:	91357DFC23ADB0CE80C463E4B6D896BE
SHA1:	273F51BE4C67A9AC1182F86AC060E963684151D5
SHA-256:	6415F279CB143EA598CF8272263AC5B502827B10CEEB242B39E6EFCC23A2EE12
SHA-512:	8EA7E2D4C2239879A4D6CCE302C38A6D2A9093A2CADEF4F4294E60D373AB9A2C468BA6E3D54DEC7F73D954CE5226EF2B022F8BDEF29B3B4AAB3838B05C72EA29
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Sofia) {.. {-9223372036854775808 5596 0 LMT}.. {-2840146396 7016 0 IMT}.. {-2369527016 7200 0 EET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-781048800 7200 0 EET}.. {291762000 10800 0 EEST}.. {307576800 7200 0 EET}.. {323816400 10800 1 EEST}.. {339026400 7200 0 EET}.. {355266000 10800 1 EEST}.. {370393200 7200 0 EET}.. {386715600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465350400 7200 0 EET}.. {481075200 10800 1 EEST}.. {496800000 7200 0 EET}.. {512524800 10800 1 EEST}.. {528249600 7200 0 EET}.. {543974400 10800 1 EEST}.. {559699200 7200 0 EET}.. {575424000 10800 1 EEST}.. {591148800 7200 0 EET}.. {606873600 10800 1 EEST}.. {62259

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Stockholm

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7308
Entropy (8bit):	3.817544865319589
Encrypted:	false
SSDEEP:	96:Skhe74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:Sky41sFpM5vwA6Efv03TBZLl
MD5:	A17318A055D4BB049FB4621CDC2AFED3
SHA1:	61BA62F253BD4D8B34C2CFCDB96AB458D413E214
SHA-256:	12447CE016745FC14584CB5F753E918C23ECA5D028CA50042E0714CF3783608A
SHA-512:	90CF037C1DBF55C5D70164D2B2CBDC9580F7FE496279416F578E42A444AD6CEBFF29336921619AAFC4E872B886A9AC5EF45006D2B9585D17AA3864F773C89610
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Stockholm) {.. {-9223372036854775808 4332 0 LMT}.. {-2871681132 3614 0 SET}.. {-2208992414 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Tallinn

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7549
Entropy (8bit):	3.76585669030767
Encrypted:	false
SSDEEP:	96:dUusEpkjXkSV3AMaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:O0WjUSWivBeRF+W35Syrwl9h5j
MD5:	54EF0224F5E28FA78F212EC97D4AE561
SHA1:	FA7C9A951ED943F1E1E609D2253582016BC26B57
SHA-256:	6F3594CCDA78B02B2EE14C8FAE29E668E47193AF2DFCF5AF1ECD210F13BCE9CE
SHA-512:	2D1CA2BB1945AE5E3F56AF8FA7F950CE7169F215C783E683634581C5EC01B54159E47A0E9551897077BBEAB06158906029A4E4B0051A263D9E5D903EA9DA1692
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tallinn) {.. {-9223372036854775808 5940 0 LMT}.. {-2840146740 5940 0 TMT}.. {-1638322740 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1593824400 5940 0 TMT}.. {-1535938740 7200 0 EET}.. {-927943200 10800 0 MSK}.. {-892954800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-797648400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 10800 1 EEST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Tirane

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7675
Entropy (8bit):	3.809498345470167
Encrypted:	false
SSDEEP:	96:n05NWKIHBJ9AE4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt:0iKqxAE41sFpM5vwA6Efv03TBZLl
MD5:	1983B88075A92942209BB2B80E565F4E
SHA1:	12A0401026C5C036144FD1D544173AAB39969F61
SHA-256:	C62686BF598138FEFB72E8CC6632BA75A5FE147F2A30124EE3583BE1F732E38D
SHA-512:	E95C38FA0A2B526C00B9DCF5CDF53059DECF64B085AA18BE000968DA626561944415D053CF7A5C32BC672085538920CFD67A3A3B627CFD5B1A4C9CEC49AA3F96
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tirane) {.. {-9223372036854775808 4760 0 LMT}.. {-1767230360 3600 0 CET}.. {-932346000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-843519600 3600 0 CET}.. {136854000 7200 1 CEST}.. {149896800 3600 0 CET}.. {168130800 7200 1 CEST}.. {181432800 3600 0 CET}.. {199839600 7200 1 CEST}.. {213141600 3600 0 CET}.. {231894000 7200 1 CEST}.. {244591200 3600 0 CET}.. {263257200 7200 1 CEST}.. {276040800 3600 0 CET}.. {294706800 7200 1 CEST}.. {307490400 3600 0 CET}.. {326156400 7200 1 CEST}.. {339458400 3600 0 CET}.. {357087600 7200 1 CEST}.. {370389600 3600 0 CET}.. {389142000 7200 1 CEST}.. {402444000 3600 0 CET}.. {419468400 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {457480800 7200 0 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 C

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Tiraspol

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.906212162381389
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV+NM/LWXHAIgoq9NM/HARL/yQa3MPgJM1p8QagNMj:SlSWB9vsM3ymI6CHAIgoI6HAN/ytM4MO
MD5:	E0C99DB7673EEE440BA1848046455BA1
SHA1:	1BCCC1BE46306DEF8A9CA249DE8FA11FC57CC04D
SHA-256:	FDD53FDB5F754BBBA8FF98F0B1555FE0BAEB7852843220A7CF93A190B641A9AD
SHA-512:	CD56B540AE9084DEAA9D0A1DBBAF89733C465424C22CE74696B9AE90FD4FEFAB265CF23C5B13A7F04597D75FD0147BD593E0552B56D87372170CB4CA1BFC8259
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Chisinau)]} {.. LoadTimeZoneFile Europe/Chisinau..}..set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Ulyanovsk

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	3.680951255407528
Encrypted:	false
SSDEEP:	48:kFvCAs6kKR6aQmF1cSNWrI+AjQndgV/Ap40FjDOP:khCAs6kC6aZF1cSN4I+AjQdgV/ApDFj4
MD5:	83C86E437B5FBA1DC9CC5235396AC381
SHA1:	5493A59C3A5A1B55ACD493E67F9E29D2A415A8DB
SHA-256:	9FA9D09509B4F8F5A9C8E422DBA02605070C3EBDAEB7C1DF8527C8EEF5E3632D
SHA-512:	86222489C65C87646939DECF91C2EC336EB46F64B644526A3FA8A4854B9D11819F6FD253107AB8A3DE911E254C88092D25137442164A6E437CDAF258A7CBB66C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Ulyanovsk) {.. {-9223372036854775808 11616 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 7200 0 +02}.. {695779200 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Uzhgorod

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7541
Entropy (8bit):	3.769633712898356
Encrypted:	false
SSDEEP:	96:dpSlo5Epkn/paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:dpUWnmivBeRF+W35Syrwl9h5j
MD5:	4AD237C8A1D94E2CB70377C49867AC76
SHA1:	121303331223925BFB708918BAED3CD2F0E33C60
SHA-256:	747F543B7A875214F8EEBFDAE3182D91B1E93CEB57B58D2B7657672F949B13A9
SHA-512:	FD2FB930CB81BD3427AEF374ACAC2A120F6AD447625824AD6D08E68868A3B389FDDE7E2A82FCFF3490488601ADE646AC989AA7CEF1FE77A700E232D7561B6E74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Uzhgorod) {.. {-9223372036854775808 5352 0 LMT}.. {-2500939752 3600 0 CET}.. {-946774800 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 1 CEST}.. {-794714400 3600 0 CET}.. {-773456400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 3600 0 CET}.. {67

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Vaduz

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.953146873643623
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQa1NEHp8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/yvNEJ8G
MD5:	A0BAEC8B6AF1589ECBE52667DDB2A153
SHA1:	37093F4F885CBFA90A1F136D082E8B7546244ACC
SHA-256:	06B235BF047FC2303102BC3DC609A5754A6103321D28440B74EEC1C9E3D24642
SHA-512:	DBEC235AFB413FA8D116FA1AFFE73706762E7458038B6D68E0BFD71C339510D766825BA97055A06DEE14D5880EAE6CD035BFE0C935C0DF44B0107A356D293A78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Vatican

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.914414313741477
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQa1xLM1p8QaxE:SlSWB9vsM3ymx5PHAIgoxvN/yvN+8rE
MD5:	2404265F8DE1F7D7745893DD4752BA1C
SHA1:	C07E7F72DBDC7F5F746385523EA733C2714F5DA2
SHA-256:	C203E94465BD1D91018FC7670437226EF9A4BB41D59DDE49095363865CA33D00
SHA-512:	5C20834542B74041AAB1DBE35686781B32EEB5814B1A35A942E87D1FC3B6D8F9264CB90433C44A480EA86DDEA65D8C152F41CE3E983C1DE5FA74D6FB5208F701
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/Vatican) $TZData(:Europe/Rome)..

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Vienna

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7930
Entropy (8bit):	3.8193566380830273
Encrypted:	false
SSDEEP:	96:8F6zq+gH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:8ozE41sFpM5vwA6Efv03TBZLl
MD5:	6A3A8055DD67174E853C7A208BABAC9B
SHA1:	64445543DE9D6C01FA858442976E249E37BE23EF
SHA-256:	A8165313C9B51DAEF130401439CBA60DAA9887FC5EAA61A5AFD4F7BAD1AD934F
SHA-512:	4407B9E8709A8DD05337A10030895AA9876EAF64EF5347952249EE2A541E304331B46D38532FD7CDFF9E633BF8C9884282F0A5ED259EBA1D99DC0914AF1A50C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vienna) {.. {-9223372036854775808 3921 0 LMT}.. {-2422055121 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1577926800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555801200 3600 0 CET}.. {-938905200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780188400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {323823600 7200 1 CEST}.. {338940000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CE

C:\Users\user\AppData\Local\Temp\_MEI69562\tcl\tzdata\Europe\Vilnius

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7485
Entropy (8bit):	3.7711709848169592
Encrypted:	false
SSDEEP:	96:FAhEpkwCXkSV3A/PplKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:FfWHUSKivBeRF+W35Syrwl9h5j
MD5:	1AB5FCEACC4E09074BA9F72F0B7747D5
SHA1:	E0134E61EC0ADC60BF6DB4544EA7B7FFA4EC7857
SHA-256:	B762DB4A068DC79FA57691E070D7026086E5A6D2FC273D5C1872E7C8E3711533
SHA-512:	07565071D05CF972DD64F6060599EB68A00BF264172873BA310168AD07CE0CFCF90D0019B775433EC910DA748B89F0C614E7FD4E821993DA53C7E33F194C6A97
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vilnius) {.. {-9223372036854775808 6076 0 LMT}.. {-2840146876 5040 0 WMT}.. {-1672536240 5736 0 KMT}.. {-1585100136 3600 0 CET}.. {-1561251600 7200 0 EET}.. {-1553565600 3600 0 CET}.. {-928198800 10800 0 MSK}.. {-900126000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-802141200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 7200 0 EEMMTT}.. {606873600 10800 1 EEST}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\images\pwrdLogo200.gif

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	GIF image data, version 89a, 130 x 200
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	7.790611381196208
Encrypted:	false
SSDEEP:	96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
MD5:	A5E4284D75C457F7A33587E7CE0D1D99
SHA1:	FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
SHA-256:	BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
SHA-512:	4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
Malicious:	false
Preview:	GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R......J.p.A.t...$A...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y135.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. .....Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'\|..M9..."...,.......

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\images\pwrdLogo75.gif

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	GIF image data, version 89a, 48 x 75
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.289201491091023
Encrypted:	false
SSDEEP:	24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
MD5:	7013CFC23ED23BFF3BDA4952266FA7F4
SHA1:	E5B1DED49095332236439538ECD9DD0B1FD4934B
SHA-256:	462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
SHA-512:	A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
Malicious:	false
Preview:	GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .\|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N\|...f..J.x... P&.\|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..\|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\images\tai-ku.gif

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	dropped
Size (bytes):	5473
Entropy (8bit):	7.754239979431754
Encrypted:	false
SSDEEP:	96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
MD5:	048AFE69735F6974D2CA7384B879820C
SHA1:	267A9520C4390221DCE50177E789A4EBD590F484
SHA-256:	E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
SHA-512:	201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
Malicious:	false
Preview:	GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa.....p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..\|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......EfY3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\license.terms

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	5.135743409565932
Encrypted:	false
SSDEEP:	48:XU/zAcKT6yOCaDBfsHLk32s3J5w83KDyP1BXy3JQz7yuC:XNc+92sg3A8uyDXy3JQnDC
MD5:	F090D9B312C16489289FD39813412164
SHA1:	1BEC6668F6549771DADC67D153B89B8F77DCD4B9
SHA-256:	0D1E4405F6273F091732764ED89B57066BE63CE64869BE6C71EA337DC4F2F9B5
SHA-512:	57B323589C5A8D9CBB224416731D8CE65C4B94146DF15CE30885DF63B1D0B3F709093B65390A911F84F20B7C5DE3C0AF9B4D7D531742BE046EDA6E8C3432EF6E
Malicious:	false
Preview:	This software is copyrighted by the Regents of the University of..California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState..Corporation, Apple Inc. and other parties. The following terms apply to..all files associated with the software unless explicitly disclaimed in..individual files.....The authors hereby grant permission to use, copy, modify, distribute,..and license this software and its documentation for any purpose, provided..that existing copyright notices are retained in all copies and that this..notice is included verbatim in any distributions. No written agreement,..license, or royalty fee is required for any of the authorized uses...Modifications to this software may be copyrighted by their authors..and need not follow the licensing terms described here, provided that..the new terms are clearly indicated on the first page of each file where..they apply.....IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY..FOR DIRECT, INDIRECT, SPECIAL, INCI

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\listbox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15255
Entropy (8bit):	4.9510475386072095
Encrypted:	false
SSDEEP:	384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
MD5:	804E6DCE549B2E541986C0CE9E75E2D1
SHA1:	C44EE09421F127CF7F4070A9508F22709D06D043
SHA-256:	47C75F9F8348BF8F2C086C57B97B73741218100CA38D10B8ABDF2051C95B9801
SHA-512:	029426C4F659848772E6BB1D8182EB03D2B43ADF68FCFCC1EA1C2CC7C883685DEDA3FFFDA7E071912B9BDA616AD7AF2E1CB48CE359700C1A22E1E53E81CAE34B
Malicious:	false
Preview:	# listbox.tcl --..#..# This file defines the default bindings for Tk listbox widgets..# and provides procedures that help in implementing those bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....#--------------------------------------------------------------------------..# tk::Priv elements used in this file:..#..# afterId -..Token returned by "after" for autoscanning...# listboxPrev -.The last element to be selected or deselected..#...during a selection operation...# listboxSelection -.All of the items that were selected before the..#...current selection operation (such as a mouse..#...drag) started; used to cancel an operation...#--------------------------------------------------------------------------....#--------------

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\megawidget.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	4.786615174847384
Encrypted:	false
SSDEEP:	192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
MD5:	D83ED6AC2912900040530528A0237AB3
SHA1:	2D18E42A8B96C3D71C1C6701010FDF75C1E6D5D8
SHA-256:	848258B946C002E2696CA3815A1589C8120AF5CC41FBC11BBD9A3F5754CC21AF
SHA-512:	00B4CD0D58029FC37820C163A4AE1DEAD22FB5C767BDC118659EACE26D449C362189611DFB3FAB1AC129FABFEC2CE853EA2C10D418FAE5AEB91DDC9330FF782D
Malicious:	false
Preview:	# megawidget.tcl..#..#.Basic megawidget support classes. Experimental for any use other than..#.the ::tk::IconList megawdget, which is itself only designed for use in..#.the Unix file dialogs...#..# Copyright (c) 2009-2010 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....package require Tk.....::oo::class create ::tk::Megawidget {.. superclass ::oo::class.. method unknown {w args} {...if {[string match .* $w]} {... [self] create $w {}$args... return $w...}...next $w {}$args.. }.. unexport new unknown.. self method create {name superclasses body} {...next $name [list \....superclass ::tk::MegawidgetClass {*}$superclasses]\;$body.. }..}....::oo::class create ::tk::MegawidgetClass {.. variable w hull options IdleCallbacks.. constructor args {...# Extract the "widget name" from the object name...set w [namespace tail [self]].....# Configure things...

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\menu.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39499
Entropy (8bit):	4.928671503514817
Encrypted:	false
SSDEEP:	768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
MD5:	078782CD05209012A84817AC6EF11450
SHA1:	DBA04F7A6CF34C54A961F25E024B6A772C2B751D
SHA-256:	D1283F67E435AAB0BDBE9FDAA540A162043F8D652C02FE79F3843A451F123D89
SHA-512:	79A031F7732AEE6E284CD41991049F1BB715233E011562061CD3405E5988197F6A7FB5C2BBDDD1FB9B7024047F6003A2BF161FC0EC04876EFF5335C3710D9562
Malicious:	false
Preview:	# menu.tcl --..#..# This file defines the default bindings for Tk menus and menubuttons...# It also implements keyboard traversal of menus and implements a few..# other utility procedures related to menus...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# cursor -..Saves the -cursor option for the posted menubutton...# focus -..Saves the focus during a menu selection operation...#...Focus gets restored here when the menu is unposted...# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if..#...tk::Priv(oldGrab) is non

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\mkpsenc.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30840
Entropy (8bit):	5.142909056222569
Encrypted:	false
SSDEEP:	768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
MD5:	983C7B78F1A0EBACAB8006D391A01FCD
SHA1:	7EA37474EA039ED7A37BFDD7D76EAE673E666283
SHA-256:	C5BDCA3ABA671F03DC4624AB5FD260490F5002491D6C619142CCF5A1A744528A
SHA-512:	A006EF9B7213E572F6FC540D1512A52C52FEC44E3A07846DE09662AE32B7191C5CF639798531847B39E4076BF9DD6314B6F5373065C04F4FEF221185B39C3117
Malicious:	false
Preview:	# mkpsenc.tcl --..#..# This file generates the postscript prolog used by Tk.....namespace eval ::tk {.. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically.. # handle any 8-bit encoding, but Tk never generates characters outside.. # ASCII)... #.. proc CreatePostscriptEncoding {} {...variable psglyphs...# Now check for known. Even if it is known, it can be other than we...# need. GhostScript seems to be happy with such approach...set result "\[\n"...for {set i 0} {$i<256} {incr i 8} {... for {set j 0} {$j<8} {incr j} {....set enc [encoding convertfrom "iso8859-1" \.....[format %c [expr {$i+$j}]]]....catch {.... set hexcode {}.... set hexcode [format %04X [scan $enc %c]]....}....if {[info exists psglyphs($hexcode)]} {.... append result "/$psglyphs($hexcode)"....} else {.... append result "/space"....}... }... append result "\n"...}...append result "\]"...return $result.. }.... # List of adobe glyph names. Converted from glyph

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgbox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	xbm image (32x, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16786
Entropy (8bit):	4.717927930017041
Encrypted:	false
SSDEEP:	192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
MD5:	217087AB6B2A8F9D7252E311D69C3769
SHA1:	09AEB2BC5B7C7F4AB3DE4211D786C519AE0970F6
SHA-256:	A07E3A3809CED3C6C9C1E171DCA5AD1F28357734CD41B2B9DD9F58085B3D2842
SHA-512:	6E57633C924BFC16D380C014C20DD24D5727E70D4843FCEC4D7995B4DB21941EA8F2A5FD6E5386DF3364B6905D4D66B2B9595DC8FC70CFF40A2D49A92A1B6FBA
Malicious:	false
Preview:	# msgbox.tcl --..#..#.Implements messageboxes for platforms that do not have native..#.messagebox support...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# Ensure existence of ::tk::dialog namespace..#..namespace eval ::tk::dialog {}....image create bitmap ::tk::dialog::b1 -foreground black \..-data "#define b1_width 32\n#define b1_height 32..static unsigned char q1_bits[] = {.. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,.. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,.. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x04, 0x00,

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\cs.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	4.789130604359491
Encrypted:	false
SSDEEP:	48:nlw9Twd+j3gLhokqwX+hTnJgNanPNcgRhgP+5QPwJJENL:nlw9TjjwI3hTnJgNaRhgP75L
MD5:	5A8B46B85DCCBF74E2B5B820E1A7B9D1
SHA1:	980F4FC5BABA82BA0FE02F9BD03A23DF6D565BB1
SHA-256:	4DFFBEEDBF0D66D84B13088016D1A782CEAAD4DED27BE1E38842F8969C0E533F
SHA-512:	2D81FC06CF3C20E4F6314BD13AF81FDE38A9B06510584C84C6A0C8C36314F980F77D02BD8056E7EE5DE599A0620E0C0349124147334B9C141145270046B19D90
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it".. ::msgcat::mcset cs "&About..." "&O programu...".. ::msgcat::mcset cs "All Files" "V\u0161echny soubory".. ::msgcat::mcset cs "Application Error" "Chyba programu".. ::msgcat::mcset cs "Bold Italic".. ::msgcat::mcset cs "&Blue" "&Modr\341".. ::msgcat::mcset cs "Cancel" "Zru\u0161it".. ::msgcat::mcset cs "&Cancel" "&Zru\u0161it".. ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.".. ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e".. ::msgcat::mcset cs "Cl&ear" "Sma&zat".. ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu".. ::msgcat::mcset cs "Color" "Barva".. ::msgcat::mcset cs "Console" "Konzole".. ::msgcat::mcset cs "&Copy" "&Kop\355rovat".. ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout".. ::msgcat::mcset cs "&

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\da.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3987
Entropy (8bit):	4.651948695787255
Encrypted:	false
SSDEEP:	48:nRZ2uDMr05sIEzs2KkrT+XuTKN0FjDDP9:nRZzDy4kBKkrT+QpP9
MD5:	227B0F255F854460E8E5146ED7A17B85
SHA1:	99A080CAD631F21963C51A5B254BDAD3724DC866
SHA-256:	FEEF8F8AD33BB3362C845A25D6ED273C398051047D899B31790474614C7AFD2D
SHA-512:	36A4B48831316CC29686CC76DA00110EB078EC56F55A960D11AE427AA3D913C340C1E3805BF2AD40C1A8A92FC6587DA5D2C245E7501289FC3E228BE14FE49598
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset da "&Abort" "&Afbryd".. ::msgcat::mcset da "&About..." "&Om...".. ::msgcat::mcset da "All Files" "Alle filer".. ::msgcat::mcset da "Application Error" "Programfejl".. ::msgcat::mcset da "&Blue" "&Bl\u00E5".. ::msgcat::mcset da "Cancel" "Annuller".. ::msgcat::mcset da "&Cancel" "&Annuller".. ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.".. ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog".. ::msgcat::mcset da "Cl&ear" "&Ryd".. ::msgcat::mcset da "&Clear Console" "&Ryd konsolen".. ::msgcat::mcset da "Color" "Farve".. ::msgcat::mcset da "Console" "Konsol".. ::msgcat::mcset da "&Copy" "&Kopier".. ::msgcat::mcset da "Cu&t" "Kli&p".. ::msgcat::mcset da "&Delete" "&Slet".. ::msgcat::mcset da "Details >>" "Detailer".. ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" finde

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\de.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4914
Entropy (8bit):	4.6221938909259475
Encrypted:	false
SSDEEP:	96:nxLEpatioUqGBLbz4ME/XKKVN9R7S/0oYr9:epY3MkXKKxRu2r9
MD5:	2203F65BCDA61BC15AEAC4F868C6D94A
SHA1:	C4CC3975679D23892406E4E8971359A0775B1B86
SHA-256:	C0F574B14068A049E93421C73873D750C98DE28B7B77AA42FE72CBE0270A4186
SHA-512:	79F134FDAD3B12524D43BF9F59D3C04CAE30A95F591A51B82C8DF7CC8563BEA5D464AEECC457D9F60C04365E30459C447ED537AFC832BA25E1815DE06C2B81E5
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset de "&Abort" "&Abbruch".. ::msgcat::mcset de "&About..." "&\u00dcber...".. ::msgcat::mcset de "All Files" "Alle Dateien".. ::msgcat::mcset de "Application Error" "Applikationsfehler".. ::msgcat::mcset de "&Apply" "&Anwenden".. ::msgcat::mcset de "Bold" "Fett".. ::msgcat::mcset de "Bold Italic" "Fett kursiv".. ::msgcat::mcset de "&Blue" "&Blau".. ::msgcat::mcset de "Cancel" "Abbruch".. ::msgcat::mcset de "&Cancel" "&Abbruch".. ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.".. ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis".. ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen".. ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen".. ::msgcat::mcset de "Color" "Farbe".. ::msgcat::mcset de "Console" "Konsole".. ::msgcat::mcset de "&Copy" "&Kopieren".. ::msgcat::mcset de "

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\el.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with very long lines (355), with CRLF line terminators
Category:	dropped
Size (bytes):	8784
Entropy (8bit):	4.334043617395095
Encrypted:	false
SSDEEP:	48:tVj/F+oxBHbkI8+xTqFt2zPJ0k63fRGIUvPXrfBNnzc+zIF7meUOT7GC8MO07S0g:fj9+AHlLoozHn7fBFrMVmehCAGb
MD5:	780F863903BBDAA6C371EC0D3C7E6D59
SHA1:	DF5D435E132BEE4C076A7FC577C8C275A8B68CD5
SHA-256:	3F6F155864FE59A341BFD869735E54DD21CEE21BBD038433D9B271AD77BA3F7E
SHA-512:	091965EE912513AE1943BE840A2E757188FBA6F760F7C47BE80D06313D59B051F183E3A29D4B1CEDE1F9E54CA3CA23D75FF2C3A3672A4E71FB56F0FA76F7FA0D
Malicious:	false
Preview:	## Messages for the Greek (Hellenic - "el") language...## Please report any changes/suggestions to:..## petasis@iit.demokritos.gr....namespace eval ::tk {.. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2".. ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...".. ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1".. ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2".. ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5".. ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7".. ::msgcat::mcset el \.."Cannot change to the directory \"%1\$s\".\nPermission denied." \.."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\en.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3377
Entropy (8bit):	4.279601088621442
Encrypted:	false
SSDEEP:	24:sQ7dw5bO0V3gqmCNyoKJ6iwp/uvENv4SKEcET2hsHFjr:n7dwNOc3RmOKJQcvEl4SK1ET2hYFjr
MD5:	D48CFC9EC779085E8F6AAA7B1C40C89A
SHA1:	0CF6253BFF39F40CA0991F9B06D3394BFEA21ED2
SHA-256:	4A33B44B2E220E28EAAE7FAC407CAFE43D97C270DA58FA5F3B699A1760BFB2A4
SHA-512:	C00EC0CFB48ABE621EF625C51952BCF177CE3BC7F0DEC5276EF84C9A97C7E014806B106EA8DEE202C43F8DD54ED7261A8D899E3EE12E3F37A90C387D864463AE
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset en "&Abort".. ::msgcat::mcset en "&About...".. ::msgcat::mcset en "All Files".. ::msgcat::mcset en "Application Error".. ::msgcat::mcset en "&Apply".. ::msgcat::mcset en "Bold".. ::msgcat::mcset en "Bold Italic".. ::msgcat::mcset en "&Blue".. ::msgcat::mcset en "Cancel".. ::msgcat::mcset en "&Cancel".. ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.".. ::msgcat::mcset en "Choose Directory".. ::msgcat::mcset en "Cl&ear".. ::msgcat::mcset en "&Clear Console".. ::msgcat::mcset en "Color".. ::msgcat::mcset en "Console".. ::msgcat::mcset en "&Copy".. ::msgcat::mcset en "Cu&t".. ::msgcat::mcset en "&Delete".. ::msgcat::mcset en "Details >>".. ::msgcat::mcset en "Directory \"%1\$s\" does not exist.".. ::msgcat::mcset en "&Directory:".. ::msgcat::mcset en "&Edit".. ::msgcat::mcset en "Effects".. ::msgcat::mcset en "Error: %1\$s".. ::msgcat::mcs

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\en_gb.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.262228832346611
Encrypted:	false
SSDEEP:	3:fEGp6fRyv//mGoW8vMKEQXyVn:sooyv//xoQOOn
MD5:	3D41FC47CD9936F817EF9645D73A77ED
SHA1:	E62BBE094B71CAF4A389DE3ECD84D2EEFBA33827
SHA-256:	01238293356E82F1D298896491F8B299BB7DC9C34F299C9E756254C736DA612B
SHA-512:	B92582C32C4D7CD9DE6571CBB6B93DD693A8B5A80645468E2D02B80C339BE2B95D5B4878A0DA9AFFE9E2F98A6C38AAE9CC1FF2440146D0ED128FE8C9A92EECDB
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset en_gb Color Colour..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\eo.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3991
Entropy (8bit):	4.605712650627941
Encrypted:	false
SSDEEP:	48:n680lhrzes/QEkFH+nl0WXqQ+pISIKU/ujHMytuXcFSpxvy:n680XeqfkFelPXqVpISIKUWgRTy
MD5:	E44F82EAF651D065CA1A2D5FA3C91C25
SHA1:	F0EA1C39DED47232B21D0DCDD5179071C5717C55
SHA-256:	37FC66686349A955935CB24B0BD524E91823D2A631E63D54FDF17733C7502CBE
SHA-512:	A2ECA0A1C06406158CA8D2066639C0C6B582969D5F01C0559838E93A3AEFFFC50EB54B26328DAA81742016650FC790B1F81841E40EFE4F885626902D82989DD7
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset eo "&Abort" "&\u0108esigo".. ::msgcat::mcset eo "&About..." "Pri...".. ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj".. ::msgcat::mcset eo "Application Error" "Aplikoerraro".. ::msgcat::mcset eo "&Blue" "&Blua".. ::msgcat::mcset eo "Cancel" "Rezignu".. ::msgcat::mcset eo "&Cancel" "&Rezignu".. ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.".. ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo".. ::msgcat::mcset eo "Cl&ear" "&Klaru".. ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon".. ::msgcat::mcset eo "Color" "Farbo".. ::msgcat::mcset eo "Console" "Konzolo".. ::msgcat::mcset eo "&Copy" "&Kopiu".. ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu".. ::msgcat::mcset eo "&Delete" "&Forprenu".. ::msgcat::mcset eo "Details >>" "Detaloj >>".. ::msgcat::mcset eo "Directory \"%1\$s\" does not ex

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\es.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4024
Entropy (8bit):	4.536517819515934
Encrypted:	false
SSDEEP:	48:nN0T1Lt8ZYSih/aiik148aFscyTzoixccUTqjcg60Dx/H5:nN0BLSQUXy/o8re055
MD5:	4765F3C055742530E4644771EBC6C69F
SHA1:	8BEA722AC00522DEAA5B380AEEF4CA57D7A271BD
SHA-256:	D2842B80F1B521EFF2D2656A69274B5F2A8F4F5831AF2E8EE73E3C37389F981F
SHA-512:	9CA247F22797A1A1FCA42B5CDABF58262ED95EECDDD321CEB1440A60A4375923E0F511238F360D159EB5EED6F82CBBE0B8907A07CC77DB831BF97082932CD0FD
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset es "&Abort" "&Abortar".. ::msgcat::mcset es "&About..." "&Acerca de ...".. ::msgcat::mcset es "All Files" "Todos los archivos".. ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n".. ::msgcat::mcset es "&Blue" "&Azul".. ::msgcat::mcset es "Cancel" "Cancelar".. ::msgcat::mcset es "&Cancel" "&Cancelar".. ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.".. ::msgcat::mcset es "Choose Directory" "Elegir directorio".. ::msgcat::mcset es "Cl&ear" "&Borrar".. ::msgcat::mcset es "&Clear Console" "&Borrar consola".. ::msgcat::mcset es "Color".. ::msgcat::mcset es "Console" "Consola".. ::msgcat::mcset es "&Copy" "&Copiar".. ::msgcat::mcset es "Cu&t" "Cor&tar".. ::msgcat::mcset es "&Delete" "&Borrar".. ::msgcat::mcset es "Details >>" "Detalles >>".. ::msgcat::mcset es "Directory \"%1\$s\"

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\fr.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3877
Entropy (8bit):	4.630737553723335
Encrypted:	false
SSDEEP:	48:nByEWs/3lHFB9FamsIfSAzZ2eaISAxh0BRc3jC:nByEWaRNzsSSWonMAv
MD5:	E279E5FFF03E1B8E9063ABC8A499A6BD
SHA1:	80910911F6B4830BA4DCBA9A9EAD12C9F802DDC9
SHA-256:	3F2CEB4A33695AB6B56E27F61A4C60C029935BB026497D99CB2C246BCB4A63C4
SHA-512:	8333388E421AC3F342317BEBE352809B0B190EF8B044A0BAE2FE4051974D86008BAFDCB7098E9DC39A8D9E1E08FB87F54B9D3388AF2D0185FF913DB6788C5AB5
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset fr "&Abort" "&Annuler".. ::msgcat::mcset fr "About..." "\u00c0 propos...".. ::msgcat::mcset fr "All Files" "Tous les fichiers".. ::msgcat::mcset fr "Application Error" "Erreur d'application".. ::msgcat::mcset fr "&Blue" "&Bleu".. ::msgcat::mcset fr "Cancel" "Annuler".. ::msgcat::mcset fr "&Cancel" "&Annuler".. ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.".. ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire".. ::msgcat::mcset fr "Cl&ear" "Effacer".. ::msgcat::mcset fr "Color" "Couleur".. ::msgcat::mcset fr "Console".. ::msgcat::mcset fr "Copy" "Copier".. ::msgcat::mcset fr "Cu&t" "Couper".. ::msgcat::mcset fr "Delete" "Effacer".. ::msgcat::mcset fr "Details >>" "D\u00e9tails >>".. ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\"

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\hu.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.7955991577265245
Encrypted:	false
SSDEEP:	96:nkCEz2TTrKmA17fzq/Hj+pUva+fQR/a5a/Thn5kU:kTqM17u/8NiMrhb
MD5:	4F1610E0C73DAE668E3F9D9235631152
SHA1:	63EE54A6C1A69B798C65C999D5F80A7AB252B6D8
SHA-256:	E063AD7CA93F37728A65E4CD7C0433950F22607D307949F6CB056446AFEAA4FE
SHA-512:	37F4B8A9CD020A77591C09AF40FBC2FA82107B2596D31B5F30CE6ECAA225417CF7A5C62FB7A93539B0D7E930D0A44F9BF2EE6BE113F831B0A72B229444672AFD
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s".. ::msgcat::mcset hu "&About..." "N\u00e9vjegy...".. ::msgcat::mcset hu "All Files" "Minden f\u00e1jl".. ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba".. ::msgcat::mcset hu "&Blue" "&K\u00e9k".. ::msgcat::mcset hu "Cancel" "M\u00e9gsem".. ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem".. ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.".. ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa".. ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s".. ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol".. ::msgcat::mcset hu "Color" "Sz\u00edn".. ::msgcat::mcset hu "Console" "Konzol".. ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s".. ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s".. ::ms

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\it.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3765
Entropy (8bit):	4.49679862548805
Encrypted:	false
SSDEEP:	48:nmU4xnonTjwUE5Xs6ZrT8BpXAg+Wr+u92C8t7mU9nUSs:nZ4FonFE58HBpXjr+fBJs
MD5:	B74C54666A5A431A782DB691B4CA3315
SHA1:	2BC63982C14BBA8A4C451CE31540181F40CE2216
SHA-256:	806930F283FD097195C7850E3486B3815D1564529B4F8E5FA6D26F3175183BC1
SHA-512:	8120E2FFD14E0A992E254796ADDC0DC995C921BE31688C0995D7A36FE82609D78791FEF73EAF5B14E2F0D40AD256AB8DAAA07C18E6950362B28E40B71E47C0B6
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset it "&Abort" "&Interrompi".. ::msgcat::mcset it "&About..." "Informazioni...".. ::msgcat::mcset it "All Files" "Tutti i file".. ::msgcat::mcset it "Application Error" "Errore dell' applicazione".. ::msgcat::mcset it "&Blue" "&Blu".. ::msgcat::mcset it "Cancel" "Annulla".. ::msgcat::mcset it "&Cancel" "&Annulla".. ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.".. ::msgcat::mcset it "Choose Directory" "Scegli una directory".. ::msgcat::mcset it "Cl&ear" "Azzera".. ::msgcat::mcset it "&Clear Console" "Azzera Console".. ::msgcat::mcset it "Color" "Colore".. ::msgcat::mcset it "Console".. ::msgcat::mcset it "&Copy" "Copia".. ::msgcat::mcset it "Cu&t" "Taglia".. ::msgcat::mcset it "Delete" "Cancella".. ::msgcat::mcset it "Details >>" "Dettagli >>".. ::msgcat::mcset it "Directory \"%1\$s\" does not ex

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\nl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	4.524344068436489
Encrypted:	false
SSDEEP:	48:nucQswBju0x0M4U2z9KSSOzZL5KhWTqGGIrlxXvhYbL/ZO5NT+T4kiLzzdDf1SDM:nLGa0x0Mp2KSHKSv2bL/ZO5u6nRfAXU9
MD5:	E56229BAC5A8ABB90C4DD8EE3F9FF9F8
SHA1:	7527D6C3C6C84BFF0E683FFA86A21C58458EB55D
SHA-256:	0914FBA42361227D14FA281E8A9CBF57C16200B4DA1E61CC3402EF0113A512C7
SHA-512:	13649DDB06DB4BA9E39BEAF828211086A519444DA9AB5CBDD1B88B29208388189A5141F75AD94B56A348EDDE534FFADE8B19B557CB988EA4ECC9A84B135D36C1
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset nl "&Abort" "&Afbreken".. ::msgcat::mcset nl "&About..." "Over...".. ::msgcat::mcset nl "All Files" "Alle Bestanden".. ::msgcat::mcset nl "Application Error" "Toepassingsfout".. ::msgcat::mcset nl "&Apply" "Toepassen".. ::msgcat::mcset nl "Bold" "Vet".. ::msgcat::mcset nl "Bold Italic" "Vet Cursief".. ::msgcat::mcset nl "&Blue" "&Blauw".. ::msgcat::mcset nl "Cancel" "Annuleren".. ::msgcat::mcset nl "&Cancel" "&Annuleren".. ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.".. ::msgcat::mcset nl "Choose Directory" "Kies map".. ::msgcat::mcset nl "Cl&ear" "Wissen".. ::msgcat::mcset nl "&Clear Console" "&Wis Console".. ::msgcat::mcset nl "Color" "Kleur".. ::msgcat::mcset nl "Console".. ::msgcat::mcset nl "&Copy" "Kopi\u00ebren".. ::msgcat::mcset nl "Cu&t" "Knippen".. ::msgcat::mcset nl "&Dele

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\pl.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	4.799369674927008
Encrypted:	false
SSDEEP:	48:nXra9E310fwNCeVsvSmy6MZv8lWBTDGdZ3tojTyrEQmAUCIx4wBxZ:n7a9Q0fyw5MQWgP3uoZChB3
MD5:	8CFA2E38822303FDCB55AE3277F0B81B
SHA1:	447F28A5064FCEA019C60B3F9B6D50CD43C2D0E3
SHA-256:	EACEB1F08DE0863CCF726881E07FE5B135EA09646C5253E0CBF7DDB987EB0D92
SHA-512:	E38BA9059AFF55C2B22A4AE24D6A76149C76DBA8BF8646AE81D6E07D7ED490D0605034B29D9AC848E6685C8EC26A3DBE5B2EAF462B14D96376E80076FBE7082A
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset pl "&Abort" "&Przerwij".. ::msgcat::mcset pl "&About..." "O programie...".. ::msgcat::mcset pl "All Files" "Wszystkie pliki".. ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie".. ::msgcat::mcset pl "&Apply" "Zastosuj".. ::msgcat::mcset pl "Bold" "Pogrubienie".. ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa".. ::msgcat::mcset pl "&Blue" "&Niebieski".. ::msgcat::mcset pl "Cancel" "Anuluj".. ::msgcat::mcset pl "&Cancel" "&Anuluj".. ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.".. ::msgcat::mcset pl "Choose Directory" "Wybierz katalog".. ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107".. ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119".. ::msgcat::mcset pl "Color" "Kolor".. ::msgcat::mcset pl "Console" "Konsola".. ::msgcat::mcset pl "&Copy" "&Kopiu

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\pt.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3987
Entropy (8bit):	4.63232183429232
Encrypted:	false
SSDEEP:	48:nHOT1mM5qHHxiBHb3joTjtcp2UqMxweo6VvilCMKKXx9vjM:nHOT1mMQnwB/otcUUpGX6VPVoLjM
MD5:	4018686F2A8E299D86BDB1478BC97896
SHA1:	0EECE3D57F2EA5EECE8157B06F3AFB97E1F2551A
SHA-256:	D687F71F0432BB0D02EFDF576E526D2C19D4136F76C41A3224A2F034168F3F34
SHA-512:	4D730068B2A21E1D6004205B10A9D0D5EE9683FEB03B6FB673E8B9B94ED6BE468086A52DFE97C4DBF35A07CBB2C5E276DF0952A06C78E029D53D796CB6FCC8DF
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset pt "&Abort" "&Abortar".. ::msgcat::mcset pt "About..." "Sobre ...".. ::msgcat::mcset pt "All Files" "Todos os arquivos".. ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o".. ::msgcat::mcset pt "&Blue" "&Azul".. ::msgcat::mcset pt "Cancel" "Cancelar".. ::msgcat::mcset pt "&Cancel" "&Cancelar".. ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.".. ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio".. ::msgcat::mcset pt "Cl&ear" "Apagar".. ::msgcat::mcset pt "&Clear Console" "Apagar Console".. ::msgcat::mcset pt "Color" "Cor".. ::msgcat::mcset pt "Console".. ::msgcat::mcset pt "&Copy" "Copiar".. ::msgcat::mcset pt "Cu&t" "Recortar".. ::msgcat::mcset pt "&Delete" "Excluir".. ::msgcat::mcset pt "Details >>" "Detalhes >>".. ::msgcat::mcset pt "D

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\ru.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7289
Entropy (8bit):	4.396417984959623
Encrypted:	false
SSDEEP:	96:n9MEBG2T4YHCIxqEMk0Y2xX6wKl9zFAWS2yuV9cDcPRjnHQuNFNfz5hVV9aWTRcD:dreFqN1T+oRR/F1RHR6
MD5:	803E0F9930828B103B03B55EDA173CB8
SHA1:	429A30A7546123B1895C4317C65A97EBCBD16F35
SHA-256:	8715E9927BA925AE8099EDF71A3D701FE396FC0E4DF039CEA7DC84120E101F47
SHA-512:	379739A2C84E35C1AC70EFA9F704D3D1455741FEB60F4A1D9B0E0FD6CC3279F66A0C63C0FADFD861498D3FE13AB9E633F2C1BB05E76B3206DECEA253FFB8E33C
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...".. ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b".. ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435".. ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439".. ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \....."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\msgs\sv.msg

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3908
Entropy (8bit):	4.658068191079967
Encrypted:	false
SSDEEP:	48:nT8A5cbwKmtI1sE9xt6BDyepTr2iiK/yGqXZlBp9:nD5cb2extDepTCnVpJ9
MD5:	1D085A672A6FCDECEF5D7D876E4C74A3
SHA1:	1A40C03F15A6926359CA3E5C0A809485CAD28AEE
SHA-256:	A6821A13D34FB31F1827294B82C4BF9586BB255CA14F78C3ACE11181F42EF211
SHA-512:	981EDEEF5E4C915BB8F10044096B412D1855CAD08F98A448C6C0A49A54222945EBD102DDCB9525535E0FB19313C319155FA59384605B2C36CC8B4A58693D57E7
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset sv "&Abort" "&Avsluta".. ::msgcat::mcset sv "&About..." "&Om...".. ::msgcat::mcset sv "All Files" "Samtliga filer".. ::msgcat::mcset sv "Application Error" "Programfel".. ::msgcat::mcset sv "&Blue" "&Bl\u00e5".. ::msgcat::mcset sv "Cancel" "Avbryt".. ::msgcat::mcset sv "&Cancel" "&Avbryt".. ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.".. ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp".. ::msgcat::mcset sv "Cl&ear" "&Radera".. ::msgcat::mcset sv "&Clear Console" "&Radera konsollen".. ::msgcat::mcset sv "Color" "F\u00e4rg".. ::msgcat::mcset sv "Console" "Konsoll".. ::msgcat::mcset sv "&Copy" "&Kopiera".. ::msgcat::mcset sv "Cu&t" "Klipp u&t".. ::msgcat::mcset sv "&Delete" "&Radera".. ::msgcat::mcset sv "Details >>" "Detaljer >>".. ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mapp

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\obsolete.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	5.038729016734604
Encrypted:	false
SSDEEP:	96:onzxtm7EMgdMjwPqeuAmz9LD1kFIQETZqoIK/RLf7w:ozxtm7qUwi79l0sZqoBJLDw
MD5:	FC9E03823BEB08DAF7681C09D106DF7D
SHA1:	7D06FC8F98140E0FFAA2571BD522FC772E58DE54
SHA-256:	540EEECBA17207A56290BAFFDAE882BBD4F88364791204AD5D14C7BEDD022CCC
SHA-512:	2B5BAD311A703A0FE2ED67ACE311BAD4C767BCD23DFC3D9ABDF5C3604146A6A15D6BD13A14BDEFCDB2B602C708AACFAB404E96FCBA7C546AD0DAECD4BE2EB34A
Malicious:	false
Preview:	# obsolete.tcl --..#..# This file contains obsolete procedures that people really shouldn't..# be using anymore, but which are kept around for backward compatibility...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# The procedures below are here strictly for backward compatibility with..# Tk version 3.6 and earlier. The procedures are no longer needed, so..# they are no-ops. You should not use these procedures anymore, since..# they may be removed in some future release.....proc tk_menuBar args {}..proc tk_bindForTraversal args {}....# ::tk::classic::restore --..#..# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic..# Tk widgets...#..# The value following an 'option add' call is the new 8.5 value...#..namespace eval ::tk::classic {.. # This may need t

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\optMenu.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	4.784780799273752
Encrypted:	false
SSDEEP:	48:g2hBuOrlkBytcqYXRE5fvvXq1EhJPqOj6Wf0cVlN:gQ6q4E5HCqhBqOhcaD
MD5:	9B7A8FD2C6B538FF31BDC380452C6DE3
SHA1:	3F915BFE85CED9F6C7E9A352718770E9F14F098E
SHA-256:	40CA505C9784B0767D4854485C5C311829594A4FCBDFD7251E60E6BB7EA74FD1
SHA-512:	43937152B844BE1E597E99DA1270E54AB1D572AE89CB759E6D41C18C9C8044CCC15A6925F9C5AF617AE9EC1404E78C2733231F4D5C6CFE4D23C546387B1FC328
Malicious:	false
Preview:	# optMenu.tcl --..#..# This file defines the procedure tk_optionMenu, which creates..# an option button and its associated menu...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_optionMenu --..# This procedure creates an option button named $w and an associated..# menu. Together they provide the functionality of Motif option menus:..# they can be used to select one of many values, and the current value..# appears in the global variable varName, as well as in the text of..# the option menubutton. The name of the menu is returned as the..# procedure's result, so that the caller can use it to change configuration..# options on the menu or otherwise manipulate it...#..# Arguments:..# w -...The name to use for the menubutton...# varName -..Global variable to hold the currently

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\palette.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8418
Entropy (8bit):	4.964814946573677
Encrypted:	false
SSDEEP:	192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
MD5:	4CE08A10CD9AE941654B8C679DF669F3
SHA1:	F1288BABCA698FD18C3BD221E6AE6C02F2975AAE
SHA-256:	849B4C57E4644E51BEAEAEB3AE59B7FF067E582ECD10F1B2CAF6B6E72F11F506
SHA-512:	0F37539DA3540E9B1DA7B0377E3BBB359B71DB4271D63BC9501E95931B4E609E8CB91DC2F7B08A6452598D4A0D58C6A2034049A215000EEF0F93A9963D003632
Malicious:	false
Preview:	# palette.tcl --..#..# This file contains procedures that change the color palette used..# by Tk...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_setPalette --..# Changes the default color scheme for a Tk application by setting..# default colors in the option database and by modifying all of the..# color options for existing widgets that have the default value...#..# Arguments:..# The arguments consist of either a single color name, which..# will be used as the new background color (all other colors will..# be computed from this) or an even number of values consisting of..# option names and values. The name for an option is the one used..# for the option database, such as activeForeground, not -activeforeground.....proc ::tk_setPalette {args} {.. if {[winfo depth .] == 1} {...# Just return on monochrome displays, otherwise errors

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\panedwindow.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5370
Entropy (8bit):	4.979530133775421
Encrypted:	false
SSDEEP:	96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
MD5:	286C01A1B12261BC47F5659FD1627ABD
SHA1:	4CA36795CAB6DFE0BBBA30BB88A2AB71A0896642
SHA-256:	AA4F87E41AC8297F51150F2A9F787607690D01793456B93F0939C54D394731F9
SHA-512:	D54D5A89B7408A9724A1CA1387F6473BDAD33885194B2EC5A524C7853A297FD65CE2A57F571C51DB718F6A00DCE845DE8CF5F51698F926E54ED72CDC81BCFE54
Malicious:	false
Preview:	# panedwindow.tcl --..#..# This file defines the default bindings for Tk panedwindow widgets and..# provides procedures that help in implementing those bindings.....bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }..bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }....bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }..bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }....bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}..bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}....bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }....bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }....# Initialize namespace..namespace eval ::tk::panedwindow {}....# ::tk::panedwindow::MarkSash --..#..# Handle marking the correct sash for possible dragging..#..# Arguments:..# w..the widget..# x..widget local x coord..# y..widget local y coord..# proxy.

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\pkgIndex.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.040809246948068
Encrypted:	false
SSDEEP:	6:CsUgabAOgjDnzJNBc6ynID/cL4RpncleXN17MQ9PQqBIQ08hof7MQ9PQqBIQei:lGbyntNO6LYZliPBIUhkPBIFi
MD5:	3367CE12A4BA9BAAF7C5127D7412AA6A
SHA1:	865C775BB8F56C3C5DFC8C71BFAF9EF58386161D
SHA-256:	3F2539E85E2A9017913E61FE2600B499315E1A6F249A4FF90E0B530A1EEB8898
SHA-512:	F5D858F17FE358762E8FDBBF3D78108DBA49BE5C5ED84B964143C0ADCE76C140D904CD353646EC0831FF57CD0A0AF864D1833F3946A235725FFF7A45C96872EB
Malicious:	false
Preview:	if {![package vsatisfies [package provide Tcl] 8.6.0]} return..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...\|\| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin libtk8.6.dll]]..} else {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin tk86t.dll]]..}..

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\safetk.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	4.891666209090638
Encrypted:	false
SSDEEP:	192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
MD5:	21A3AC11146EC26784C0E729D8D644D0
SHA1:	C7E0918E8692C42C1D1DD1BBCBFFF22A85979B69
SHA-256:	579701605669AADFFBCDB7E3545C68442495428EE6E93C2D3A3133583BCD3D33
SHA-512:	724ED83B989AD9033BEC4211EE50E4C9E85B51054C518CDF7E02D0ED0416F636B9F38C0B0D29F8F4F7F465B77C7D2E01D0918D2C2C3FEC4C7739EA982302FA2E
Malicious:	false
Preview:	# safetk.tcl --..#..# Support procs to use Tk in safe interpreters...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# see safetk.n for documentation....#..#..# Note: It is now ok to let untrusted code being executed..# between the creation of the interp and the actual loading..# of Tk in that interp because the C side Tk_Init will..# now look up the parent interp and ask its safe::TkInit..# for the actual parameters to use for it's initialization (if allowed),..# not relying on the child state...#....# We use opt (optional arguments parsing)..package require opt 0.4.1;....namespace eval ::safe {.... # counter for safe toplevels.. variable tkSafeId 0..}....#..# tkInterpInit : prepare the child interpreter for tk loading..# most of the real job is done by loadTk..# returns the child name (tkInterpInit

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\scale.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8056
Entropy (8bit):	4.979589163397994
Encrypted:	false
SSDEEP:	96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQz9MUKOC9dLrVx:KsbYQO48t+QYa+NkFjpaQz5KX9dLrVx
MD5:	857ADD6060A986063B0ED594F6B0CD26
SHA1:	B1981D33DDEA81CFFFA838E5AC80E592D9062E43
SHA-256:	0DA2DC955FFD71062A21C3B747D9D59D66A5B09A907B9ED220BE1B2342205A05
SHA-512:	7D9829565EFC8CDBF9249913DA95B02D8DADFDB3F455FD3C10C5952B5454FE6E54D95C07C94C1E0D7568C9742CAA56182B3656E234452AEC555F0FCB76A59FB1
Malicious:	false
Preview:	# scale.tcl --..#..# This file defines the default bindings for Tk scale widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for entries...#-------------------------------------------------------------------------....# Standard Motif bindings:....bind Scale <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. tk::ScaleActivate %W %x %y..}..bind Scale <Motion> {.. tk::ScaleActivate %W %x %y..}..bind Scale <Leave> {.. if {$tk_strictMotif} {...%W configure -activebackground

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\scrlbar.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13188
Entropy (8bit):	5.063842571848725
Encrypted:	false
SSDEEP:	192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
MD5:	5249CD1E97E48E3D6DEC15E70B9D7792
SHA1:	612E021BA25B5E512A0DFD48B6E77FC72894A6B9
SHA-256:	EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
SHA-512:	E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
Malicious:	false
Preview:	# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" \|\| [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\spinbox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16526
Entropy (8bit):	5.033807343600737
Encrypted:	false
SSDEEP:	384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
MD5:	77DFE1BACCD165A0C7B35CDEAA2D1A8C
SHA1:	426BA77FC568D4D3A6E928532E5BEB95388F36A0
SHA-256:	2FF791A44406DC8339C7DA6116E6EC92289BEE5FC1367D378F48094F4ABEA277
SHA-512:	E56DB85296C8661AB2EA0A56D9810F1A4631A9F9B41337560CBE38CCDF7DD590A3E65C22B435CE315EFF55EE5B8E49317D4E1B7577E25FC3619558015DD758EB
Malicious:	false
Preview:	# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\tclIndex

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20523
Entropy (8bit):	4.786929402401609
Encrypted:	false
SSDEEP:	384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
MD5:	9378397DD3DCA9DFB181F6F512B15631
SHA1:	4F95DD6B658B6A912725DC7D6226F8414020D6C7
SHA-256:	B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
SHA-512:	D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\tearoff.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5309
Entropy (8bit):	4.74935501162253
Encrypted:	false
SSDEEP:	96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
MD5:	5F042DE8AD8941C7B9EF6D7BE06C86E4
SHA1:	A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
SHA-256:	A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
SHA-512:	E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
Malicious:	false
Preview:	# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\text.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34961
Entropy (8bit):	4.958000555615616
Encrypted:	false
SSDEEP:	768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
MD5:	7C2AC370DE0B941AE13572152419C642
SHA1:	7598CC20952FA590E32DA063BF5C0F46B0E89B15
SHA-256:	4A42AD370E0CD93D4133B49788C0B0E1C7CD78383E88BACB51CB751E8BFDA15E
SHA-512:	8325A33BFD99F0FCE4F14ED5DC6E03302F6FFABCE9D1ABFEFC24D16A09AB3439A4B753CBF06B28D8C95E4DDABFB9082C9B030619E8955A7E656BD6C61B9256C3
Malicious:	false
Preview:	# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\tk.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24266
Entropy (8bit):	5.1375522500072925
Encrypted:	false
SSDEEP:	384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
MD5:	338184E46BD23E508DAEDBB11A4F0950
SHA1:	437DB31D487C352472212E8791C8252A1412CB0E
SHA-256:	0F617D96CBF213296D7A5F7FCFFBB4AE1149840D7D045211EF932E8DD66683E9
SHA-512:	8FB8A353EECD0D19638943F0A9068DCCEBF3FB66D495EA845A99A89229D61A77C85B530F597FD214411202055C1FAA9229B6571C591C9F4630490E1EB30B9CD3
Malicious:	false
Preview:	# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.12.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] \|\| [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\tkfbox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39613
Entropy (8bit):	5.1830399016984146
Encrypted:	false
SSDEEP:	768:+oj+AqE9cn9eJNgDN0/vsKulXgx65Eh6pSb:+6+ZM/gAEdix65Ehpb
MD5:	47635811AAA1CEB26EDA3930D91C8855
SHA1:	F071757BED525AF8CA21BFA0FCA89EC3F95AA278
SHA-256:	595A0B05EB2CBD4CF489E57624B509FC3B4885E6410CA6416E7521D23694373D
SHA-512:	A374126EC28E70C89EE247A591C2168DF55E110F260664F46F470C53CDA3A2411C3775391FC8FD575CEE69CD1768512E68CDDCB335204D00B9EB81906AC79344
Malicious:	false
Preview:	# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\altTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3713
Entropy (8bit):	4.915055696129498
Encrypted:	false
SSDEEP:	48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
MD5:	01F28512E10ACBDDF93AE2BB29E343BC
SHA1:	C9CF23D6315218B464061F011E4A9DC8516C8F1F
SHA-256:	AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
SHA-512:	FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
Malicious:	false
Preview:	#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\aquaTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.940737732832436
Encrypted:	false
SSDEEP:	48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
MD5:	F07A3A86362E9E253BE91F59714FE134
SHA1:	84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
SHA-256:	E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
SHA-512:	324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
Malicious:	false
Preview:	#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\button.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	4.917794267131833
Encrypted:	false
SSDEEP:	48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
MD5:	D4BF1AF5DCDD85E3BD11DBF52EB2C146
SHA1:	B1691578041319E671D31473A1DD404855D2038B
SHA-256:	E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
SHA-512:	25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
Malicious:	false
Preview:	#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\clamTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4809
Entropy (8bit):	4.905115353394083
Encrypted:	false
SSDEEP:	48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
MD5:	2B20E7B2E6BDDBEB14F5F63BF38DBF24
SHA1:	43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
SHA-256:	CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
SHA-512:	1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
Malicious:	false
Preview:	#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\classicTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	4.935603001745302
Encrypted:	false
SSDEEP:	48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
MD5:	0205663142775F4EF2EB104661D30979
SHA1:	452A0D613288A1CC8A1181C3CC1167E02AA69A73
SHA-256:	424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
SHA-512:	FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
Malicious:	false
Preview:	#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\combobox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12718
Entropy (8bit):	5.063548300335668
Encrypted:	false
SSDEEP:	192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
MD5:	F7065D345A4BFB3127C3689BF1947C30
SHA1:	9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
SHA-256:	68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
SHA-512:	74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
Malicious:	false
Preview:	#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\cursors.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	4.843146795750702
Encrypted:	false
SSDEEP:	96:DRYEqfLDxGmxGUz4GUtaPT6t6brv0q3O4Uu0:DWEqTDbxdWaPqe5PUr
MD5:	18EC3E60B8DD199697A41887BE6CE8C2
SHA1:	13FF8CE95289B802A5247B1FD9DEA90D2875CB5D
SHA-256:	7A2ED9D78FABCAFFF16694F2F4A2E36FF5AA313F912D6E93484F3BCD0466AD91
SHA-512:	4848044442EFE75BCF1F89D8450C8ECBD441F38A83949A3CD2A56D9000CACAA2EA440CA1B32C856AB79358ACE9C7E3F70DDF0EC54AA93866223D8FEF76930B19
Malicious:	false
Preview:	#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\defaults.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	4.933885986949396
Encrypted:	false
SSDEEP:	96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
MD5:	FC79F42761D63172163C08F0F5C94436
SHA1:	AABAB4061597D0D6DC371F46D14AAA1A859096DF
SHA-256:	49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
SHA-512:	F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
Malicious:	false
Preview:	#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\entry.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17617
Entropy (8bit):	5.025882547402842
Encrypted:	false
SSDEEP:	384:sca9JzOyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9JzOy76wiV3YNa
MD5:	89089172393C551CD1668B9C19B88290
SHA1:	0B8667217A4A14289E9F6C1B384DEF5479BCA089
SHA-256:	830CC3009A735E92DB70D53210C4928DD35CAAB5051ED14DEC67E06AE25CBE28
SHA-512:	ABBBE6AA937AAB392BC7DCB8BBFBBEC9EE5ED2C9F10ED982D77258BD98F27EE95AC47FD7CB6761B814885EF0878E1F1557D034C9F4163D9D85B388F2B837683F
Malicious:	false
Preview:	#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\fonts.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5732
Entropy (8bit):	5.001928619185109
Encrypted:	false
SSDEEP:	96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
MD5:	80331FCBE4C049FF1A0D0B879CB208DE
SHA1:	4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
SHA-256:	B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
SHA-512:	A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
Malicious:	false
Preview:	#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\menubutton.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6641
Entropy (8bit):	4.923865616450888
Encrypted:	false
SSDEEP:	192:toMcJQkmcE6fNuLyiCpYSmFSRwgppdT3kXdpK3dpKkNf2tOTjvAG:tRc6kFbcz2pyXz+zZ2y
MD5:	4C8D90257D073F263B258F00B2A518C2
SHA1:	7B58859E9B70FB37F53809CD3FFD7CF69AB310D8
SHA-256:	972B13854D0E9B84DE338D6753F0F11F3A8534E7D0E51838796DAE5A1E2E3085
SHA-512:	ED67F41578EE834EE8DB1FDED8AA069C0045E7058E338C451FA8E1ADE52907BED0C95631C21B8E88461571903B3DA2698A29E47F990B7A0F0DD3073E7A1BCADC
Malicious:	false
Preview:	#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\notebook.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5825
Entropy (8bit):	4.96378772387536
Encrypted:	false
SSDEEP:	96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
MD5:	F811F3E46A4EFA73292F40D1CDDD265D
SHA1:	7FC70A1984555672653A0840499954B854F27920
SHA-256:	22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
SHA-512:	4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
Malicious:	false
Preview:	#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\panedwindow.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2290
Entropy (8bit):	4.948496148661722
Encrypted:	false
SSDEEP:	48:zVAqE3ZF8b4rXzsqALAXsmCLFeNqkFeNXLz:zLeU4bzNs1h
MD5:	619D8F54EE73AD8A373AB272FBDB94A6
SHA1:	973626B5396B7E786DEDD8159D10E66B4465F9E0
SHA-256:	4D08A7E29EEF731876951EF01DFA51654B6275FA3DAADB1F48FF4BBEAC238EB5
SHA-512:	0D913C7DC9DAEE2B4A2A46663A07B3139D6B8F30D2F942642817504535E85616835EAA7D468851A83723A3DD711B65761376F3DF96A59A933A74EF096E13ACE9
Malicious:	false
Preview:	#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\progress.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.763501917862434
Encrypted:	false
SSDEEP:	24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
MD5:	DBF3BF0E8F04E9435E9561F740DFC700
SHA1:	C7619A05A834EFB901C57DCFEC2C9E625F42428F
SHA-256:	697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
SHA-512:	D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
Malicious:	false
Preview:	#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\scale.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	4.795451191784129
Encrypted:	false
SSDEEP:	48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
MD5:	F1C33CC2D47115BBECD2E7C2FCB631A7
SHA1:	0123A961242ED8049B37C77C726DB8DBD94C1023
SHA-256:	B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
SHA-512:	96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
Malicious:	false
Preview:	# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\scrollbar.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	4.979174619784594
Encrypted:	false
SSDEEP:	48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
MD5:	3FB31A225CEC64B720B8E579582F2749
SHA1:	9C0151D9E2543C217CF8699FF5D4299A72E8F13C
SHA-256:	6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
SHA-512:	E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
Malicious:	false
Preview:	#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\sizegrip.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	4.830288003879418
Encrypted:	false
SSDEEP:	48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
MD5:	DD6A1737B14D3F7B2A0B4F8BE99C30AF
SHA1:	E6B06895317E73CD3DC78234DD74C74F3DB8C105
SHA-256:	E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
SHA-512:	B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
Malicious:	false
Preview:	#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\spinbox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5003
Entropy (8bit):	5.055050310142795
Encrypted:	false
SSDEEP:	96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
MD5:	9C2833FAA9248F09BC2E6AB1BA326D59
SHA1:	F13CF048FD706BBB1581DC80E33D1AAD910D93E8
SHA-256:	DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
SHA-512:	5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
Malicious:	false
Preview:	#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\treeview.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10180
Entropy (8bit):	4.886259798213254
Encrypted:	false
SSDEEP:	96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
MD5:	F705B3A292D02061DA0ABB4A8DD24077
SHA1:	FD75C2250F6F66435444F7DEEF383C6397ED2368
SHA-256:	C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
SHA-512:	09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
Malicious:	false
Preview:	#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\ttk.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4993
Entropy (8bit):	4.954034141173847
Encrypted:	false
SSDEEP:	96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
MD5:	AF45B2C8B43596D1BDECA5233126BD14
SHA1:	A99E75D299C4579E10FCDD59389B98C662281A26
SHA-256:	2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
SHA-512:	C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
Malicious:	false
Preview:	#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\utils.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	5.001791071900077
Encrypted:	false
SSDEEP:	192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LVJWQl8p7M+R5:rw0+WmpWxa/w9nVJHu
MD5:	D98EDC491DA631510F124CD3934F535F
SHA1:	33037A966067C9F5C9074AE5532FF3B51B4082D4
SHA-256:	D58610A34301BB6E61A60BEC69A7CECF4C45C6A034A9FC123977174B586278BE
SHA-512:	23FAED8298E561F490997FE44AB61CD8CCB9F1F63D48BB4CF51FC9E591E463FF9297973622180D6A599CABB541C82B8FE33BF38A82C5D5905BBFA52CA0341399
Malicious:	false
Preview:	#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key\|F

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\vistaTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9710
Entropy (8bit):	4.6639701588183895
Encrypted:	false
SSDEEP:	192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
MD5:	0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
SHA1:	153AFB735B10BBA16CFBE161777232F983845D90
SHA-256:	EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
SHA-512:	5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
Malicious:	false
Preview:	#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\winTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	4.917847108902527
Encrypted:	false
SSDEEP:	48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
MD5:	769C0719A4044F91E7D132A25291E473
SHA1:	6FB07B0C887D443A43FB15D5728920B578171219
SHA-256:	AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
SHA-512:	47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
Malicious:	false
Preview:	#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\ttk\xpTheme.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	4.9805308941424355
Encrypted:	false
SSDEEP:	48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
MD5:	162F30D2716438C75EA16B57E6F63088
SHA1:	3F626FF0496BB16B27106BED7E38D1C72D1E3E27
SHA-256:	AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
SHA-512:	6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
Malicious:	false
Preview:	#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\unsupported.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	5.0647027375963996
Encrypted:	false
SSDEEP:	192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
MD5:	508F7E258C04970FAE526990168CB773
SHA1:	33785204B18C0E0F5CDCB5B49399B5907351FDB8
SHA-256:	B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
SHA-512:	A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
Malicious:	false
Preview:	# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk

C:\Users\user\AppData\Local\Temp\_MEI69562\tk\xmfbox.tcl

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27064
Entropy (8bit):	4.967626999005091
Encrypted:	false
SSDEEP:	384:0BLzjXhss64XP8FXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oy9jN7:0BvjXoivB3flLCRE5phLCP3xWV8veTod
MD5:	6DFD12DB27069F13957BC963EF5ACAAF
SHA1:	E492F0B60D73CE17C4FA7680BF0087DC5E0CC132
SHA-256:	1ED57E32CE9C419BCE36B483A91410DDF4C997CAF62D20E42048FC350F8C3F60
SHA-512:	32A3E205B4BC3B7D4D6F31E6FD26075EA3FAB7396F7392855D8BD4426CFEE9081482759EFF219038D64B074E2D3D864041E7C37DCA134F2A0C3140AA04D757C2
Malicious:	false
Preview:	# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#

C:\Users\user\AppData\Local\Temp\_MEI69562\tkinter\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	169387
Entropy (8bit):	5.325727669238682
Encrypted:	false
SSDEEP:	3072:to1bmOAjOql2MRQpdvtbtsYQCpANEOWSFnzry2dpYtDHeiKp+lsL/cLZXJ2nzj/a:t+bsjhoFOo6pYh+iKp+yctJ2nzj/a
MD5:	57965EA71C33330031929DEDA2F402F5
SHA1:	4EB3EECE3732A221DCD8C12AA571C154732A6298
SHA-256:	0F650BF307F1BF9001FBE0E79FE542375F6A10AF8BE0E887F1D083278C38228B
SHA-512:	875697E58FF281B889C718299A73061E79748BD59B08F38EDF6E81635BC0F7A2E113811D3C185E86E5CE4E368056A72057A9F1C2FCC934CE9F177A2B5D5DC91A
Malicious:	false
Preview:	o....................................@....$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.d.d.l.T.d.d.l.Z.d.Z.e.e.j...Z.e.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e...d...Z.e...d.e.j...Z.d.d...Z.d.d...Z.d.d...Z.z.e.j.Z.W.n...e.yX......Y.n.w.d.d...Z.z.e.j.Z.W.n...e.yk......Y.n.w.d.d.d...Z.G.d.d...d.e.e.j...Z.G.d.d...d...Z.d.a.d.a d.d...Z!d.d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d d!..Z&d.a'G.d"d#..d#..Z(G.d$d%..d%e(..Z)G.d&d'..d'e(..ZG.d(d)..d)e(..Z+G.dd+..d+e(..Z,d.d,d-..Z-e.Z/e.Z0d.d/..Z1G.d0d1..d1..Z2G.d2d3..d3..Z3G.d4d5..d5..Z4G.d6d7..d7..Z5G.d8d9..d9..Z6G.d:d;..d;e2e6..Z7d.d=d>..Z8G.d?d@..d@..Z9G.dAdB..dB..Z:G.dCdD..dD..Z;G.dEdF..dFe2..Z<G.dGdH..dHe<e9e:e;..Z=G.dIdJ..dJe<e6..Z>G.dKdL..dLe=..Z?G.dMdN..dNe=e4e5..Z@d.aAG.dOdP..dPe=..ZBG.dQdR..dRe=e4..ZCG.dSdT..dTe=..ZDG.dUdV..dVe=..ZEG.dWdX..dXe=e4e5..ZFG.dYdZ..dZe=..ZGG.d[d\..d\e=..ZHG.d]d^..d^e=..ZIG.d_d`..d`e=..ZJG.dadb..dbe=..ZKG.dcdd..dde=..ZLG.dedf..dfe=e4e5..ZMG.dgdh..dh..ZNG.didj..djeH..ZOG.dkdl..dl..ZPG.dmdn..dneP..ZQG.dodp..dpeP..ZRdqdr..ZSdsdt

C:\Users\user\AppData\Local\Temp\_MEI69562\tkinter\constants.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1637
Entropy (8bit):	5.7597666077747816
Encrypted:	false
SSDEEP:	24:gFV33T24X3jegX6v5qpE6k0wu3kxrm0+2XFMwadNx6XsR2ZbXEy10TI3LB/xDfqo:gHj24nnEd0wZxVydN8XI6YyAIbB/xD2M
MD5:	1A85033C7F2B6A0CCD7345EE2230501C
SHA1:	2A9DB770E72530961ACCA99869277E6DBCC23E08
SHA-256:	146EE8E331F1FF416BE0533BBF23139635703C0366A89A40875308A99DC7D2F8
SHA-512:	FAE35A2B76E68EA0577B5FA44E96CF456C227088EDDE98EE3A9BE59904F1EE2C51CC864E7E7724256CFC97E80FF2F9532FF27BDE56F2772A3D080F4979A5C56E
Malicious:	false
Preview:	o....................................@....8...d...Z...Z.Z.d...Z...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d Z$d!Z%d"Z&d#Z'd$Z(d%Z)d&Zd'Z+d(Z,d)Z-dZ.d+Z/d,Z0d-Z1d.Z2d/Z3d0Z4d1Z5d2Z6d3Z7d4Z8d5Z9d6Z:d7Z;d8Z<d9Z=d:Z>d;Z?d<Z@d=ZAd>ZBd?ZCd@ZDdAZEdBZFdCZGdDZHdEZIdFZJdGZKdHZLdIS.)J............n..s..w..e..nw..sw..ne..se..ns..ew..nsew..center..none..x..y..both..left..top..right..bottom..raised..sunken..flat..ridge..groove..solid..horizontal..vertical..numeric..char..word..baseline..inside..outside..sel..sel.first..sel.last..end..insert..current..anchor..all..normal..disabled..active..hidden..cascade..checkbutton..command..radiobutton..separator..single..browse..multiple..extended..dotbox..underline..pieslice..chord..arc..first..last..butt..projecting..round..bevel..miter..moveto..scroll..units..pagesN.M..NO..FALSE..OFF..YES..TRUE..ON..N..S..W..E..NW..SW..NE..SE..NS..EW..NSEW..CENTER..NONE..X..Y..BOTH..LEFT..TOP

C:\Users\user\AppData\Local\Temp\_MEI69562\tkinter\ttk.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	55655
Entropy (8bit):	5.245061977145734
Encrypted:	false
SSDEEP:	768:eNszZaFK0s+Sr+IX4Lm3dBCTfqxUMwPJphxlA54+tKTEX8snxhdC4f1kAudoNLJ+:eIaFZXSR4i3dITyxCxwMkrT1kAP7y
MD5:	61DBE4A09A3490CC51BFA627E133B954
SHA1:	2B54B7D156A99F603870FB6BB791E8B975906D0B
SHA-256:	E37F2BB3C807911F69B7DE40C8831D1835B64879090FED66307E7F18F303BDA2
SHA-512:	3E7B5314D1442F49E346D7A83520CF1832922E2A3AFD632A38689322319931B56E10264EE6ACF5BCD2A34021E67F25CDAC2A63E11919D36EDB14BD707D798832
Malicious:	false
Preview:	o....................................@....X...d.Z.d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...e.j.d.k.r!d.n.d.Z.d.d...Z.dWd.d...Z.dXd.d...Z.d.d...Z.dWd.d...Z.dWd.d...Z.dYd.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.dZd)d..Z.G.d+d,..d,e...Z.G.d-d...d.e.j...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e.e.j ..Z G.d5d6..d6e ..Z!G.d7d8..d8e...Z"G.d9d:..d:e...Z#G.d;d<..d<e...Z$e$Z%G.d=d>..d>e...Z&G.d?d@..d@e...Z'G.dAdB..dBe.e.j(..Z)e)Z(G.dCdD..dDe...ZG.dEdF..dFe...Z+G.dGdH..dHe.e.j,..Z,G.dIdJ..dJe.e.j-..Z-G.dKdL..dLe...Z.G.dMdN..dNe...Z/G.dOdP..dPe ..Z0G.dQdR..dRe.e.j1e.j2..Z3G.dSdT..dTe"..Z4G.dUdV..dVe&..Z5d.S.)[.....Ttk wrapper...This module provides classes to allow using Tk themed widget set...Ttk is based on a revised and enhanced version of.TIP #48 (http://tip.tcl.tk/48) specified style engine...Its basic idea is to separate, to the extent possible, the code.implementing a widget's behavior from the code implementing its.appearance. Widget class binding

C:\Users\user\AppData\Local\Temp\_MEI69562\token.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	5.758725012073385
Encrypted:	false
SSDEEP:	48:gUHWS58lFEOqIlPBJR418BVfulNe1je6JQmXmiLJVgkGQLU:vHWSOFEOb5nfBVJ9lJQCtlqKLU
MD5:	C564C7AAC76C79CA84E494DE0B6F1B9F
SHA1:	4B66611D59C5D948617BB268B0D760257EE2B5AF
SHA-256:	61E5212FA45C935D340415C9049F15723921209405DF250EFDD1B0FB791788F2
SHA-512:	22EBAED46E5344391F242603CA9365BDD9AA9E4783198F6E12DBA48B300401672F47FB86E63D30318B416F4AD78AABD7AAC1D4F5B1C1E5A54E70E7E525B7550E
Malicious:	false
Preview:	o....................................@....F...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)p..Token constants.....tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)........+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

C:\Users\user\AppData\Local\Temp\_MEI69562\tokenize.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17169
Entropy (8bit):	5.821556514480802
Encrypted:	false
SSDEEP:	384:GSAswulhQHPY0Ib6CSy9VcnWJMiLjoHBrFj:GmXsPYbbfSy9Vd7oHBrFj
MD5:	5B3B14C5FC36893D280CAE7F98899EB5
SHA1:	957EFF09AFE661EDC9298E7814B72A237250C65F
SHA-256:	F18705B4F6F7DD31D09594824ED6C5EAB91880F7E3B38DA63C858BE140C0DF2D
SHA-512:	514035E2CE7B7D4DC6DE1C1FB43B20E3FE34177E9E11F2FD58356C0B392269E542BB9B44BE78893BB05ABD0B2F33138DBE1D3D6306615CCACBF79D1A2C37C5F9
Malicious:	false
Preview:	o....................................@....T...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Ze.ee)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)P.o...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

C:\Users\user\AppData\Local\Temp\_MEI69562\tracemalloc.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17432
Entropy (8bit):	5.0041484913663705
Encrypted:	false
SSDEEP:	192:76qY121U+o1f7LIZ3GTyhz/AfLr5tFvcSi8iwQSyb/AHyH5KzF8J9kCjKovluCCo:7Q2Q1whltWLr5tFvcSiM1yDAK42FvCo
MD5:	17DE18A0CFB813C400267C1B60378A88
SHA1:	DCBDAAA475AB7FB81CC21D2346B59F8E1509DCBF
SHA-256:	34B36B29A72908613CE25A98BACC729AD5EEDBC893AD4C7BB5926F80B6549F8D
SHA-512:	D0C4B037C68AF67FDE8460969B973CB82BA2DC086A82B221CA1EE63C79D917484B017F3B64784F9B95028DB934906206E3F9E95A338EE665137FFBC30A48361A
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.e.G.d.d...d.....Z.e.G.d.d...d.e.....Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!..Z.d"d#..Z.d.S.)$.........Sequence..Iterable....total_orderingN........_get_object_traceback.._get_tracesc....................C.......d.D.]>}.t.\|...d.k.r \|.d.k.r \|.r.d.\|.\|.f.......S.d.\|.\|.f.......S.t.\|...d.k.s\|.d.k.r<\|.r4d.\|.\|.f.......S.d.\|.\|.f.......S.\|.d...}.q.d.S.).N....BZ.KiBZ.MiBZ.GiB..TiB.d...r......%+.1f %s..%.1f %s..(..r......%+.0f %s..%.0f %s.........abs....size..sign..unit..r......tracemalloc.py.._format_size...............................r ...c....................@....D...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Statistic.S. Statistic difference on memory allocations between two Snapshot instance.. ....tracebackr......countc..

C:\Users\user\AppData\Local\Temp\_MEI69562\tty.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.179077773900451
Encrypted:	false
SSDEEP:	24:gJvKfqMZ0GlnlXV0SyGXUZx0NhEXcaUQa/ss9VpmA0+mmf:ghK5hnllqvZx0vYcae0WKA0+mM
MD5:	443BA1D842CA028CE1785773C4C7CBA7
SHA1:	970E5C43FFC50D74705B9B0F21468482DB214176
SHA-256:	092B9F7BAAAF38A03B95866FB1FBC8EB1DCE0B7D360A87BB9E0930848F549B2D
SHA-512:	73F53F49EDAC6267570F030649D8CD2FC8F1F1ADAFDCC01D4BD9E55E7BCCB6C2977DA0CC0B3F9C873B32776B10E50010920D759F275CF4E7306353EEECE29708
Malicious:	false
Preview:	o....................................@....L...d.Z.d.d.l.T.d.d.g.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.f.d.d...Z.e.f.d.d...Z.d.S.)...Terminal utilities..........*..setraw..setcbreak..............................c....................C.......t.\|...}.\|.t...t.t.B.t.B.t.B.t.B...@.\|.t.<.\|.t...t...@.\|.t.<.\|.t...t.t.B...@.\|.t.<.\|.t...t.B.\|.t.<.\|.t...t.t.B.t.B.t.B...@.\|.t.<.d.\|.t...t.<.d.\|.t...t.<.t.\|.\|.\|.....d.S.)...Put terminal into a raw mode.r....r....N....tcgetattr..IFLAGZ.BRKINTZ.ICRNLZ.INPCKZ.ISTRIPZ.IXON..OFLAGZ.OPOST..CFLAGZ.CSIZEZ.PARENBZ.CS8..LFLAG..ECHO..ICANONZ.IEXTENZ.ISIG..CC..VMIN..VTIME..tcsetattr....fd..when..mode..r .....tty.pyr..............."...............c....................C....F...t.\|...}.\|.t...t.t.B...@.\|.t.<.d.\|.t...t.<.d.\|.t...t.<.t.\|.\|.\|.....d.S.).. Put terminal into a cbreak mode.r....r....N..r....r....r....r....r....r....r....r....r....r ...r ...r!...r.......................N....__doc__..termios..__all__r....r....r....r......ISPEED..OSPEEDr......TCSAFLUSHr....r....r ..

C:\Users\user\AppData\Local\Temp\_MEI69562\typing.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	85030
Entropy (8bit):	5.342904336398452
Encrypted:	false
SSDEEP:	1536:GCpt+yq//3TokpNyIITKhoQmkvU0pH47KlCZo1ZUK4stH5uln5YeJNJ4mQU3mwy0:tyzSuEkHpH1h4spEwwum93m3IxPT809h
MD5:	BB389BA240BA7334037563A7E7DF9C6B
SHA1:	6FE257DEE812DCDD9BA2537387FC2DC25FADC319
SHA-256:	C0A08F266A944998D2530BB054019FA824221AC2BCA7802BAC26711BF9925D08
SHA-512:	8B28520DA22EBA8DFF35F06BE82485B991105818EBD0AA06F69259C87A398A9115335A5A45FDCEED0E963BFF0EAED6D8E4AC8D4DBD273F72117793936793F27B
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d..de"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d\|..d\|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

C:\Users\user\AppData\Local\Temp\_MEI69562\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016584
Entropy (8bit):	6.669319438805479
Encrypted:	false
SSDEEP:	24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
MD5:	0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
SHA1:	4189F4459C54E69C6D3155A82524BDA7549A75A6
SHA-256:	8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
SHA-512:	A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1123608
Entropy (8bit):	5.3853088605790385
Encrypted:	false
SSDEEP:	12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
MD5:	81D62AD36CBDDB4E57A91018F3C0816E
SHA1:	FE4A4FC35DF240B50DB22B35824E4826059A807B
SHA-256:	1FB2D66C056F69E8BBDD8C6C910E72697874DAE680264F8FB4B4DF19AF98AA2E
SHA-512:	7D15D741378E671591356DFAAD4E1E03D3F5456CBDF87579B61D02A4A52AB9B6ECBFFAD3274CEDE8C876EA19EAEB8BA4372AD5986744D430A29F50B9CAFFB75D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$z.eJ).eJ).eJ)...).eJ)..K(.eJ)..O(.eJ)..N(.eJ)..I(.eJ)\|.K(.eJ)..K(.eJ).eK).eJ)\|.G(.eJ)\|.J(.eJ)\|..).eJ)\|.H(.eJ)Rich.eJ)........................PE..d.....,d.........." .....B.......... *.......................................@......Q.....`.............................................X............ ..........H......../...0.......`..T........................... a..8............`..x............................text...9A.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..H...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3375
Entropy (8bit):	5.64083916316201
Encrypted:	false
SSDEEP:	96:OkG1FP4XD+2+tnmXYQZQ3ACW4uN408K2OIE2I:xgAXgtni3ZQ3AC1uUcIE2I
MD5:	78EDE15833D6D59BC490C1A2FD60D42B
SHA1:	64F4A953C5644D93BD0EBEBA752189430870EE5F
SHA-256:	E6D89DAFB980BA84377FAA3ABDC8420AE0EA94F10A0FA2A30E7E5E4A6425DF96
SHA-512:	D31942FE065DA3504CA6ED659DE3088A6B052AB29E563DAB8CEEB2E0970A2100D2876122576DA78F4637529F3B34DF0750BE6597315F1CABF856EA98E804A1E3
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.e...g.d.......d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..e.Z"d.d...Z#d.d...Z$d.d...Z%d.S.).......Python unit testing framework, based on Erich Gamma's JUnit and Kent Beck's.Smalltalk testing framework (used with permission)...This module contains the core framework classes that form the basis of.specific test cases and suites (TestCase, TestSuite etc.), and also a.text-based utility class for running the tests and reporting the results. (TextTestRunner)...Simple usage:.. import unittest.. class IntegerArithmeticTestCase(unittest.TestCase):. def testAdd(self): # test method names begin with 'test'. self.assertEqual((1 + 2), 3). self.assertEqual(0 + 1, 1). def testMultiply(self):. self.assertEqual((0 * 10), 0). self.assertEqual((5 * 8), 40).. if __name_

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\_log.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	5.131453359036529
Encrypted:	false
SSDEEP:	48:gGYKlmogOkqDPJfkVtzjj8F+N7ACJlHrLCgOHzDWxo6uDQTUjQEUE7:/m3HeRfGlgEBrJkgOTSPuDQTUjQEz7
MD5:	CBA9F7393E33CC441063FFACB1557591
SHA1:	31B1B513696880246B3E64D9843CCE98BC1C17B2
SHA-256:	FA9B79A6793891A1A1CB745EC0FB1AC38E6994033BE07156D3F45DC25198CCF2
SHA-512:	C3A925FAEE7DBEBD4F81F9819E9675D7B472C24C3DA6D0F7EDB2E00987451343AA9FB5DB1E24E955B497ECD48A0D05620C13E75580604D959F63ABEFAA9E00DC
Malicious:	false
Preview:	o....................................@....R...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d.d.d.g...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.d.S.)......N........._BaseTestCaseContext.._LoggingWatcher..records..outputc....................@....(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._CapturingHandler.M. A logging handler capturing all (raw and formatted) logging output.. c....................C........t.j...\|.....t.g.g...\|._.d.S.).N....logging..Handler..__init__r......watcher....self..r......unittest\_log.pyr..................._CapturingHandler.__init__c....................C........d.S.).Nr....r....r....r....r......flush............._CapturingHandler.flushc....................C....*...\|.j.j...\|.....\|...\|...}.\|.j.j...\|.....d.S.).N..r....r......append..formatr......r......record..msgr....r....r......emit................._CapturingHandler.emitN....__name__..__module__..__qualname__..__doc__r....r....r#...r....r....r....r....r.......................r....c....................@....,...e.Z.d.Z.d.Z.

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\async_case.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4702
Entropy (8bit):	5.162270860195572
Encrypted:	false
SSDEEP:	96:NDwaqsfkym5cnRjbQYUoTe46OslsCzEXwiNvGd3G/GNFbJ7e+Ak8+fNNSA:92yRjdh6OsmXBVGd3G/GNFbJ7mk8+fNn
MD5:	21D49C9A4A613F87AA7770C859022AA4
SHA1:	9B2B11D4ABCED296C1997191640FD6EFB978632E
SHA-256:	3208067D6596E5B764D70BECE839C53D3CD080BB615955484529E2BB4E23D550
SHA-512:	A83B4BB5545FE9FBBA2C4CB3C56FE687DA86FE5AC3A7CAA3715EB8F001AFFF5502105F3C225813D892530DC84A6559E9B164C4FBCDAAB7F02F2EF17D74AABB5F
Malicious:	false
Preview:	o....................................@....0...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.........TestCasec............................e.Z.d.Z.d#..f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d$..f.d.d...Z...f.d.d ..Z.d!d"..Z.....Z.S.)%..IsolatedAsyncioTestCase..runTestc.............................t.....\|.....d.\|._.d.\|._.d.S.).N....super..__init__.._asyncioTestLoop.._asyncioCallsQueue....self..methodName....__class__....unittest\async_case.pyr....!............... IsolatedAsyncioTestCase.__init__c...............................d.S.).Nr......r....r....r....r......asyncSetUp&............."IsolatedAsyncioTestCase.asyncSetUpc........................r....).Nr....r....r....r....r......asyncTearDown)...r.....%IsolatedAsyncioTestCase.asyncTearDownc....................O........\|.j.\|.g.\|...R.i.\|.......d.S.).N....addCleanup..r......func..args..kwargsr....r....r......addAsyncCleanup,...........'IsolatedAsyncioTestCase.addAs

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\case.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	48424
Entropy (8bit):	5.362465030990573
Encrypted:	false
SSDEEP:	768:lptofpD1U+CUtZ1JiBXQED1jmhwwfSTfhMelsfCkJoJoua8aAc5Gq7LGOB6cz9qo:OfpD7tZZQjmvfSTfqelsf7JoJof8Hcc8
MD5:	642EFF407D503E2EB23796AB1CA50D6E
SHA1:	F220B9BF010E62FF7EE99CCD0C4822B49C0838D4
SHA-256:	D63309BC5623CE012DC63C82D4924691EF181EAEC107AD9846A7BEA78755B961
SHA-512:	CB1F3DF15EB5B65DAE3E83C6F7A1162EC572D292CC364576C3C1DC1D6215C01877B82BF1A7949A5069896C8BA188F981BC5B0FB6E21B3C04B9F743556F9E306D
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.Z.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.g.Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"d.d...Z#d.d...Z$G.d d!..d!..Z%G.d"d#..d#e%..Z&G.d$d%..d%e&..Z'G.d&d'..d'e&..Z(G.d(d)..d)e.j)..ZG.dd+..d+e...Z+G.d,d-..d-e+..Z,G.d.d/..d/e+..Z-d.S.)0..Test case implementation.....N.........result....strclass..safe_repr.._count_diff_all_purpose.._count_diff_hashable.._common_shorten_reprT.@.Diff is %s characters long. Set self.maxDiff to None to see it.c....................@........e.Z.d.Z.d.Z.d.S.)...SkipTest... Raise this exception in a test to skip it... Usually you can use TestCase.skipTest() or one of the skipping decorators. instead of raising this directly.. N....__name__..__module__..__qualname__..__doc__..r....r......unittest\case.pyr.................r....c.............

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\loader.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	14379
Entropy (8bit):	5.4818967194961035
Encrypted:	false
SSDEEP:	384:8ZytBF75O43p2Y9kr2LSgDjaRY61ry+oolZgep2xrya:8ev3p5qrpjBvQrya
MD5:	92DF3DC7078F95C512992DA1EEDE76D0
SHA1:	4AD4FFFEFE5D9D904891D6465559C10AAEBBEC0C
SHA-256:	D5A950C5BB6AE397F47556A28479943199CF6AE5BF3F03D14975DA9569CDF652
SHA-512:	8B1EAD6DAB9B9636D30D28CA94B6EC064DD5ECC2B1116EF23F457B012323E5D4A8CB1379D7B8F5C14E13C2B8AEC3CF035FE99DF3FE666ED4C12F6853190C038B
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.Z.e...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.d.d...Z.e.j.d.f.d.d...Z.d.e.j.e.j.f.d.d...Z d.e.j.e.j.f.d.d...Z!d.S.) ..Loading unittests......N....fnmatch..fnmatchcase.........case..suite..utilT..[_a-z]\w\.py$c.........................,...e.Z.d.Z.d.Z...f.d.d...Z...f.d.d...Z.....Z.S.)..._FailedTestNc.............................\|.\|._.t.t.\|.....\|.....d.S.).N...._exception..superr......__init__....self..method_name..exception....__class__....unittest\loader.pyr..................._FailedTest.__init__c............................\|...j.k.r.t.t.......\|...S...f.d.d...}.\|.S.).Nc...............................j...).N..r....r......r....r....r......testFailure!...........,_FailedTest.__getattr__.<locals>.testFailure...._testMethodNamer....r......__getattr__..r......namer"...r....r!...r....r'.............

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\main.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7529
Entropy (8bit):	5.369614403062867
Encrypted:	false
SSDEEP:	192:34ogIwU8KUbaIjIr7v2Te9+LSckseQKLmZ:B8Kh/qmkkk
MD5:	1BD625022E9BECBD3F2F5BB50081F223
SHA1:	2D3254130623AC3C57E30934C22E568FBED39EFC
SHA-256:	17311A3211ACCF05DCE9FEC2F8685BEE0CB0B57C0D0C2EFF0C7BC20103EBF1B2
SHA-512:	8C826487026EA93B98E4A86396FC9EA7E62A9E509EC894E7FD69EA016026DBDF477A766CFD4F0E20B7D6F3A7F228D2836BFF6D601289239AF9DC44965BF6A437
Malicious:	false
Preview:	o....................................@....t...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.e.Z.d.S.)...Unittest main program.....N.........loader..runner....installHandlerT.....Examples:. %(prog)s test_module - run tests from test_module. %(prog)s module.TestClass - run tests from module.TestClass. %(prog)s module.Class.test_method - run specified test method. %(prog)s path/to/test_file.py - run tests from test_file.py..F...Examples:. %(prog)s - run default set of tests. %(prog)s MyTestSuite - run suite 'MyTestSuite'. %(prog)s MyTestCase.testSomething - run MyTestCase.testSomething. %(prog)s MyTestCase - run all 'test' test methods. in MyTestCase.c....................C.......t.j...\|...r>\|.......d...r>t.j...\|...r,t.j...\|.t.......}.t.j...\|...s(\|...t.j...r\|.S.\|.}.t.j...\|...d.d.......d.d.....d.d.

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\result.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	8019
Entropy (8bit):	5.221951584175691
Encrypted:	false
SSDEEP:	192:OmyPjwjYgT+8duMG4UJnYoKtFL6qMi+V+fxDjkqIAC6CE:Om+8duMG4UqoKtFLbMiNCE
MD5:	2679EC67463A944B2F232960CCACFB65
SHA1:	72D104AEB0AEE25AF845159290C96558A22E07E0
SHA-256:	6DD9FD992C088057AA38457C880F6E64908A80FAF18D79E962F179ADB1753875
SHA-512:	C2278CDD9BB85C1E24E36E3E3EF98920641F778296EE3D3432724917E131EBB803F14EE400C02F2C820EE166EB0C52B63931C3F2F012AF7CD9D2CFD58AF2778D
Malicious:	false
Preview:	o....................................@....\...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.Z.d.Z.G.d.d...d.e...Z.d.S.)...Test result object.....N.........util....wrapsTc.............................t.......f.d.d.....}.\|.S.).Nc............................t.\|.d.d...r.\|.........\|.g.\|...R.i.\|.....S.).N..failfastF....getattr..stop....self..args..kw....method....unittest\result.py..inner.................failfast.<locals>.innerr......r....r....r....r....r....r...................r.......Stdout:.%s...Stderr:.%sc....................@........e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d0d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d d!....Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d.S.)1..TestResult.....Holder for test result information... Test results are automatically managed by the TestCase and TestSuite. classes, and do not need to be explicitly manipulated by writers of tests... Each insta

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\runner.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6931
Entropy (8bit):	5.248517340962882
Encrypted:	false
SSDEEP:	192:2p3QAK966gc+Tya9a2YE857PzYzJBvZ8DDeCZ:Ug+GjzgZ+7Z
MD5:	6DD5E83CB6E63A5D76AD743752EA5AFF
SHA1:	B2A280726045DA2A4B5741AC6C7EC70879E0F046
SHA-256:	65D096D375D6CA0AA583F821CCE18A3D609E10492962BEBE9E187D10A885454E
SHA-512:	E3D6C275B12DC3EC01232FE16D5D688394A82C5088846EBAF3515C03E7CA5D21586AA73CF2FDECA303BF4AB6D6ADCA3AAEDE7630E3BE931F6B2AA10FAD912C8A
Malicious:	false
Preview:	o....................................@....n...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.d.S.)...Running tests.....N.........result....registerResultTc....................@....*...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)..._WritelnDecorator.@Used to decorate file-like objects with a handy 'writeln' methodc....................C........\|.\|._.d.S.).N....stream....selfr......r......unittest\runner.py..__init__............._WritelnDecorator.__init__c....................C........\|.d.v.r.t.\|.....t.\|.j.\|...S.).N..r......__getstate__....AttributeError..getattrr......r......attrr....r....r......__getattr__................._WritelnDecorator.__getattr__Nc....................C........\|.r.\|...\|.....\|...d.....d.S.).N.......write..r......argr....r....r......writeln................._WritelnDecorator.writeln..N....__name__..__module__..__qualname__..__doc__r....r....r'...r....r....r....r....r.......................r....c..................

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\signals.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	4.969601560478578
Encrypted:	false
SSDEEP:	48:gJHBZWet9+89VRayr0A8KLRmVGKKgKG2c1qpi/y7nILOWhlNUqAFTUSfDueh3:uZ3lpayJLRmVGngKG2cYpOCILJh3UqAD
MD5:	EAF6199531E47999CE248CD7FD620A8E
SHA1:	5F4D5324416C5600623158902504EAF94722E3FA
SHA-256:	155191C3DFBF7E593714EAB801D51BA0430EB268DAB616F828981A48202A5539
SHA-512:	997EB0C0717071EA2757AADEE6A0F400FFA64131D0C13FB13326ADF1740BF45150396C3EF695EA381502A3584BB3117004412C41C7AE30C10ED7E058057CBA09
Malicious:	false
Preview:	o....................................@....b...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.G.d.d...d.e...Z.e.....Z.d.d...Z.d.d...Z.d.a.d.d...Z.d.d.d...Z.d.S.)......N....wrapsTc....................@........e.Z.d.Z.d.d...Z.d.d...Z.d.S.)..._InterruptHandlerc....................C....N...d.\|._.\|.\|._.t.\|.t...r"\|.t.j.k.r.t.j.}.n.\|.t.j.k.r.d.d...}.n.t.d.....\|.\|._.d.S.).NFc....................S........d.S.).N....Z.unused_signumZ.unused_framer....r......unittest\signals.py..default_handler............3_InterruptHandler.__init__.<locals>.default_handler.Yexpected SIGINT signal handler to be signal.SIG_IGN, signal.SIG_DFL, or a callable object....called..original_handler..isinstance..int..signal..SIG_DFL..default_int_handler..SIG_IGN..TypeErrorr........selfr....r....r....r......__init__............................._InterruptHandler.__init__c....................C....R...t...t.j...}.\|.\|.u.r.\|...\|.\|.....\|.j.r.\|...\|.\|.....d.\|._.t.....D.].}.\|.......q d.S.).NT..r......getsignal..SIGINTr....r......_results..keys..sto

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\suite.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	10227
Entropy (8bit):	5.140155133352744
Encrypted:	false
SSDEEP:	192:8qmHNzaXVqRHqql43qBHqOgmrqsqmAjoqWqqjN3jqo4qdTrO4YmjwB32qlqTK3vT:8qmHNzEVqRHqqlgq1qFOqsqjoqWqqjNa
MD5:	43BC2D22B1173F9F7C06A3642252665D
SHA1:	43D50632904EB371EB6274F18B14016C0AFAE1CC
SHA-256:	B94033D8A40DC5E4DF7DE4FC30062D779FFAB42857946ED2E316E3D0301223B5
SHA-512:	758D5C545291771BC4E784ADEFC33ADEA29DDE80556E008A16D9A53743BB97A32D2138A98D86AF00ADDD48491FC5F19AA93372455D6369B490E86A0F0729C3A7
Malicious:	false
Preview:	o....................................@....\|...d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e...Z.d.S.)...TestSuite.....N.........case....utilTc....................C........t.\|.\|.d.d.....}.\|.....d.S.).Nc....................S........d.S.).N..r....r....r......unittest\suite.py..<lambda>............!_call_if_exists.<locals>.<lambda>....getattr....parent..attr..funcr....r....r......_call_if_exists.............r....c....................@....n...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseTestSuite.NA simple test suite that doesn't provide class or module shared fixtures.. Tr....c....................C........g.\|._.d.\|._.\|...\|.....d.S.).Nr........_tests.._removed_tests..addTests....self..testsr....r....r......__init__.................BaseTestSuite.__init__c....................C........d.t...\|.j...t.\|...f...S.).N..<%s tests=%s>..r......strclass..__cla

C:\Users\user\AppData\Local\Temp\_MEI69562\unittest\util.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	4518
Entropy (8bit):	5.453094527680093
Encrypted:	false
SSDEEP:	96:o39tnYIXVTmke36SkUhV9reD1yh5/VIx/8bhonJTu/YaL97eV:oXmHKSHHsZyDte/8Sk7haV
MD5:	41460F01DBF1B6915AE7996F5C08BF58
SHA1:	1CF1780CFB52AB1ECA4E10C966A01C019B4F79BA
SHA-256:	6282BBDD6CEFD9AE4A0BFD77EDB5123C7563B7FCC6B4E1E3CC141CE5B75F6315
SHA-512:	9E970A1CFE8AA22A94521252E21D83B851A33AFDBD33B66FE2827CFCB05A5024D2CCCBBA6315C759E1A02DD73393E90D6418E9F0BEF9E2D98784F09D412F3DC5
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.e.e...e...e...e.....Z.e.d.k.s.J...d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...Z.d.d...Z.d.d...Z.d.S.)...Various utility functions..........namedtuple..Counter....commonprefixT.P.............c....................C....B...t.\|...\|...\|...}.\|.t.k.r.d.\|.d.\|.....\|.\|.t.\|...\|...d.....f...}.\|.S.).N..%s[%d chars]%s....len.._PLACEHOLDER_LEN....s..prefixlenZ.suffixlen..skip..r......unittest\util.py.._shorten.............&...r....c............................t.t.t.\|.....}.t.t.t.\|.....}.\|.t.k.r.\|.S.t.\|.....t.......t.\|.....t...t.....}.\|.t.k.rJt.t...t...\|.......t.k.s8J...t...t.\|.....t.....f.d.d...\|.D.....S.t...t.t.....t.....f.d.d...\|.D.....S.).Nc....................3.... .....\|.].}...\|...d.......V...q.d.S.).Nr.........0r........prefixr....r....r......<genexpr>'.............'_common_shorten_repr.<locals>.<genexpr>c....................3....(.....\|.].}...t.\|...d.....t.t.....V...q.

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6047
Entropy (8bit):	5.481557258870835
Encrypted:	false
SSDEEP:	96:i/KVMbgcD9Q0jnB8sjM2oAHlnCu23QRlcLJCuhvPFor70SIGqUEV/vpyl+4bDZrH:LVIgchjjnasdCFCuh8iUE+TRrH
MD5:	941DEA6421262B6BE018B06E9E065403
SHA1:	82976FEE4970EE45D9A9E552F464157393B942BD
SHA-256:	EEE88C9D0A857FBE0DB2C025438DAF4C5CACC50F7B8466698EA85F4C9EF86827
SHA-512:	E445E2BBA8053EA5B5EA24CD9DBF5328CCF3C9FF9CDDD6D60FA694B0E3690E2650023C8961A5AEAF094C6AF517911B5951BDC2A885800EED08FFD6174D350A56
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)E.e.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more..........annotationsN....NullHandler.........exceptions...._TYPE_BODY....HTTPHeaderDict....__version__....HTTPConnectionPool..HTTPSConnectionPool..connection_from_url...._TYPE_FIELDS..encode_multipart_formdata....PoolManager..ProxyManager..proxy_from_url....BaseHTTPResponse..HTTPResponse....make_headers....Retry....Timeout..OpenSSL .Uurllib3 v2 only suppo

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\_base_connection.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5619
Entropy (8bit):	5.134285480344425
Encrypted:	false
SSDEEP:	96:H2irLsVlT4uElnZ12IND56MYLYrrN8//FLO4GdvN8I5PFwsiqpe:H22LsVl8uElZzxrK/+8I5PG1qpe
MD5:	C0A820008E79AE68F92C40BCF7F66617
SHA1:	495C55F61CDD5162CDA1337AF6721CCC22CDF8C6
SHA-256:	A339BAA7F11CDE4FA1D2400EED24A4717BEB7A4B8A0D02333783A2499EA9B665
SHA-512:	270A3756ECCF0B4A69CBF94E01E8C4BF4345ED1FCA3BB197A26A99C696E8EC9FEB4671F2DAC97E8D1F104621DA1B6513E61BEA5E366FF268AAF1E707DC1EFE9E
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rhd.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)..........annotationsN........._TYPE_SOCKET_OPTIONS...._DEFAULT_TIMEOUT.._TYPE_TIMEOUT....Urlc....................@........e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..bool..use_forwarding_for_https..None \| str \| Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r......urllib3\_base_connection.pyr.......................r....c....................@....6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..str..request_method..request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r ........................r .......Literal..Protocol....Bas

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\_collections.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	16125
Entropy (8bit):	5.3316351436147835
Encrypted:	false
SSDEEP:	384:dBUGURlWHyrzOGsPTRpQ2E14Qc87llrc0dj9ycM5On:iWozOLPTRpQDll40Na5C
MD5:	317F3EE23453230D589D5CA09D117C90
SHA1:	2F2AC53879E5BBED5042E5A5920AEEBD374FD97D
SHA-256:	066D807380850D30545F715925687A9FD04762A31B02CAB1B0771B08F6FD1ED9
SHA-512:	776AAA5DF9FA47272492831C5544D57F8823248C0F98BDD9F82623476C29037502E37931AFC44C4D35BCD2B181B49AE6844C4575A06FE1179F315406698054D2
Malicious:	false
Preview:	o....................................@....:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)..........annotationsN....OrderedDict....Enum..auto....RLock....Protocol....Selfc....................@.... ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S.).N......selfr....r......urllib3\_collections.py..keys.............HasGettableStringKeys.keys..key..strc....................C...r....).Nr......r....r....r....r....r......__getitem__....r.....!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r........__name__..__module__..__qualname__r....r....r....r....r....r....r...................r......RecentlyUsedContainer..HTTPHeaderDict.._KT.._VT.._DTc

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\_request_methods.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9075
Entropy (8bit):	5.243843075357384
Encrypted:	false
SSDEEP:	96:4jx2cO6oSxdCyJLLC/V9RddhTErRJ17fTR5oJkK7h3dSnPXW4XdbaRSpK2OHfRAQ:ogR6oSXCyQN9Xi7l5tKtABQSUH8U
MD5:	05FC866D130A64824FBA1065365344E7
SHA1:	6C0EF9495D22FDA1885FF08DC4AE1DBA622A1E74
SHA-256:	0DED994961BABFCD6A43CC0C22F6DFA589E45B88ED1A556EA830D73BBFBA9CD3
SHA-512:	2E1AF72F8497FA39C9AF03996C248DEFE93CEF0CA66053555D9F8AA83D4CC71C3401129561DA80956607EDF51E331C5034E35FDB62BDC443128E8238E75262C1
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.g.Z.e.j.e.j.e.j.e.e.j.e.e.f...f.....e.j.e.e.j.e.e.f...f...f...Z.G.d.d...d...Z.d.S.)..........annotationsN....urlencode........._TYPE_BODY....HTTPHeaderDict...._TYPE_FIELDS..encode_multipart_formdata....BaseHTTPResponse..RequestMethodsc....................@....p...e.Z.d.Z.d.Z.h.d...Z.d%d&d.d...Z.........d'd(d.d...Z.........d)d*d.d...Z.....d+d,d!d"..Z.........d'd-d#d$..Z.d.S.).r......... Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body`

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\_version.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.489379522053039
Encrypted:	false
SSDEEP:	3:ztWlVl1l3AlZfZZgMckmE/KEqcbULi6D5v6XrN42m2ECmFZ8ITmAtn:gNlQBZDa9ZOrSyiZ8Iztn
MD5:	23DD69572333B5F6DFC2D9DF0B14CF74
SHA1:	9EF447406B8E718DEBEF68CFA9F8B74E7B2D13BA
SHA-256:	983053914AE22405FA8D0A01056529F84093AA042356DAE9B8D961FD2A22E406
SHA-512:	5CB0C3A4A8A62A33E0555F038AD7F9036A281B43AB1143B790025BB3CAC94AF604D1F1FD9D2606CCEDE983E6F68D81923914A5A7A2FB136599095C1E71DFA0F6
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.Z.d.S.)..........annotations..2.2.1N....__future__r......__version__..r....r....z.urllib3\_version.py..<module>.............

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\connection.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	22199
Entropy (8bit):	5.5310883339968795
Encrypted:	false
SSDEEP:	384:hi0Q9B1iEP/Q8jJgyRRlpEqA1GsuU/TOIbItpD9zchZfiiT4ygVpMsFVc56Nfzez:htGg8tgyRRlpluGVU/a1OZfGjVpx6QNM
MD5:	717760DB8F440519FEE53F2F6DFA274A
SHA1:	F468D703B266798D5D59E6D86573FB658BB534CB
SHA-256:	D7AB01830F97BE7105D598ABCDAC85A3847A7DDE71EEB8866FDF2ABB681783DC
SHA-512:	76C88B6595877E08AD6763E94889FD83F44160AD869501FCAD2066381ADCB6A2F8A26DD932B51B6D186C5E06DDE40BE7E5097EDA8697F43AFE217A4EEE169996
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rYd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m Z ..d.d.l!m"Z"..d.d.l#m$Z$..z.d.d.l%Z%e%j&Z'W.n...e(e)f.y.......d.Z%G.d.d...d.e..Z'Y.n.w.d.d.l+m,Z,..d.d.l+m-Z-..d.d.l+m.Z...d.d.l/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7..d.d.l8m9Z9m:Z:m;Z;m<Z<..d.d.l=m>Z>..d.d.l.m?Z@..d.d.l.mAZAmBZBmCZCmDZDmEZE..d.d.lFmGZGmHZH..d.d.lImJZJ..eKZKeLZLe..MeN..ZOd.d.d ..ZPe..Qd!d"d...ZRe..Sd#..ZTeUe.d$..ZVG.d%d&..d&e...Z.G.d'd(..d(e...ZWG.d)d..d*e.jX..ZYd+d,..d_dFdG..ZZ.+d`dadNdO..Z[dbdTdU..Z\dcdVdW..Z]G.dXdY..dY..Z^e%..sSe^ZWeWZ_..ddded]d^..Z`d.S.)f.........annotationsN....HTTPConnection....HTTPException....ResponseNotReady....timeout....Literal.........HTTPResponse...._TYPE_PEER_CERT_RET_DICT....SSLTransport....HTTPHeaderDict....assert_header_parsing...._DEFAULT_TIMEOUT.._TYPE_TIMEOUT..Timeout..

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\connectionpool.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	29208
Entropy (8bit):	5.473264805894626
Encrypted:	false
SSDEEP:	384:bq25MeJti2OY4K7zBMs3rzYIi4MnVR4T7iLX1XkFCDD2rz38xyRj0H9ainyKZ2m:fVQ234K7zBMiEVOT77bSyS
MD5:	7C0E934D9624B236CDB827FBA7B9D574
SHA1:	2E7BFCB0CE67892596A66A197A50FD74B7356496
SHA-256:	E75E1FC5894AC91B67324E10F257A3A08650C0A8F7C8C56B97BD91E782C92D0E
SHA-512:	BC06E5D686471BEC5CAAB3E59250E5DA45313225474BAC65AF007EEB5FB52C1AEA04CBA948A5900D761E89C41CB12080E4690071B4E1957194F94A96ADCBE058
Malicious:	false
Preview:	o....................................@....`...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.l.mGZG..d.d.l.mHZHmIZI..e..JeK..ZLe.jMe<eNe;d.f...ZOe..Pd...ZQG.d.d...d...ZRe.jSe.jTh.ZUG.d.d...d.eRe...ZVG.d.d...d.eV..ZWd7d%d&..ZXe.jYd8d+d,....Z@e.jYd9d-d,....Z@d:d.d,..Z@..d;d<d2d3..ZZd=d5d6..Z[d.S.)>.........annotationsN....timeout....TracebackType........._TYPE_BODY....HTTPHeaderDict....RequestMethods....BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error....port_by_scheme....ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.6644389312533505
Encrypted:	false
SSDEEP:	3:ztWlulehlra4lPlPlX3MZIOkcTg/lz:gqeho4B+RMh
MD5:	D27AE83BB729474CCF92E75575F9B1A4
SHA1:	05BE518D1E3C9FACEAE2FF99C937306A575FAA87
SHA-256:	59B1C45F941F5E35702A6BDFC3B344DCEB91B7367E4BB113BC3E37CBC0A1B61F
SHA-512:	F1872E667FA3A442A274530B7667B5BCD780B0BEC5538ED85C856E53CD8D9FC3A49D38C3C2D6C6C330BB999E45767B66E86639BF2D77254FBAF4553B4AA51DF9
Malicious:	false
Preview:	o....................................@........d.S.).N..r....r....r....z.urllib3\contrib\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\emscripten\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	659
Entropy (8bit):	4.866851249455391
Encrypted:	false
SSDEEP:	12:gVNTptML6abIwicpOiMNHsvLGJcrizhr+VY2yEM7EH/oJn:gnZEbLGJai8nyEwEH/cn
MD5:	83D53DA43771A4B550326EAF447BC9C9
SHA1:	7031CC30C3A34C3EF919920A9738F92B5672CE78
SHA-256:	72F7F5766EB1800FF8BC779A88F4A2988C509B73EDB202345A00EFECB8BB8835
SHA-512:	54881A2EE9BF3EB405847340C67741DB2B43E07520CDA7963322701232D4DC7BB76B6E0EF056E2474F6D5895FF0CBE7A766610BFCC4B1C60F74C98A182B649E0
Malicious:	false
Preview:	o....................................@....B...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.S.)..........annotationsN.........HTTPConnectionPool..HTTPSConnectionPool.........EmscriptenHTTPConnection..EmscriptenHTTPSConnection..return..Nonec....................C.... ...t.t._.t.t._.t.t.j._.t.t.j._.d.S.).N..r....r......ConnectionClsr....r......urllib3..connection..HTTPConnection..HTTPSConnection..r....r.....&urllib3\contrib\emscripten\__init__.py..inject_into_urllib3.................r......r....r........__future__r....Z.urllib3.connectionr......connectionpoolr....r....r....r....r....r....r....r....r....r......<module>...................

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\emscripten\connection.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7505
Entropy (8bit):	5.3151911732743145
Encrypted:	false
SSDEEP:	96:6i4G/GLAgP1QZVvCEERx3GK4lbJeABu7+r7NdRLGXFXzu5fU+BkWHJotdZ3slH7F:6hGFnZVviGK45tr0X9kzqEJodZE7g+
MD5:	50FF1ABAAE9C5ED7C27672DBC012F7CD
SHA1:	69A7941541E83C42F9106092B3F039727625EC8C
SHA-256:	23F84B4831B91B063EAFBEF1E8FF3941D5CC51CEA60B046B6BA398A69CAC1B1B
SHA-512:	6D9C6D4920A4CDFB93748BAC86C368DC10FF7E83821EB9FF78E82565B3EE35F9C42F54196605AE616A311851708E2E1971E67322CF97A0438D4D40A679E9E641
Malicious:	false
Preview:	o....................................@....0...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z ..e.j!rpd.d.l.m"Z"m#Z#..G.d.d...d...Z$G.d.d...d.e$..Z%e.j!r.e$d.d...Z&d.e'd.<.e%d.d...Z(d.e'd.<.d.S.d.S.)..........annotationsN....HTTPException....ResponseNotReady........._TYPE_BODY....HTTPConnection..ProxyConfig..port_by_scheme....TimeoutError....BaseHTTPResponse...._TYPE_SOCKET_OPTIONS...._DEFAULT_TIMEOUT.._TYPE_TIMEOUT....Url........._RequestError.._TimeoutError..send_request..send_streaming_request....EmscriptenRequest....EmscriptenHttpResponseWrapper..EmscriptenResponse....BaseHTTPConnection..BaseHTTPSConnectionc....................@........e.Z.d.Z.U.e.d...Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.Z.d.e.d.<.d.Z.d.e.d.<.d.e.d.<...dDe.d.d.d.d.d.d...dEd#d$..Z.......dFdGd)d*..Z.dHd+d,..Z.....dId.d-d-

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\emscripten\fetch.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11805
Entropy (8bit):	5.410419796826287
Encrypted:	false
SSDEEP:	192:UeaoJCSD26bP4KKb48PKH+wL9Bben3Ti27x+/DLk6dOFezzzYXsvwooWCQ:UeFJCSbbP4KfBmhyHIFeznY8YooWCQ
MD5:	922E2524C6D6E5AA028CADF148D6D9BC
SHA1:	56FFFB4A598C2F81F50053F7C955481EF174983A
SHA-256:	79B8F2AC4716677B220A46C2C6E9B9A066E54A702E606AF8D9AF7CA35A927352
SHA-512:	0662FF05AA988AAAA28F8D8355B1B238F0CFFCEDBE418FAA6122D1C650DB48D22C916D3F53F24CC8E924B39EEF6A6F079FD1F66B5D4FE8ABA06E766E55C0942E
Malicious:	false
Preview:	o....................................@.......U.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...e.r=d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.Z.d.Z.d.Z.d.Z.d.Z.e.e.....d...j.d.d...Z G.d.d...d.e!..Z"G.d.d...d.e"..Z#G.d.d...d.e"..Z$dBd.d...Z%G.d d!..d!e.j&..Z'G.d"d#..d#..Z(dCd%d&..Z)dCd'd(..ZdCd)d..Z+dCd+d,..Z,d.Z-d-e.d.<.e,..r.e*..r.e)..s.e+..s.e(..Z-n.d.Z-dDd2d3..Z/d4a0dEd6d7..Z1d4a2dEd8d9..Z3dFd;d<..Z4dGd>d?..Z5dCd@dA..Z6d.S.)H......Support for streaming http requests in emscripten...A few caveats -..Firstly, you can't do streaming http in the main UI thread, because atomics.wait isn't allowed..Streaming only works if you're running pyodide in a web worker...Secondly, this uses an extra web worker and SharedArrayBuffer to do the asynchronous fetch.operation, so it requires that you have crossOriginIsolation enabled, by serving over https.(or from localhost) with the two headers below set:.. Cross-Origin-Opener-Policy: same-ori

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\emscripten\request.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.031104444539522
Encrypted:	false
SSDEEP:	24:gAY9bwibJeht6t4npGLKn3WwINY55OF1rC9:gvwi4X6CpGmnGYmF18
MD5:	58A97CE98243B48E564199C9620C9A01
SHA1:	598C8C3E6DD423CCEDDD446297F3D7E12937649F
SHA-256:	C6109DFBBFD3497C8887609A23348C0D4DA3D94846A4EB3F25BD14EE1F596617
SHA-512:	2F8C12990AE623C10C9D721AABD9CF0AC4195F5BA8123E82C94E383C58BDDBB0BE3550755D270B2FC33A62285B7F9F7398C6E5B4394422E44971E5F127C42EBD
Malicious:	false
Preview:	o....................................@....>...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.G.d.d...d.....Z.d.S.)..........annotations....dataclass..field........._TYPE_BODYc....................@....t...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.Z.d.e.d.<.d.Z.d.e.d.<.e.e.d...Z.d.e.d.<.d.Z.d.e.d.<.d.Z.d.e.d.<.d.d.d...Z.d.d.d...Z.d.S.)...EmscriptenRequest..str..method..urlN..dict[str, str] \| None..params.._TYPE_BODY \| None..body....default_factory..dict[str, str]..headersr......float..timeoutT..bool..decode_content..name..value..return..Nonec....................C........\|.\|.j.\|.....<.d.S.).N..r......capitalize....selfr....r......r%....%urllib3\contrib\emscripten\request.py..set_header.............EmscriptenRequest.set_headerc....................C........\|.\|._.d.S.).N..r......r$...r....r%...r%...r&.....set_body.............EmscriptenRequest.set_body..r....r....r....r....r....r......r....r....r....r........__name__..__module__..__qualname__..__annotations__r....r....r......dictr....r....r....r'...r-...r%...r

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\emscripten\response.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	7673
Entropy (8bit):	5.3676890758222155
Encrypted:	false
SSDEEP:	192:Dhgev5/deW6Qfihbl2pfhNC5SyfQQj9Vdn3aNHo8:Dhzv5/H6FbWheIQj1n3P8
MD5:	3AB1583DD2252FAB3B142CC8CBBFEB36
SHA1:	736992F92804C3E3E3D7DE2C214C2B83ABF4323A
SHA-256:	2828FFDC9E2B763BF19AD32F4ED944E0681A77F697C97ADF0C5656A92D28B37E
SHA-512:	F2F82FEFB5F74B35BAC9E85FA629158E7BBAF9898C70194D6DDC7CF4BC80613D1396F78D70DDF5F26B385F0EBE2225415317F489EB33F9D8CCE28C46714C5395
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rQd.d.l.m.Z.m.Z...e...e...Z.e.G.d.d...d.....Z.G.d.d...d.e...Z d.S.)..........annotationsN....contextmanager....dataclass....HTTPException....BytesIO..IOBase.........InvalidHeader..TimeoutError....BaseHTTPResponse....Retry.........EmscriptenRequest....BaseHTTPConnection..BaseHTTPSConnectionc....................@........e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...EmscriptenResponse..int..status_code..dict[str, str]..headers..IOBase \| bytes..bodyr......requestN....__name__..__module__..__qualname__..__annotations__..r...r....&urllib3\contrib\emscripten\response.pyr.......................r....c.............................e.Z.d.Z.....d7d8..f.d.d...Z.e.d9d.d.....Z.e.j.d:d.d.....Z.e.d;d.d.....Z.e.d<d.d.....Z.e.j.d=d.d.....Z...d>d?d.d...Z.d@d.d ..Z......!dAdBd%d&..Z.....d7d?d'd(..Z.dCd)d*..Z.dCd+d,

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\pyopenssl.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17028
Entropy (8bit):	5.582499126263445
Encrypted:	false
SSDEEP:	384:tO0nuUKS9OCLhbrERGN8UrcLN0IDIGvdH+Iwa5sqp/Az8BDKtvHFsjvWxkzKpHWY:tGUrICLlEsN8ycp0IDIGvdH+Iwa5sqlS
MD5:	C689AA7A3A3D6EBF1A643D616428B695
SHA1:	CC125DA2890702F0696EC0414717055FCB708668
SHA-256:	FE0E8EB5A5BE9B43D0B3B930A9AFDBBC0924402BE81B3E2891850FB0C4C9F2E6
SHA-512:	B507A7329DEEAFF024F9756F44C41B89E4117EFEF900DFDE946B4069F65707B0D1905468F62935AC9FC23A81E37630CE2468E968AEF3C220181A2DCE0A86A964
Malicious:	false
Preview:	o....................................@....(...U.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y,......G.d.d...d.e...Z.Y.n.w.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rZd.d.l.m.Z...d.d.g.Z.e.j.j.e.j.j.e.j.j.e.j.j.e.j.e.j.j.i.Z d.e!d.<.e"e.d...r.e"e.j.d...r.e.j.j#e e.j$<.e"e.d...r.e"e.j.d...r.e.j.j%e e.j&<.e.j'e.j.j(e.j)e.j.je.j+e.j.je.j.j,..i.Z-d.d...e-....D...Z/e0e.j.d.d...e0e.j.d.d...B.Z1d.e!d.<.e0e.j.d.d...Z2d.e!d.<.e0e.j.d.d...Z3d.e!d.<.e0e.j.d d...Z4d.e!d!<.e0e.j.d"d...Z5d.e!d#<.e.j6j7e1e.j6j8e1e.j6j9e1e2B.e.j6j:e1e2B.e3B.e.j6j;e1e2B.e3B.e4B.e.j6j<e1e2B.e3B.e4B.i.Z=d.e!d$<.e.j6j7e1e2B.e3B.e4B.e5B.e.j6j8e1e3B.e4B.e5B.e.j6j9e1e4B.e5B.e.j6j:e1e5B.e.j6j;e1e.j6j<e1i.Z>d.e!d%<.d&Z?e.j.j@ZAe..BeC..ZDdDd)d...ZEdDd*d...ZFdDd+d,..ZGdEd0d1..ZHdFd5d6..ZIG.d7d8..d8..ZJe.jKeJ_KG.d9d:..d:..ZLdGdBdC..ZMd.S.)H......Module for using pyOpenSSL as a TLS backend. This module was relevant before.the standard library ``ssl`` module supported SNI, but now th

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\contrib\socks.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6100
Entropy (8bit):	5.621334682261799
Encrypted:	false
SSDEEP:	96:Yq8beojUEqiHSPkwAWZMGhRl/kF+4WvwFmC69f6pEs5sOl8zp:DxVEqtcX4/kg9fwF8p
MD5:	47DA3872B3A49B5DEBF0667AF5DEA80F
SHA1:	6F7E8ED5C906980731E9BEB4F77262BCF1BB802A
SHA-256:	ED3AC16B6E630111B62FB4E06ADB2047F62B7B0652BD66134BA6C35C0084CF03
SHA-512:	0B8091168E837D45E66573751431C70C228B59F45B271B0EE6D52904218CF5E340E346BCFFED435C5346D85A6C82AD162C55867545F471C77F06D2A05C596313
Malicious:	false
Preview:	o....................................@....@...d.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.y&......d.d.l.Z.d.d.l.m.Z...e...d.e.......w.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yf......d.Z.Y.n.w.d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.S.)......This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. I

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\exceptions.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	13168
Entropy (8bit):	5.011348513548979
Encrypted:	false
SSDEEP:	192:OWAvjpLLD6gbFQDWM6iB7e+stsnosGmqidtOyzAhfoUhb4SrV:OJDcDD6i1e+GCGmqi7OyzAhgub4SB
MD5:	D8FE64AA34140037FB60781F041861C1
SHA1:	EC4829029B461335748F737189E3CA1F80C8F80F
SHA-256:	345EB11E01D21F529AE6A8134968A9D5E1BC99AAA5CF4260E6DC5EECC9776D61
SHA-512:	3E560C566E5C1B30A3FE7DCA2ADC777E03019CF5F3EC1CA9B4839833EB15D7AA091623654E34F2AF2497CB6E1B6F57E079BB1CCC623452109D7DF004C0BE5ECA
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.........annotationsN....MessageDefect....IncompleteRead.........HTTPConnection....ConnectionPool....HTTPResponse....Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\fields.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9655
Entropy (8bit):	5.407936627884424
Encrypted:	false
SSDEEP:	96:Mm/pD2Dm9fY77oYfP+qmxdpeOLG1h/4Ej6riosUWta+J7nnlRDl31Kpm9BuKf9g1:MIkBoct8dGLEiFUsdAKaZf
MD5:	0B16F5BFDDD55750950301CE04721CE7
SHA1:	7E82FCF2FA46A9637708BF967EB7641C06501F61
SHA-256:	562EA96C99A5FC5D6795D5EC2C49F4BC77F9F9BAF88DD81F9E8AD8F20BED8E16
SHA-512:	19FC0E97B9C7693FE706C2380E054EEF431A652D9014DF562BCE08403186CAFEE4FA4E806D542294DFED868554455389F3B07946CCA233CB5A632F95A43F4082
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.e.f...Z.e.j.e.e.j.e.e.f...e.j.e.e.e.f...f...Z...d.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.S.)..........annotationsN..application/octet-stream..filename..str \| None..default..str..returnc....................C........\|.r.t...\|...d...p.\|.S.\|.S.).... Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. r........mimetypes..guess_type..r....r......r......urllib3\fields.py..guess_content_type...............r......name..value.._TYPE_FIELD_VALUEc............................d.d.l.}.\|.j.d.t.d.d.....t...t...r.....d.....t...f.d.d...d.D.....s=\|...d.....d...}.z.\|...d.....W.\|.S...t.t.f.y<......Y.n.w.t.j.....d.....\|...d...........S.)...... Helper function to format and quote a single header parameter using the.

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\filepost.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2287
Entropy (8bit):	5.56569358103639
Encrypted:	false
SSDEEP:	48:g/JhfLQuUKjcuCKgaTxE1C2GSRo8bCGyQUpz:WL1Zc5IxEA2KjWU9
MD5:	D6EAA33D6AC6CA936BBCD49EBFE314AF
SHA1:	CB6DE8C114496624CEBBB941774753A7C33CB662
SHA-256:	EE47067FE9CC5CFE5BF970540B5B7F597A5BC1A50ADB5CF1CCB08CFE79AA6102
SHA-512:	E65EC323473122DB85565025890C15686811B241553B5C85304F2F21D623B236FF30DB476C3A14BDD585F75D02A9323B5E775A6454C0CC1588C2AD49EE75D758
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...d...d...Z.e.j.e.j.e.j.e.e.f...e.f.....Z.e.j.e.e.j.e.e.f...f...Z.d.d.d...Z.d.d.d...Z...d.d.d.d...Z.d.S.)..........annotationsN....BytesIO........._TYPE_FIELD_VALUE_TUPLE..RequestField..utf-8.......return..strc....................C........t...t...d.........S.)..N. Our embarrassingly-simple replacement for mimetools.choose_boundary.. .........binascii..hexlify..os..urandom..decode..r....r......urllib3\filepost.py..choose_boundary...........r......fields.._TYPE_FIELDS..typing.Iterable[RequestField]c....................c....H.....t.\|.t.j...r.\|.....}.n.\|.}.\|.D.].}.t.\|.t...r.\|.V...q.t.j.\|...V...q.d.S.).... Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... N....isinstance..typing..Mapping..itemsr......from_tuples..r......iterable..fieldr....r....r......iter_field_objects.................

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\poolmanager.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	18158
Entropy (8bit):	5.512305757124418
Encrypted:	false
SSDEEP:	384:0RCIw508FG/7AZfYmM2iu10LHzp4QvXWE05:fFU7AZQnjzzphWEM
MD5:	23E0C3B4BAC4D2895C6FC520FDC9F90E
SHA1:	877A2ECA90278086CED39CA748AD211633774C41
SHA-256:	6A80EF5D06BF074A14EAC675AB29414150C1285358730FA7B90D1D373497814E
SHA-512:	FDD579ED4B833DD72E0503F50032A47751B129C102CFD8CF40C4249B90146E849D13CB146392BD4BA155A116FD3DE255640415894EE04B8FBE21E4A643CD088F
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..e.j'r.d.d.l(Z(d.d.l.m)Z)..g.d...Ze..+e,..Z-d.Z.d.Z/e..0d...Z1G.d.d...d.e.j2..Z3dd.d...Z4e..5e4e3..e..5e4e3..d...Z6e.e.d...Z7G.d d!..d!e...Z8G.d"d#..d#e8..Z9d+d(d)..Z:d.S.),.........annotationsN....TracebackType....urljoin.........HTTPHeaderDict..RecentlyUsedContainer....RequestMethods....ProxyConfig....HTTPConnectionPool..HTTPSConnectionPool..port_by_scheme....LocationValueError..MaxRetryError..ProxySchemeUnknown..URLSchemeUnknown....BaseHTTPResponse...._TYPE_SOCKET_OPTIONS....connection_requires_http_tunnel....Retry....Timeout....Url..parse_url....Literal....PoolManager..ProxyManager..proxy_from_url....key_file..cert_file..cert_reqs..ca_certs..ca_cert_data..ssl_version..ssl_minimum_version..ssl_maximum_version..ca

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\response.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	32791
Entropy (8bit):	5.372701310101964
Encrypted:	false
SSDEEP:	384:FMBbYje/pGiZEUXIIAbRbVEX9uJr/YVl2sAGR5wJEn1H/bE1diD661gPNZ0UvTGT:FGpGo4bR7Y2sAGRiJE5IaD1gPNlb0D
MD5:	1585E73ADD9F5CCC00919089DFED2A0B
SHA1:	D41A955CEC050E89C8DC685AB614D5D659776F8A
SHA-256:	DDBEF53D3E4975076399F1C6A828075505501D50947543130838ED93D4FB88CC
SHA-512:	D43CC2C32DB3EB26C5B1060633234052CB35BFA6C19CD842E375A148497A6099D6621996958DC3BDAE01301C0129A26EE51708040C2D6CC74A4B402B49DDC023
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.e.e.e e..!d.e.j"...#........Z$Z$e$d.k.r.d.Z.W.n...e%e.e&f.y.......d.Z.Y.n.w.d.d.l'm(Z(..d.d.l.m)Z)..d.d.lm+Z+..d.d.l,m-Z-m.Z.m/Z/..d.d.l0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:..d.d.l;m<Z<m=Z=..d.d.l>m?Z?..e.j.r.d.d.l.m@Z@..d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe.d.u...r&G.d.d...d.eF..ZKG.d d!..d!eF..ZLd-d%d&..ZMG.d'd(..d(..ZNG.d)d..d*e.jO..ZPG.d+d,..d,eP..Z.d.S.)..........annotationsN....contextmanager....HTTPMessage....HTTPResponse....timeout.........BaseHTTPConnection..^([0-9]+)\.([0-9]+)..r.............util...._TYPE_BODY....HTTPHeaderDict....BaseSSLError..HTTPConnection..HTTPException....BodyNotHttplibCompatible..DecodeError..HTTPError..Inco

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	900
Entropy (8bit):	5.233808664659235
Encrypted:	false
SSDEEP:	24:gHUVegJzLyYhRYQZyiupgKepF4A89HMlu:gFgJz2Y39ZyiUoK5r
MD5:	8707F833B69FBEEC9470FF0558343719
SHA1:	49D9F6735C5BB2BAEBA855A3F8359B4714109815
SHA-256:	38D4D61E7FD36F6BBFA058E9970F4B6E1747A4FB40F6CAD0BD9479894851165C
SHA-512:	F945731B95596DA65F46EC76C457A2D6040A02EE171ED22CA4E4784FEC5408BB0878BC124647BD8F85E39E9722FAF94AF38D1F485CC43C6417E12295FF3CE5F8
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)..........annotations.........is_connection_dropped....SKIP_HEADER..SKIPPABLE_HEADERS..make_headers....is_fp_closed....Retry....ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket....Timeout....Url..parse_url....wait_for_read..wait_for_write..r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r ...r....r....N....__future__r......connectionr......requestr....r....r......responser......retryr......ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r .....__all__..r-...r-...z.urllib3\util\__init__.py..<module>...................(.........

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\connection.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3423
Entropy (8bit):	5.549180076006682
Encrypted:	false
SSDEEP:	96:L+kX8Cm+hAVwwStdnd2Cmv5WHiuL1WUxKOkTw:1hfjQ59uJ9xKOkTw
MD5:	972EA2AC6A03D7D145D3251842CC6E0F
SHA1:	D3A36730D79653912DD66C0CA8AEF1A79656963E
SHA-256:	9DF1813CA71797FA79EF3B0053435D0C06F53B2576667F42E5B9B787C39B8376
SHA-512:	884D22B47ED35CB9E813E162FEF0E737E39DC7CC40CDF726ECC99F33A69E7416DDC0842A9801BD0865A90539ED09F751DA3612390E7E332DAA5258FFDEE30AB3
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.........annotationsN.........LocationParseError........._DEFAULT_TIMEOUT.._TYPE_TIMEOUT....BaseHTTPConnection..connr......return..boolc....................C........\|.j...S.).... Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. ....is_connected..r......r......urllib3\util\connection.py..is_connection_dropped...........r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C....$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.\|.\|.....\|.t.u.rU\|...\|.....\|.r\\|...\|.....\|...\|..

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\proxy.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	5.325286043577025
Encrypted:	false
SSDEEP:	24:g9pGf5n/Owt84RzmQXvAFnT8adJVdzTJn:gCt/Rt82m38anVhJ
MD5:	8D928C33A9C5CD213F2AD3ACF9C1B790
SHA1:	00C6FFA1A26C3CA3E1C53BE1DBEA1DF9AFC6132B
SHA-256:	00CF932C81A10C402CC9278B4282F490D55BFFAEB6E856FC9D7655BAE249E6C3
SHA-512:	025493B195910C9833141889CD176547394FB9C69DEA2E445C23165D49787FB4FA79AFBA9F8362D687B532C35DCBD875C33F9494CB31CBD6947A6836BB89513C
Malicious:	false
Preview:	o....................................@....H...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.........d.d.d.d...Z.d.S.)..........annotationsN.........Url.........ProxyConfig..proxy_url..Url \| None..proxy_config..ProxyConfig \| None..destination_scheme..str \| None..return..boolc....................C....4...\|.d.u.r.d.S.\|.d.k.r.d.S.\|.j.d.k.r.\|.r.\|.j.r.d.S.d.S.)..?.... Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). NF..http..httpsT....scheme..use_forwarding_for_https..r....r....r......r......urllib3\util\proxy.py..connection_requires_http_tunnel...............................r......NNN..r....r....r....r....r....r....r....r........__future__r......typing..urlr......TYPE_CHECKING..connectionr....r....r....r....r....r......<modu

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\request.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	6159
Entropy (8bit):	5.639742546427224
Encrypted:	false
SSDEEP:	96:rj+t5EbNiDK4DKYV1Q2P7fsWkmWxT75jmGyT/kjKnzMyEMbsrHMCtkpT7LIt1ptk:WCgK4DKYzP7XWxTsAjKnYRM4HqTU1pW
MD5:	70EE2EBE2C8F4011CA84E59D6DF17E00
SHA1:	31E02B2B3A3D15E12CC1FDC34DF50216698E8202
SHA-256:	92CDB9E7CF7B7071CA749C19C0239C1323EF1B519D5A89DBA6394457FAC04F78
SHA-512:	25C9D1A469C0D18135DF00968B0770846BE6824C08FAF355C65A9B58D5544617B0C188A8D03079263C11B4411F9BFC71F42CCBE3BCC1CB53B230016CB1C4C16D
Malicious:	false
Preview:	o....................................@....d...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.........annotationsN....b64encode....Enum.........UnrewindableBodyError.........to_bytes....Final..@@@SKIP_HEADER@@@....accept-encoding..host..user-agent..gzip,deflate..,br..,zstdc....................@........e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N....__name__..__module__..__qualname__..token..r ...r .....urllib3\util\request.pyr....'............r......Final[_TYPE_FAILEDTELL].._FAILEDTELL.......TRACE..OPTIONSZ.CONNECT..GET..HEAD..DELETE..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_auth..proxy_basic_auth..disable_cache..return..

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\response.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	5.367942309945
Encrypted:	false
SSDEEP:	48:grmhh16Yefb2+Nk7gkL2asBm7ChemXax6nrBf58lhC:r67fb2slP6Izx
MD5:	F702CE29A000D9DE81B7BFE636AEFE31
SHA1:	CA7074DACA37173F52B20315E44949F42EBB5749
SHA-256:	7502C04025A811B624175B3ECC6319C8B778848627183C1308A5670507063EBC
SHA-512:	E937ED01AC4E0C922E2494A09279D34D47A501ABB64CB37EC2534A5C71E69CAB1038673F7E2E53F8E986B181999260744348F6AE315F70102F75EDF27CC342A1
Malicious:	false
Preview:	o....................................@....V...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..........annotationsN...!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.........HeaderParsingError..obj..object..return..boolc....................C....`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.)..t. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. N.)Unable to determine whether fp is closed.....isclosed..AttributeError..closed..fp..ValueError..r......r......urllib3\util\response.py..is_fp_closed..... ...................................r......headers..httplib.HTTPMessage..Nonec....................C....n...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.)..>.... Asserts whether all headers have been successfully parsed.. Extracts encountered errors from

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\retry.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	15614
Entropy (8bit):	5.376872439833585
Encrypted:	false
SSDEEP:	192:6/O8t12FuuccXjtRLJIkmuhvCRJUR9mP5be+UkTf2C2sCOexBKb99YV0R:LsuPVtvCR+SP5e+U2o0R
MD5:	BE624FBCE3D6E8C849EADC013C2D8BCF
SHA1:	A5B704708B5D18390F4668F096D8D2794A0F2FB1
SHA-256:	E91AC284496D923D8D13E82A8D886BE89A7A5744204F35ADEFC0189F87F66024
SHA-512:	71576E7EC0EC156A037280C7218F9B481454E4CFBD0AA307EFA6642FCF1D4FABF2834A3177AD0C3A8118A46EEF4AD462D2F69A78E8522367A2C4244841BA4728
Malicious:	false
Preview:	o....................................@........d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rQd.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z e d...e _!d.S.)..........annotationsN....takewhile....TracebackType.........ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.........reraise....ConnectionPool....BaseHTTPResponsec....................@....6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN....__name__..__module__..__qualname__..__annotations__..r(...r(.....urllib3\util\retry.pyr.........................r....c....................@...."...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.d.d.g...Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd(d)..Z.dcd,d-..Z.e.....ddded1d2....Z.dfd3d4..Z.dgd7d8..Z.dhd<d=..Z.di

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\ssl_.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12238
Entropy (8bit):	5.70465165162177
Encrypted:	false
SSDEEP:	192:kTqTU+SiPE9oeENEPrN642IcfFqEdwaBaUR2PG7g+zYyJK9ETHY2V6yKz42tO31H:EmU+Ss+xEO642I0M009PG7g+JJK9CBVp
MD5:	982159696482A1439DB4DF0C951F6CE3
SHA1:	2F01F66932CCE1AF3F6C888C8A837A250B230B02
SHA-256:	3A3001E25984322698EF3748DF79FE30122CC66986EAFA0B9872E1202C2845BF
SHA-512:	840BAE864F42AF80986E0FAC583441ED742AB1982F840BA6F64ED861704907DF30998311A24873100BEBB4F5EBAA0956BA1AD14F1210E1CF36ADB6B479DB7D1B
Malicious:	false
Preview:	o....................................@........U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.e.e.e.d...Z.dbd.d...Z.dcd.d...Z.e.j r.d.d.l!m"Z"..d.d.l.m#Z#m$Z$..d.d.l%m.Z&..G.d.d...d.e$d.d ..Z'i.Z(d!e)d"<.z_d.d.l!Z!d.d#l!mZm.Z.m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m.Z.m3Z3..e/Z4e.r.e.e-e.e.j5j6e.j7e.j5j6d$k.r.e.j8n.d...s.d.Z.d%D.].Z9z.e:e3e9..e(e:e!d&e9......<.W.q...e;y.......Y.q.w.d.d.l%m.Z...W.n...e<..y.......d'Z+d(Z,d)Z1d*Z2d...Z4Z/d+Z0Y.n.w.e.j=d.e>d.f...Z?ddd0d1..Z@ded5d6..ZAdfd7d8..ZB............dgdhdBdC..ZCe.jD.D.D.D.D.D.D.D.D.D.D.D.DdidjdTdU....ZEe.jD.D.D.D.D.D.D.D.D.D.D.D.DdidkdWdU....ZE........................dldkdXdU..ZEdmd[d\..ZFdnd^d_..ZG..dodpd`da..ZHd.S.)q.........annotationsN....unhexlify....md5..sha1..sha256.........ProxySchemeUnsupported..SSLError........._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REF..http/1.1... ....(....@.....implementation_name..str..version_inf

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\ssl_match_hostname.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3655
Entropy (8bit):	5.71631284022516
Encrypted:	false
SSDEEP:	96:gY/R/QukAMdqA+v1rDr23L4fyRGH0QP87b8nrprF:gHdA/9rnvjHCStF
MD5:	1D1012BB0592D366929F3A9FFF58780F
SHA1:	32C64F3A82BDDAE6908C58D0A894919A0B46D745
SHA-256:	220DF9A593F1731EB7F1AF0C86760AC04946E3BC6FD845D7F9B7F33F70A0660A
SHA-512:	C44D58763D0CB54C1A97D08BFDED2AA0722375590BF168D2CBF484E702550BBC74E15F2A25D1711EBA18C67A034C2AA52D4BB3F750675CC029FE94845A24F071
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.j.r%d.d.l.m.Z...d.Z.G.d.d...d.e...Z...d!d"d.d...Z.d#d.d...Z...d$d%d.d ..Z.d.S.)&.HThe match_hostname() function from Python 3.5, essential when using SSL..........annotationsN....IPv4Address..IPv6Address........._TYPE_PEER_CERT_RET_DICT..3.5.0.1c....................@........e.Z.d.Z.d.S.)...CertificateErrorN....__name__..__module__..__qualname__..r....r....."urllib3\util\ssl_match_hostname.pyr.................r......dn..typing.Any..hostname..str..max_wildcards..int..return..typing.Match[str] \| None \| boolc....................C........g.}.\|.s.d.S.\|...d...}.\|.d...}.\|.d.d.....}.\|...d...}.\|.\|.k.r&t.d.t.\|.........\|.s2t.\|.....\|.....k...S.\|.d.k.r<\|...d.....n.\|...d...sF\|...d...rO\|...t...\|.......n.\|...t...\|.....d.d.......\|.D.].}.\|...t...\|.......q]t...d.d...\|.....d...t.j...}.\|...\|...S.)..hMatching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/html/rfc6125#section-6.4.3. F..

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\ssltransport.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9507
Entropy (8bit):	5.316206156676416
Encrypted:	false
SSDEEP:	192:WfXcuKX0qHS8/UNbHirgC+JI/lCouB1srDYuA6T5zEB5uY3:klKDHS8mbHiVl/ks/7gB5uY3
MD5:	5408F507EF489132383507C1B2A82F4D
SHA1:	950FB6A5F7D6D6D1410525AAD5AF1CA0A05044C2
SHA-256:	701077209657D4ED74E0407B6E517270F426D54A807BFBFE8144975287B51621
SHA-512:	5A8F76CC14994FFA7A4EFB38E8EF6A19290F887ACCDB8BA6EED837C9AC2235091487A7B778470655ABB7463EF48D3F5394ED092D3BBBCBFAC91BFF517A6200A6
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.d.d.d...Z.e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)..........annotationsN.........ProxySchemeUnsupported....Literal........._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._SelfT..SSLTransport....bound.._ReturnValue..@..c....................@.......e.Z.d.Z.d.Z.e.dvd.d.....Z.....dwdxd.d...Z.dyd.d...Z.dzd.d...Z.d{d.d...Z.d\|d}d"d#..Z.d~d.d'd(..Z....$d.d.d-d...Z.d.d.d1d2..Z.d.d.d3d4..Z...d.d.d.d.d5..d.d=d>..Z.d.d?d@..Z.d.dAdB..Z.e.j..Cd.d.dGdH....Z.e.j.d.dKdH....Z.d.d.dNdH..Z.d.dOdP..Z.d.dRdS..Z.d.dTdU..Z.d.dVdW..Z.d.dYdZ..Z.d.d[d\..Z.d.d_d`..Z.d.dadb..Z.d.dcdd..Z.d.d.dfdg..Z.e.j.d.djdk....Z.e.j.d.dndk....Z.e.j.d.dqdk....Z.....d.d.dudk..Z.d.S.).r.....L.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections togeth

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\timeout.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	9551
Entropy (8bit):	5.136371315196204
Encrypted:	false
SSDEEP:	96:848E4lOMrflhdz+7V0MV8K7byybXiCDzAe23/LCfAChn8W/SzWOBGawWyF+81GZt:iPZn+l/u9y8BCBXYqGSkjlhKfQHisyS
MD5:	3B6550D12B7DFFCBAB118BEF7B64A0FB
SHA1:	38226CA971E04D5754AB7365C35239D68C96DB29
SHA-256:	BB6591802A9E29EE928E303B27649CC722C76B1729165CA911C8623A53832617
SHA-512:	0EC4FD1560E103732F24280427045C888B7C8548EAEA81119462A4898D36FA6ABAAB816F115FD7B4E4AFFAFBA670A125C9FFEDC1795D18E07AAE7FF2738C6820
Malicious:	false
Preview:	o....................................@.......U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)..........annotationsN....Enum....getdefaulttimeout.........TimeoutStateError....Finalc....................@........e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N....__name__..__module__..__qualname__..token..r....r......urllib3\util\timeout.pyr.................r......Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@.......e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeout.....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp = http.request("GET", "https://exa

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\url.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	11175
Entropy (8bit):	5.833522511392853
Encrypted:	false
SSDEEP:	192:s1VO6gAeOzb/QFYP0YUHmZA1h/3dmnpfvL1Y3sRKtuD/NgdzcEW:kV7gRSoJ/X1hFq83MDVghW
MD5:	7AF1708937DC25B3BA207C4331518194
SHA1:	933EAFE3FBC9BE94D2A97E54B7C57E83B145F4BE
SHA-256:	848068C327D5751748205771EA1F10B8DE3BA0CBAAFF84D0751D658C0A01EA96
SHA-512:	0EFFC37D0B72D44812A54B0BC5AF5327D1AF691D5A126F93D0B04D383BDD8DF8B6E1EE4D31A4DC4859AE20BCCB4A77C442B46F15AD6C54BE62EB4B5E489DD519
Malicious:	false
Preview:	o....................................@....~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.........annotationsN.........LocationParseError.........to_str....http..httpsN..%[a-fA-F0-9]{2}..^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/).S^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$..(?:[0-9]{1,3}\.){3}[0-9]{1,3}..[0-9A-Fa-f]{1,4}..(?:{hex}:{hex}\|{ipv4})....hexZ.ipv4..r....Z.ls32..

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\util.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	4.937261863166667
Encrypted:	false
SSDEEP:	24:gukVMQdXRjkWvBVsFCyQ4lCXatMXSwgpsqnXTQ/838y4KeASu:gxMQdBYEOFCR4lCX5Wp1DdsDASu
MD5:	E7C5CF6DFB029F5148AC9DCF00100601
SHA1:	8726281E046D2C224CB9E5E47D7EA8A8C6605DB4
SHA-256:	963C65500F43140284664DDE7EBA2CD1930ECCA554B2621CFD5DFCCF835E0115
SHA-512:	817EE882986EFCA94CDAA5DFD357B1E6BB43CC4A1896FF6A47E2040A0154CBBC389BA744F21A86FF8BB0D2A89C7242720FCE4CF363EBB64774C47972359B7DD1
Malicious:	false
Preview:	o....................................@....N...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)..........annotationsN....TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S.).N..not expecting type ..utf-8..strict..r........isinstancer......str..TypeError..type..__name__..encode..r....r....r......r......urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....).Nr....r....r....r......r....r....r....r....r....r......decoder....r....r....r......to_str....r....r!.....tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C....$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w.).N....__traceback__..with_traceback..r"...r$...r&...r....r....r......reraise.....................r......NN..r....r....r....r....r....r....r....r......r....r....r....r....

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib3\util\wait.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2339
Entropy (8bit):	5.1220846119326335
Encrypted:	false
SSDEEP:	48:g9y6A4Hhr1StsUMEEZYvTemoJawgelYEhNShEoG0N3AtleO3A8qSXSar:iy6A4HTmsovTemoJgeyixoGcAtYIANSH
MD5:	D30DC2088699ABCA805AAE39CB190AF9
SHA1:	A8693FF3B3AB22154E7D7627B1C0B3A06E62459B
SHA-256:	CD1DB4903CEC2C244C172D855D9EA485820B3A21EF3F5D0C07E6B01DE4DE4AAF
SHA-512:	0932BF57FBF69AB21924921CE9F606674E6BB3C10B0A884E63FA1A11259D681D9A5CE4251A1E44DBAB659F34EFBF19D30B183C1452AED003A24ACEAC706518BB
Malicious:	false
Preview:	o....................................@.......d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)..........annotationsN....partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C....b...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True....RuntimeError..appendr......selectr......r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r......urllib3\util\wait.py..select_wait_for_socket!..............................r....c.........................^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c.............................\|.d.u.r.\|.d.9.}.....\|...S.).N.........poll..r......Z.poll_objr....r......do_pollJ.............

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	3.4477081253754815
Encrypted:	false
SSDEEP:	3:ztWlulehlra4lPlPlpqOkcTg/lz:gqeho4WuMh
MD5:	2619AB77D01B4D8379037413E3B1506E
SHA1:	AA7B1FB37532AC2EC4106454772E086B43A1999F
SHA-256:	DE2F0DD877E43B065D32C16B088F74DE7E97E989DEF16AC4EEBFDE4F4CB61807
SHA-512:	25AC0D81FD444F3517E38985663688589B33D4DB2DC1E747BEC190ACF8AC4AAFAFFBBAFEC7BBDE282C8EABBB584A318D8967138FB3E7817F50E8FBF8C0D4D5E2
Malicious:	false
Preview:	o....................................@........d.S.).N..r....r....r....z.urllib\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\error.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.9312465540194275
Encrypted:	false
SSDEEP:	48:g/SbuQshuDSkJ8eLNa/QJwiWFQgpTDDFZLD2G/mhIDIyfGm12NgOZ8oYHFPtX4YK:XbuyDSkJ8ew/QJwBQgp/DDkhIDIpm1IT
MD5:	A764C28BFB2676C6CB913DC6403AE8DA
SHA1:	190F8B586545C5B5CCA03BCF592636378A5714CC
SHA-256:	768387D0D639809AD9C24821477FCD0CC973BA68DB98D7445204333682F37495
SHA-512:	9E19B21450A0A9F0FB957FEA30C9C8351AE08414A33F1E668873ED6AF011806F0DE6820F5C7FAA7DCE5A893D1AECBF777C503FA78A4111B330CABA71EDAAE105
Malicious:	false
Preview:	o....................................@....V...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.)......Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N....URLError..HTTPError..ContentTooShortErrorc....................@........e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C....$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S.).N....args..reason..filename....selfr....r......r......urllib\error.py..__init__.....................URLError.__init__c....................C........d.\|.j...S.).N..<urlopen error %s

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\parse.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	33734
Entropy (8bit):	5.468340174967263
Encrypted:	false
SSDEEP:	768:3vGxPCq+NsXcr0GpIYo67SwB3qrJJBWDWNa8cd:uxP01G2iJB4S6
MD5:	56B4B0E92608CADF8E8AF37230BA3A09
SHA1:	E188F2EC70EA073C604CEAD48AB26A56F29BF5DC
SHA-256:	99D476EECBC648E0B80DF613FA00EE7EF49AEF130AB71CCA2E31FEEBE5CBABF0
SHA-512:	CA980964A5E93C115B313A093BBCD613499D47E2BCDFB1F73E0C563C70384EC13072550ACB5754803FDBC1631EDBE608A54B3B13A80A2F0C955ADAE5DD5BAA32
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!de._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...ZG.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd\|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\request.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	71241
Entropy (8bit):	5.464935109861024
Encrypted:	false
SSDEEP:	1536:5ZcvBotZ5uIXcj6W7+jCQDn62lhusefSe426Aij9dvctGn:5WatvBs5/Qjuut265nEUn
MD5:	A650FFD36C94E90937A66149FE40523A
SHA1:	2174ED9121512FF0B1B7B94B45EEFDAA97F2FEA2
SHA-256:	7D015F520C4D330D6F62AF362A39EAF27B2E7D79490A1DB917C2A1C32B1F6098
SHA-512:	5F0F19A4DF957F611BDD0A9E6883B5DA0430092BBF3473D2251D4A422BE02869DABCA3F9DE78B5F54D74B8DBE546925067F7A553380F474419EC24DF44A5AB90
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZm+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d..d..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

C:\Users\user\AppData\Local\Temp\_MEI69562\urllib\response.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	4.781759888334522
Encrypted:	false
SSDEEP:	48:gGrJALVoBGvoGvVvRYnpnMRHDKh55/u5QO25Bs0G1SE7EpexeT7we0vVd:jBaL9CnpnMtDKhP/pfg4Egpfvd0H
MD5:	5544B716788D3FD608D64737021EAAF3
SHA1:	E6E3A99B8B5D6785B3490494C76517BF4D8E6F5E
SHA-256:	E3EE1B41F66CA8E35A545C74B9DF5BC053A2DA1AD54D72DCAEE9FCABD6C3C349
SHA-512:	0A67507539101AAE83A01A124687921959333628F665BCA5E776168ECF8C19AFE17D5D7AE7CAAA5870787D2B8ECAAD3555FE570AC8AA9A3A0D22DE6E8FADD36F
Malicious:	false
Preview:	o....................................@....Z...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N....addbase..addclosehook..addinfo..addinfourlc.........................8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r.....OBase class for addinfo and addclosehook. Is a good idea for garbage collection.c......................... ...t.t.\|...j.\|.d.d.d.....\|.\|._.d.S.).N..<urllib response>F....delete....superr......__init__..fp....selfr........__class__....urllib\response.pyr...................addbase.__init__c....................C........d.\|.j.j.t.\|...\|.j.f...S.).N..<%s at %r whose fp = %r>..r......__name__..id..file..r....r....r....r......__repr_

C:\Users\user\AppData\Local\Temp\_MEI69562\uu.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3668
Entropy (8bit):	5.5665356607073
Encrypted:	false
SSDEEP:	96:ITByWehUC2hozDucLmhgzUk045k4CW53Jz:ITByZ22zrCSY14rJz
MD5:	9BD5FF319DB62FC04688AF01C1467F9A
SHA1:	9BB51B91629E4D3C91BB87EEC226442AB28B3465
SHA-256:	B7E9EEE5E76B194B64CC8934ADA873896D81080B0EEE7AC24CA704E93FC241FB
SHA-512:	1CA0ECBD4E99AB21A6C304484E64EC185DAE2E0D6D4A3BE4808DD9686C56D099176C3ECF130433D3C49F7D2572903D0E617A9C970B37C865C90EB35AB632D8AF
Malicious:	false
Preview:	o....................................@....l...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.)...Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N....Error..encode..decodec....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qualname__..r....r......uu.pyr....'............r....F....backtickc....................C....x...g.}.z.\|.d.k.r.t.j.j.}.n/t.\|.t...r;\|.d.u.r.t.j...\|...}.\|.d.u.r1z.t...\|...j.}.W.n...t.y0......Y.n.w.t.\|.d...}.\|...\|.....\|.d.k.rDt.j.j.}.n.t.\|.t...rSt.\|.d...}.\|...\|.....\|.d.u.rYd.}.\|.d.u.r_d.}.\|...d.d...}.\|...d.d...}.\|...d.\|.d.@.\|.f.....d.......\|...d...}.t.\|...d.k.r.\|...t.j.\|.\|.d.......\|...d...}.t.\|...d.k.s.\|.r.\|...d.....n.\|...d.....W.\|.D.].}.\|.......q.d.S.\|.D.].}.\|.......q.w.)...Uuencode file..-N..rb..wb.........\n.....\r..begin %o %s........ascii.-...r....r.........`.end......

C:\Users\user\AppData\Local\Temp\_MEI69562\uuid.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	22480
Entropy (8bit):	5.535415999968231
Encrypted:	false
SSDEEP:	384:jSBZ2usU9uyf2LoA73JY2+4dsDYAD/vonRG:jSB7J9/f28aB+4dsUAzono
MD5:	D83019664737A7419DDB12F4573D2DFC
SHA1:	297C60F8B94AB08087EE432444AE59D34C845B9A
SHA-256:	585A8BCA795FBEE3F0C929B6D7075760C53162EDFF3495AD0913BF24A676FE60
SHA-512:	9014A627E4411972EAFB1355E169412006DB5712442BA89706D3A239B7E4163866C1EE3B6337C792C32AE5AF021BD7B83956CE61BA67B60ECA190AD5514DACDB
Malicious:	false
Preview:	o....................................@....D...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.e.j.d.v.r.d...Z.Z.n.d.d.l.Z.e.....Z.e.d.k.Z.e.d.k.Z.d.Z.d.Z.e.r6d.Z.d.Z.g.d...\.Z.Z.Z.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z d%d&..Z!d'd(..Z"z.d.d.l#Z#e$e#d)d...Z%e$e#dd...Z&e#j'Z(W.n...e)y.......d.Z#d.Z%d.Z&d.Z(Y.n.w.d+d,..Zd-d...Z+d/d0..Z,d1d2..Z-e.r.e.e.g.Z.n e.j.d3k.r.e.e.e g.Z.n.e.j.d4k.r.g.Z.n.e.r.e g.Z.n.e.e.e.e e.g.Z.e.j/d5k.r.e+g.e...Z0n.e.j/d6k.r.e,g.e...Z0n.e.Z0d.a1d7d8..Z2d.a3dEd9d:..Z4d;d<..Z5d=d>..Z6d?d@..Z7e.dA..Z8e.dB..Z9e.dC..Z:e.dD..Z;d.S.)F.Q...UUID objects (universally unique identifiers) according to RFC 4122...This module provides immutable UUID objects (class UUID) and the functions.uuid1(), uuid3(), uuid4(), uuid5() for generating version 1, 3, 4, and 5.UUIDs as specified in RFC 4122...If all you want is a unique ID, you should probably call uuid1() or uuid4()..Note that uuid1() may compromise privac

C:\Users\user\AppData\Local\Temp\_MEI69562\webbrowser.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	16973
Entropy (8bit):	5.332090585652653
Encrypted:	false
SSDEEP:	384:7DwhF6PNa3rVfZrN57/QRN6vQghudo0hsz03nF6:7Oma7VdN9CKLcsGnE
MD5:	5B71B3522E61BC76917AA357B72790D5
SHA1:	E2F0F7A6EA9E6C7C23BED862CBDA17C051CB2205
SHA-256:	C28A6F0E691447CF1358B1D9A3E7A5D246A9E5E6498427FED23E987C7CB9B16E
SHA-512:	1AF1CF3D6E23106377FAA1AED6B6E7557967DF5080392E2A939442DC83189FC8FFDDF818372E92E5ED4F7A94B7BA36B06CE44462D752A79EA896DBFCB36B0E2C
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.e.....Z.i.Z.d.a.d.a.d=d.d...d.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.d.d...d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.e.Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z G.d)d..de...Z!G.d+d,..d,e...Z"d-d...Z#d/d0..Z$e.j%d.d1....d2k.r.G.d3d4..d4e...Z&e.j%d5k.r.G.d6d7..d7e...Z'G.d8d9..d9e...Z(d:d;..Z)e*d<k.r.e)....d.S.d.S.)?.?Interfaces for launching and remotely controlling web browsers......N....Error..open..open_new..open_new_tab..get..registerc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qualname__..r....r......webbrowser.pyr.................r....F....preferredc....................C.......t..4..t.d.u.r.t.....\|.\|.g.t.\|.....<.\|.s.t.r!\|.t.v.r!t...d.\|.....n.t...\|.....W.d.........d.S.W.d.........d.S.1.s9w.......Y...d.S.)...Register a browser connector.Nr..

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	673
Entropy (8bit):	5.139219876372739
Encrypted:	false
SSDEEP:	12:gesll2P0+ItWAyOyKfYtMMZFV/zkGQHxuo89RlIwRnbLw+Wbl:g5l2P0/Up9KG77kGQHx89R/R/qJ
MD5:	328B36A728BF2B32E687EEA8A14EED30
SHA1:	5BF5585EB72CEF8853F5DE6BC0741087870146C3
SHA-256:	F5772070AAC387FDE7EA05EDC2ECC9F52EC915DA2D3D81EF66BA7C8ACF047917
SHA-512:	21764FD1F29294B84515D9187E5DE38A7EA6902F8DB84FC23FBF06019E983955C97703A41DB10759F4F872CA512141D6BD3D56E552619A04230A0B1B4CE719FD
Malicious:	false
Preview:	o....................................@........d.Z.g.d...Z.d.S.)......Core XML support for Python...This package contains four sub-packages:..dom -- The W3C Document Object Model. This supports DOM Level 1 +. Namespaces...parsers -- Python wrappers for XML parsers (currently only supports Expat)...sax -- The Simple API for XML, developed by XML-Dev, led by David. Megginson and ported to Python by Lars Marius Garshol. This. supports the SAX 2 API...etree -- The ElementTree XML library. This is a subset of the full. ElementTree XML release.......dom..parsers..sax..etreeN....__doc__..__all__..r....r....z.xml\__init__.py..<module>.............

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.882058485606321
Encrypted:	false
SSDEEP:	6:gqet/OCoYyKyeHgj/vlG+psvKV6EcLV40KVdVQLD6Ow/lQ/scMV:gqe1OIyKU/0+psvKVvcLycD6tthcMV
MD5:	45947BA2EBA740C73BC754CB2FEB917F
SHA1:	4099D15CA188A46AB750382912F47F6605265078
SHA-256:	522327227FD358E33D2B8A7DE45D1EA408FA3A7ACF772A9C2A241ADBCB856FD4
SHA-512:	437359774A0EFE8926977992BF490714D94B716884E01318A4EAF8F1070234066574D11CFC63127580B396255BB6FD12821144A2222B7575984C9D169DF7CAE3
Malicious:	false
Preview:	o....................................@........d.Z.d.S.)...Python interfaces to XML parsers...This package contains one module:..expat -- Python wrapper for James Clark's Expat parser, with namespace. support...N....__doc__..r....r....z.xml\parsers\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\parsers\expat.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.017843411782104
Encrypted:	false
SSDEEP:	6:g/9qBcgFqZKLInBLCIhVdWxHHNdV3+lzSKaD5:g/oBcgOKQFDdWxHH41SKE5
MD5:	543D8F4254A07BE35639ECAA63EBBB51
SHA1:	BAE1FE609EDAC0288F1081A033606E4AF618E896
SHA-256:	59BE7170CA84844CE1840BD94EA1833F2914F2EDBC9F2F623150495A267E2531
SHA-512:	50F3DA3B68304A915F31186CFD390613FF3A6C238E6E262B2C3C6086B77B924041E7AB2A91544D3626E215E0824F6A00DCAA84728F74D6744F487DD6D45F44B7
Malicious:	false
Preview:	o....................................@....,...d.Z.d.d.l.Z.d.d.l.T.e.e.j.d.<.e.e.j.d.<.d.S.)..1Interface to the Expat non-validating XML parser......N....*..xml.parsers.expat.model..xml.parsers.expat.errors....__doc__..sys..pyexpat..model..modules..errors..r....r....z.xml\parsers\expat.py..<module>...................

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\sax\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	3185
Entropy (8bit):	5.464435543746579
Encrypted:	false
SSDEEP:	48:gki6/eqovPRqIZqw3wUjrEcxOsSAuYBB3NPXVwO9avxKlIZ1zqrfg5:jiVNJLqcwaDOPqB3dVwOiolMOc5
MD5:	4E9BE38EF8841B9B20AC74575D02857A
SHA1:	0A36BBEE372A17A0E037BFDD07CC80D7E9DAB6D9
SHA-256:	126CCA0931C1BFF5C9BCA359A9A725DF6E6B5E24B0AB21F55F42FA9C5A9A78BA
SHA-512:	3EA6E4AC3DACD3021AC87920020C1A7FAF4EB6299CA20276D54AF75BF9EF970FD64073D65AC7B312F61E033DCB13F8DB06677FA283905AFCF583A8AB0419D095
Malicious:	false
Preview:	o....................................@........d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e...f.d.d...Z.e...f.d.d...Z.d.g.Z.d.Z.e.r7d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.j.sPd.e.j.v.rPe.j.d.....d...Z.[.d.Z.e.j.d.d.....d.k.rke.j...e...rke.j...e.....d...Z.d.d.d...Z.e.j.d.d.....d.k.r.d.d...Z.[.d.S.d.d...Z.[.d.S.)......Simple API for XML (SAX) implementation for Python...This module provides an implementation of the SAX 2 interface;.information about the Java version of the interface can be found at.http://www.megginson.com/SAX/. The Python version of the interface is.documented at <...>...This package contains the following modules:..handler -- Base classes and constants which define the SAX 2 API for. the 'client-side' of SAX for Python...saxutils -- Implementation of the convenience classes commonly used to. work with SAX...xmlreader -- Base classes and constants which define the SAX 2 API for. the parsers used with SAX for Python...expatreader --

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\sax\_exceptions.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	5354
Entropy (8bit):	5.082046590314121
Encrypted:	false
SSDEEP:	96:9pTtAOeC1FQigUBUXcIgsYcmEVSJtAWRPuh+uWES9OYU3KWw/7Lx:9JOtUFQEBB4T5VeJETaX/7Lx
MD5:	AAC24AFA90B1D8658F485AA6F241FBE5
SHA1:	ADB48A563F94D41CBA42365548FE83AC7DFBCC1E
SHA-256:	390E9C750A8310F297E65F077FF53DED9E47B0BBA69776DF1E7EDD19F12FCF98
SHA-512:	7C38FD110969D5F73306A148E444BA76304F36F2E961C1600EAF4791A677647E641760B72986984452D4383B741403819EE9CF5EBF18B03158768F82D1F645CE
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.e.j.d.d.....d.k.r.d.d.l.m.Z...[.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)..!Different kinds of SAX Exceptions.....N.......java....Exceptionc....................@....:...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...SAXException.....Encapsulate an XML error or warning. This class can contain. basic error or warning information from either the XML parser or. the application: you can subclass it to provide additional. functionality, or to add localization. Note that although you will. receive a SAXException as the argument to the handlers in the. ErrorHandler interface, you are not actually required to raise. the exception; instead, you can simply read the information in. it.Nc....................C........\|.\|._.\|.\|._.t...\|.\|.....d.S.)..UCreates an exception. The message is required, but the exception. is optional.N...._msg.._exceptionr......__in

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\sax\expatreader.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12440
Entropy (8bit):	5.231763755781415
Encrypted:	false
SSDEEP:	192:ZpaD3dMpGiCjMALn58wULgGuwDz3/QwBzKIY3S5LQiIcYh8uhaO/V7Tb2WMv6n+z:ZajiCz51YJP/QwS/c3s7TbLJg
MD5:	833F62341FD930D328EFC983E5D6A1CB
SHA1:	4C138FBCEDAEC105582292B03B0306B350495E6E
SHA-256:	05DE7320CD33957978B3B95D39562F5C279F4AF51F8F96EEBEABEE484B6BE138
SHA-512:	B9CEFE97CB73FBBAA9BA1172701F4C36838140271CBE19597AF3C87FC4F4F7018B3AFFF650395267D31BD6BC6263CD929630398AF92BD7DAFC54A8553419906F
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.e.j.d.d.....d.k.r>e.d.d.....[.z.d.d.l.m.Z...W.n...e.yS......e.d.d.....w.e.e.d...s^e.d.d.....d.d.l.m.Z.m.Z.m.Z...e.j.Z.e.j.Z.z.d.d.l.Z.W.n...e.y.......d.d...Z.Y.n.w.d.d.l.Z.e.j.Z.[.[.G.d.d...d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j e.j...Z!d.d...Z"e#d.k.r.d.d.l$Z%e"..Z&e&.'e%j(j..)......e&.e%j(.+......e&.,d.....d.S.d.S.)..].SAX driver for the pyexpat C module. This driver works with.pyexpat.__version__ == '2.22'....0.20.............feature_validation..feature_namespaces....feature_namespace_prefixes....feature_external_ges..feature_external_pes....feature_string_interning....property_xml_string..property_interning_dictN.......java..expat not available in Java....expat..expat not supported..ParserCreate....xmlreader..saxutils..handlerc....................C........\|.S.).N......or ...r .....xml\sax\expatreader.py.._mkproxy'..........r$...c...........

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\sax\handler.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	14524
Entropy (8bit):	4.934903440143273
Encrypted:	false
SSDEEP:	192:NdiK9W/lpbTjhguUiDZAmSC4SEjOkM1OAx5V5UWHapLbqI1vblmJhdzmafRGgcDM:jiA+30i1nj4VOkKOE5V5UW6pRZaf7hH
MD5:	043D7D6A781884BE5B3130FF93CBC604
SHA1:	F2C3463007D9A6CA79F598D9547C4DFBEFC3D452
SHA-256:	0A575E375E33A39C7675FFAB7ACDB268E3DEA9C846B431BB7A27921FFCE52671
SHA-512:	2460E44765A65D0517AA0DC5D718F4F494100D18BA846AF20C519A62070A0F94FB5FC30653E0C24C92E5F6D5F17DFC29E68EDA22B040CBA137089C5F96E0249A
Malicious:	false
Preview:	o....................................@.......d.Z.d.Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.e.e.g.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.e.e.g.Z.G.d.d...d...Z.d.S.)..0....This module contains the core classes of version 2.0 of SAX for Python..This file provides only default classes with absolutely minimum.functionality, from which drivers and applications can be subclassed...Many of these classes are empty and are included only as documentation.of the interfaces...$Id$...2.0betac....................@....(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...ErrorHandler....Basic interface for SAX error handlers... If you create an object that implements this interface, then. register the object with your XMLReader, the parser will call the. methods in your object to report all warnings and errors. There. are three levels of errors available: warnings, (possibly). recoverable errors, and unrecoverable errors. All methods take a. S

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\sax\saxutils.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	12567
Entropy (8bit):	5.163407829584764
Encrypted:	false
SSDEEP:	192:rUGNfqTeZQ7ZEeb9r3jKw8hhiCewiJjBcGl9FPUByyjILWxCt9nnkIquoG5s:r1feKUzb9LjK0wYT9FPmyyELaCtRXs
MD5:	B06B3750F2D3FF5C72E80F80AAE61AF9
SHA1:	2D1E4CE8BE53E158FCF696736895962885CCBE12
SHA-256:	918BE15BE219ECFC1762C79C5CFDC46893060963F31933F1CFDF36F27FF7327F
SHA-512:	F868DF4122A85906EED717A8109CA9CF0E7CF0BBB6421B1FE8C327665EC04389B3B75F4E6C3B178799EF734A27CE2E9226B3E74FAC2B74012787678902A3F4AF
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.i.f.d.d...Z.i.f.d.d...Z.i.f.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d.d...Z.d.S.)..nA library of useful helper classes to the SAX classes, for the.convenience of application and driver writers.......N.........handler....xmlreaderc....................C...."...\|.....D.].\.}.}.\|...\|.\|...}.q.\|.S.)..2Replace substrings of a string using a dictionary.....items..replace....s..d..key..value..r......xml\sax\saxutils.py..__dict_replace...............r....c....................C....6...\|...d.d...}.\|...d.d...}.\|...d.d...}.\|.r.t.\|.\|...}.\|.S.)...Escape &, <, and > in a string of data... You can escape other strings of data by passing a dictionary as. the optional entities parameter. The keys and values must all be. strings; each key will be replaced with its corresponding value.. ..&..&..>..>..<..<..r....r........data..entitiesr....r....r......

C:\Users\user\AppData\Local\Temp\_MEI69562\xml\sax\xmlreader.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	16319
Entropy (8bit):	5.042885004406992
Encrypted:	false
SSDEEP:	192:hqX+xK2aQjBwp+/hx9DJ11rxvURWCz4mg6HUj06s+ALtgsjFk5fy:hoDu11rxvUIBA5NFk5fy
MD5:	04245DB8717548798743A968B595166A
SHA1:	94373227982820F5B5560D82826757C58EA49E81
SHA-256:	4462964FBB3BFCDDEFB737EF0E4C0C98C9C64C2DD481BB9DB296CE29FAD466EB
SHA-512:	2C78FE48790AE4FCF1D50350B3DA9BA3201E35B9BF354CD782A707D57BC5B67AA4A3E12B001467543994D13D5B2DEBA7EC010E0EA092BFA77D50C9A24B1FAC25
Malicious:	false
Preview:	o....................................@.......d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.d...Z.e.d.k.rIe.....d.S.d.S.)..]An XML Reader is the SAX 2 name for an XML parser. XML Parsers.should be based on this code. .........handler....SAXNotSupportedException..SAXNotRecognizedExceptionc....................@.......e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d S.)!..XMLReader.%...Interface for reading an XML document using callbacks... XMLReader is the interface that an XML parser's SAX2 driver must. implement. This interface allows an application to set and query. features and properties in the parser, to register event handlers. for document processing, and to initiate a document parse... All SAX interfaces are assumed to be synchronous: the parse. methods must not return until parsing is complete, and r

C:\Users\user\AppData\Local\Temp\_MEI69562\xmlrpc\init.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	3.4793277200090578
Encrypted:	false
SSDEEP:	3:ztWlulehlra4lPlPlMV5LikcTg/lz:gqeho4qVyMh
MD5:	85AC4725050A03E66DAB645A8FA12F8C
SHA1:	A2EABED0F04338D07A0919BE45FEBE389644B100
SHA-256:	F878736EF62D83DF3BFE820DA670758BAE334536EE2C18D3AC82867AF44FF185
SHA-512:	E00DA07A41A395E6E25A22B567932772C6BFF7497D9997172571EA1306EC03DCBC7A75F2A813D13FC435A98D270B0D9CC7B7E4454B480FC6E4D370C29EBACB0A
Malicious:	false
Preview:	o....................................@........d.S.).N..r....r....r....z.xmlrpc\__init__.py..<module>...........

C:\Users\user\AppData\Local\Temp\_MEI69562\xmlrpc\client.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	34345
Entropy (8bit):	5.34492608790865
Encrypted:	false
SSDEEP:	768:j17gDSvXYsY2ztX4oBKo8RkBXqBxpuTRWvSdoevKdh:j17uSvXYsY2zd4oBYCXqBxpkRd2eS/
MD5:	DBCDD0E2FA93026B74E0035DD7EF417F
SHA1:	E9BB3E713658BB4EDECFA193F98CE5E7F4CA5E0B
SHA-256:	47565AA9C77E579FF366702D0B303FBE3E3BB78949C0E68C2A2389C3036B98E3
SHA-512:	92DF198A7DCB13D3601855CFA0CC6BDDF8B490455DAD9F88C545416AAECD3A52FEE30FF76FB97BB06CA776C9A3A1C1EEC7B92FB274E1D3C9362AE88DBFDC142D
Malicious:	false
Preview:	o....................................@....j...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.yC......d.Z.Y.n.w.d.d...Z.d.e.j.d.d.......Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"G.d.d...d.e#..Z$G.d.d...d.e$..Z%G.d.d...d.e$..Z&G.d.d...d.e$..Z'e(..Z)Ze.d.d.d...Z+d d!..Z,e,d"..r.d#d$..Z-n.e,d%..r.d&d$..Z-n.d'd$..Z-[+[,d(d)..Z.G.dd+..d+..Z/d,d-..Z0d.d/..Z1G.d0d1..d1..Z2d2d3..Z3e/e2f.Z4G.d4d5..d5..Z5G.d6d7..d7..Z6G.d8d9..d9..Z7G.d:d;..d;..Z8G.d<d=..d=..Z9G.d>d?..d?..Z:d...Z;..Z<Z=dZdAdB..Z>...@d[dCdD..Z?dZdEdF..Z@dGdH..ZAd\dJdK..ZBG.dLdM..dMe...r*e.jCn.eD..ZEG.dNdO..dO..ZFG.dPdQ..dQ..ZGG.dRdS..dSeG..ZHG.dTdU..dU..ZIeIZJeKdVk...r.eIdW..ZLz.eMeLjN.O......W.n...e$..yv..ZP..z.eMdXeP....W.Y.d.ZP[Pn.d.ZP[Pw.w.e:eL..ZQeQ.R....eQ.Sd.dY....eQ.Td.d.....z.eQ..D.].ZUeMeU......q.W.d.S...e$..y...ZP..z.eMdXeP....W.Y.d.ZP[Pd.S.d.ZP[Pw.w.d.S.)].....An XML-RPC client interface for Python...The marshalling and response pa

C:\Users\user\AppData\Local\Temp\_MEI69562\zipfile.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	60964
Entropy (8bit):	5.589755422802215
Encrypted:	false
SSDEEP:	1536:OKjyZQvgU2Sl9EwkzyTRY2v+LUK7T5cIf0Xk5DZ:mHU2S0wirMXw
MD5:	C3266CBD3BBB052A99EE38D0724A6E1A
SHA1:	1EDA0AA308BCA13637C77DB6F0D24A1ABFE4A58E
SHA-256:	61E1E240670F0B3543E8E53F3541C8F4CF40E050FCEF8879F4D304CFBBB55BA3
SHA-512:	480A34E41DA541AE8C512880C3307982F79D0991E5CCC49B7AAA29ECDF1FADDB692FE284C00C633FE581B765ED8AB21144E5B4994623BD7D2E617A12BC7C83B9
Malicious:	false
Preview:	o....................................@....D...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.e.j.Z.W.n...e.yQ......d.Z.e.j.Z.Y.n.w.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.yu......d.Z.Y.n.w.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(e..)e'..Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6e..)e5..Z7d.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd ZGd!ZHd"ZId#ZJd$ZKd%ZLe..)eK..ZMd.ZNd.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXd.ZYd&ZZd'Z[e..)eZ..Z\d(Z]d)Z^e..)e]..Z_d.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfd.Zgd.Zhd.ZidZje..kd+..Zld,d-..Zmd.d/..Znd0d1..Zod2d3..Zpd4d5..ZqG.d6d7..d7er..Zsd.atd8d9..Zud:d;..ZvG.d<d=..d=..ZwG.d>d?..d?..Zxi.d.d@..d.dA..d.dB..d.dB..d.dB..d.dB..d.dC..d.dD..d.dE..d.dF..d.dC..d.dG..d.dH..d#dI..dJdK..dLdM..dNdO..ZydPdQ..ZzdsdRdS..Z{dTdU..Z\|G.dVdW..dW..Z}G.dXdY..dY..Z~G.dZd[..d[e.j...Z.G.d\d]..d]e.j...Z.G.d^d_..d_..Z.

C:\Users\user\AppData\Local\Temp\_MEI69562\zipimport.pyc

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	data
Category:	dropped
Size (bytes):	17009
Entropy (8bit):	5.66222326480475
Encrypted:	false
SSDEEP:	384:Qdif7yBnavYyhHINjL1wclx9RA9o2fsjnRrZR8888888hokSISy6sbpMzlItRk8Z:Yim1kYkHiX1nx9RA9o2fsjnRrZ0okS5W
MD5:	EBF83B857171740D5D01920314FF4E08
SHA1:	64C052719CFDB731F7757074632BD80FB640AF74
SHA-256:	DD8373B4214296E73BED70BD86F9405D814CC136B342042AF671C4E1085FA790
SHA-512:	A1F18B6A5E1DF9BF8757F56F77352C699FEDB2E6241E4E7683D87884A0AC07C98552183A05C8E0AC1CDC17F60C6CA6D17E5DC2FA732FDA71BFB4EB18C31C26AB
Malicious:	false
Preview:	o....................................@....P...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.g.Z.e.j.Z.e.j.d.d.....Z.G.d.d...d.e...Z.i.Z.e.e...Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.e.d...d.d.f.e.d...d.d.f.d.d.f.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.Z d.a!d.d...Z"d.d...Z#d.d ..Z$d!d"..Z%e.e%j&..Z'd#d$..Z(d%d&..Z)d'd(..Zd)d..Z+d+d,..Z,d-d...Z-d.S.)/.P...zipimport provides support for importing Python modules from Zip archives...This module exports three objects:.- zipimporter: a class; its constructor takes a path to a Zip archive..- ZipImportError: exception raised by zipimporter objects. It's a. subclass of ImportError, so it can be caught as ImportError, too..- _zip_directory_cache: a dict, mapping archive paths to zip directory. info dicts, as used in zipimporter._files...It is usually not needed to use the zipimport module explicitly; it is.used by the builtin import mechanism for sys.path items that are paths.to Zip archives.......N...._unpack_u

C:\Users\user\AppData\Roaming\datura.exe

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	883120
Entropy (8bit):	6.337623478886386
Encrypted:	false
SSDEEP:	12288:xTQ9xn3REWo572OshJrJ79dzDbd/NB63AiQ3Y7zJypHRoSwJjs:dn572OshJrJB1J/NB6QieozJfSwJjs
MD5:	D56367A6C7C36AAE95B97492F6C52CFD
SHA1:	EE49A362C53B8929877183C290AF6C3F22162DFB
SHA-256:	FF58943FBB5FD97A1246E1E2A34CB1A630804893DEB6C06E28D31614FAAA58A0
SHA-512:	87CF1EB9252DB33ED55C901B614759F314F1D432C522945732C2A220B52C92C16EC391615F78D92F8002266EF9AAFDA05765D60400CD62745AC423B7EADF4DAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..\|Y.\|Y.\|Y..)X.\|Y../X)\|Y...X.\|Y../X.\|Y..)X.\|Y...X.\|Y..,X.\|Y..+X.\|Y.\|+Y.}Y...X.\|Y../X.\|Y...Y.\|Y..(X.\|YRich.\|*Y................PE..d......e.........."....%............T..........@..........................................`.......................................................... ...........d...R...'.............T.......................(.......@............................................text...H........................... ..`.rdata..............................@..@.data...4...........................@....pdata...d.......f...H..............@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc...............@..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\pythoninzoo.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.348307438367845
Encrypted:	false
SSDEEP:	3:reo6IABFReNmI4Th3F1AuF5QEyn:M5MmI4Th3o3
MD5:	B74455DDF06A182DDEB081AEB127692B
SHA1:	84DE9F48B01AF51675A80261D4FDA2271EAE6041
SHA-256:	476D198B41C68352257B194A95FB1027943497DA10E4F7AE6AEFECAA2BEE3A5D
SHA-512:	D9B94CB493C6D55EFA87121C47122C30E13BAEDDC5C046791C6B567A7ED0A3EC60129501DCA58451ED8FA645A91F59125C80307A8DA2FE73A6722F24E192155A
Malicious:	false
Preview:	[1892] Failed to execute script 'datura' due to unhandled exception!..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.997625112138111
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	pythoninzoo.exe
File size:	19'067'264 bytes
MD5:	3a272e96b2a6682a76021561514d1906
SHA1:	69674411cab38710263415b8d710780f3752bded
SHA256:	934cb0e1c647de2ecfac8f33ec578c133e7a8e7b7e83ff476e082aa92d789894
SHA512:	26298bf3d5337950045e33033edbeaaf5c5ad7de2906518bb4d7d49057cd9f62c1594790a61ee5ca9881f1c4c243f7f660899f8219043b636f3383e35993199a
SSDEEP:	393216:N4xb4FU9V++4eN0ynQYeFsseTDfDgKic64eDW8Q3+d9B4X:2x8SVSeC9sseTb0K94W8QOd9B8
TLSH:	B117339BA1054884F46CEE33F550433E29A77C594BC723876AA77F110EF9ACA7A36341
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...MY#f.........."......`...0......P..........@......................................#...`........................................

File Icon


Icon Hash:	14e88eb2aab22e68

Static PE Info

General

Entrypoint:	0x140001350
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6623594D [Sat Apr 20 05:57:33 2024 UTC]
TLS Callbacks:	0x4000d660, 0x1, 0x4000d6e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ae12a62716b0df0807d8026a2602e0f0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00015CC5h]
mov dword ptr [eax], 00000000h
call 00007F882C7F2DFFh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
dec eax
sub esp, 28h
call 00007F882C80872Ch
xor ecx, ecx
dec eax
cmp eax, 01h
sbb ecx, ecx
mov eax, ecx
dec eax
add esp, 28h
ret
nop dword ptr [eax+eax+00000000h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push esi
dec eax
sub esp, 20h
mov esi, ecx
dec eax
mov eax, dword ptr [00015CEAh]
dec eax
mov eax, dword ptr [eax]
mov ecx, dword ptr [eax]
dec eax
mov eax, dword ptr [00015CE6h]
dec eax
mov eax, dword ptr [eax]
dec eax
mov edx, dword ptr [eax]
call 00007F882C7F9610h
mov ecx, esi
dec eax
mov edx, eax
dec eax
add esp, 20h
pop esi
jmp 00007F882C7F4841h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
arpl word ptr [edx], ax
dec eax
add eax, edx
ret
nop word ptr [eax+eax+00000000h]
inc ecx
push edi
inc ecx
push esi
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 28h
dec eax
mov edi, edx
dec eax
mov ebx, ecx
dec eax
add ecx, 70h
dec eax
lea edx, dword ptr [00015C9Ah]
call 00007F882C7F50D2h
dec eax
test eax, eax
je 00007F882C7F3051h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d550	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x9ab4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x23000	0x9e4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x120	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x20000	0x1c	.buildid
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1caa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1d388	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d9e0	0x428	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15f86	0x16000	e5f9ca7aead3c08481f178b60f404526	False	0.5079012784090909	data	6.382808174926538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x17000	0x8190	0x8200	1f46b9071bf86bd7dc0a85ce3e037c75	False	0.5376802884615385	data	6.621751309918256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.buildid	0x20000	0x35	0x200	5601fbc31e9e5ffe4ddabc3e70276d2b	False	0.109375	data	0.6209719269643509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21000	0x1e00	0x200	d7349fe3fad8972660ce1fa4c5a100d1	False	0.1640625	DOS executable (block device driver \377\3)	1.152553494752204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x23000	0x9e4	0xa00	24d03b401b246cfca03f842d1e5c9a6b	False	0.528515625	data	4.870565874401139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x24000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25000	0x9ab4	0x9c00	ddec2c7e0743ecc783fa5913d52d15d0	False	0.11062700320512821	data	4.662926710558394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x120	0x200	06decc29ac72e1c4a00dcd896b2037c8	False	0.455078125	data	3.376310861235878	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x250e8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	0.09375656926634433
RT_GROUP_ICON	0x2e590	0x14	data	1.1
RT_MANIFEST	0x2e5a4	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	GetWindowThreadProcessId, ShowWindow
KERNEL32.dll	AreFileApisANSI, CloseHandle, CreateDirectoryW, CreateProcessW, CreateSymbolicLinkW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryExW, LocalFree, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, __C_specific_handler
ADVAPI32.dll	ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
msvcrt.dll	___lc_codepage_func, ___mb_cur_max_func, __argc, __iob_func, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _commode, _errno, _filelengthi64, _fileno, _findclose, _fmode, _get_osfhandle, _getpid, _initterm, _lock, _onexit, _snwprintf, _stat64, _strdup, _stricmp, _unlock, _wcsdup, _wfindfirst64, _wfindnext64, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wstat64, _wtempnam, abort, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputs, fputwc, fread, free, fsetpos, fwprintf, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, strtoul, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 09:01:20.540405035 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 20, 2024 09:01:20.658098936 CEST	80	49746	208.95.112.1	192.168.2.4
Apr 20, 2024 09:01:20.659521103 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 20, 2024 09:01:20.659521103 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 20, 2024 09:01:20.778768063 CEST	80	49746	208.95.112.1	192.168.2.4
Apr 20, 2024 09:01:20.826289892 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 20, 2024 09:01:21.175777912 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.175859928 CEST	443	49747	149.154.167.220	192.168.2.4
Apr 20, 2024 09:01:21.175945997 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.212037086 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.212138891 CEST	443	49747	149.154.167.220	192.168.2.4
Apr 20, 2024 09:01:21.654788017 CEST	443	49747	149.154.167.220	192.168.2.4
Apr 20, 2024 09:01:21.655443907 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.655502081 CEST	443	49747	149.154.167.220	192.168.2.4
Apr 20, 2024 09:01:21.657262087 CEST	443	49747	149.154.167.220	192.168.2.4
Apr 20, 2024 09:01:21.657350063 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.658011913 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.658164978 CEST	49747	443	192.168.2.4	149.154.167.220
Apr 20, 2024 09:01:21.706751108 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 20, 2024 09:01:21.824434996 CEST	80	49746	208.95.112.1	192.168.2.4
Apr 20, 2024 09:01:21.824615002 CEST	49746	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 09:01:20.433258057 CEST	62334	53	192.168.2.4	1.1.1.1
Apr 20, 2024 09:01:20.537878990 CEST	53	62334	1.1.1.1	192.168.2.4
Apr 20, 2024 09:01:21.061595917 CEST	59251	53	192.168.2.4	1.1.1.1
Apr 20, 2024 09:01:21.166831017 CEST	53	59251	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 09:01:20.433258057 CEST	192.168.2.4	1.1.1.1	0xbae1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 20, 2024 09:01:21.061595917 CEST	192.168.2.4	1.1.1.1	0x83e2	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 09:00:53.050251961 CEST	1.1.1.1	192.168.2.4	0x7c66	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 20, 2024 09:00:53.050251961 CEST	1.1.1.1	192.168.2.4	0x7c66	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 20, 2024 09:00:53.389781952 CEST	1.1.1.1	192.168.2.4	0x1bba	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 20, 2024 09:00:53.389781952 CEST	1.1.1.1	192.168.2.4	0x1bba	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 20, 2024 09:01:20.537878990 CEST	1.1.1.1	192.168.2.4	0xbae1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 20, 2024 09:01:21.166831017 CEST	1.1.1.1	192.168.2.4	0x83e2	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49746	208.95.112.1	80	1892	C:\Users\user\Desktop\pythoninzoo.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 09:01:20.659521103 CEST	166	OUT	GET /json?fields=proxy,hosting HTTP/1.1 Host: ip-api.com User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Apr 20, 2024 09:01:20.778768063 CEST	205	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 07:01:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 29 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 70 72 6f 78 79 22 3a 74 72 75 65 2c 22 68 6f 73 74 69 6e 67 22 3a 74 72 75 65 7d Data Ascii: {"proxy":true,"hosting":true}

Target ID:	0
Start time:	09:01:06
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\pythoninzoo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\pythoninzoo.exe"
Imagebase:	0x7ff7aa3e0000
File size:	19'067'264 bytes
MD5 hash:	3A272E96B2A6682A76021561514D1906
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:01:06
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:01:17
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\pythoninzoo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\pythoninzoo.exe"
Imagebase:	0x7ff7aa3e0000
File size:	19'067'264 bytes
MD5 hash:	3A272E96B2A6682A76021561514D1906
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:01:18
Start date:	20/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7f2f50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:19
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Roaming\datura.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\datura.exe
Imagebase:	0x7ff6dcee0000
File size:	883'120 bytes
MD5 hash:	D56367A6C7C36AAE95B97492F6C52CFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.4%
Total number of Nodes:	1003
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF7AA3E68E0 Relevance: 63.2, APIs: 30, Strings: 6, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E693D
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6948

Part of subcall function 00007FF7AA3E7E80: wcslen.MSVCRT ref: 00007FF7AA3E7E8A

_wcsdup.MSVCRT ref: 00007FF7AA3E696C
GetTempPathW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6986
_getpid.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E698C
_wtempnam_dbg.MSVCRT ref: 00007FF7AA3E69AA
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E69C6
_wtempnam.MSVCRT ref: 00007FF7AA3E69D8
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E69F4
_wtempnam.MSVCRT ref: 00007FF7AA3E6A06
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6A22
_wtempnam.MSVCRT ref: 00007FF7AA3E6A34
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6A4C
_wtempnam.MSVCRT ref: 00007FF7AA3E6A5E
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6A76
SetEnvironmentVariableW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6B3C
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6B45

Part of subcall function 00007FF7AA3E67B0: GetEnvironmentVariableW.KERNEL32(?,00000000,00007FF7AA3E2C7E,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E67DC
Part of subcall function 00007FF7AA3E67B0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00007FF7AA3E2C7E,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E67FC

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC

_wfullpath.MSVCRT ref: 00007FF7AA3E6B5C
memset.MSVCRT ref: 00007FF7AA3E6B7E
wcschr.MSVCRT ref: 00007FF7AA3E6B8A
wcsncpy.MSVCRT ref: 00007FF7AA3E6BC2
CreateDirectoryW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6BCC
wcschr.MSVCRT ref: 00007FF7AA3E6BDA
CreateDirectoryW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6BEC
_wputenv_s.MSVCRT ref: 00007FF7AA3E6BFC
free.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,00007FF7AA3E2058), ref: 00007FF7AA3E6C07

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7AA3E6B1A
TMP, xrefs: 00007FF7AA3E6904, 00007FF7AA3E6A84, 00007FF7AA3E6AD0
TMP, xrefs: 00007FF7AA3E6BF2
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7AA3E6C14
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7AA3E6C1D
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7AA3E6B2B

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free$Environment_wtempnam$CreateDirectoryExpandStringsVariablewcschr$ByteCharMultiPathTempWide_getpid_wcsdup_wfullpath_wputenv_s_wtempnam_dbgmemsetwcslenwcsncpy
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$LOADER: Failed to set the TMP environment variable.$TMP$TMP
API String ID: 826648976-2290190126
Opcode ID: b961734b964d55ccc931928f8b13503ef1ec162a213b27921bda5c60e2258742
Instruction ID: b0f203cce5fb3b826d1f9d1c4240d07887a9fd4f7218b0dd3c21cdd270737511
Opcode Fuzzy Hash: b961734b964d55ccc931928f8b13503ef1ec162a213b27921bda5c60e2258742
Instruction Fuzzy Hash: 9C814522B1AE47C1FD25B72399152B9D291AF557C0FC240BDDD0E4A7B6EE7CE5068320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E1160 Relevance: 13.6, APIs: 9, Instructions: 123
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3E11A5
_amsg_exit.MSVCRT ref: 00007FF7AA3E11CC
_initterm.MSVCRT ref: 00007FF7AA3E120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3E124E
malloc.MSVCRT(?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3E127E
wcslen.MSVCRT ref: 00007FF7AA3E12A7
malloc.MSVCRT(?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3E12B7
memcpy.MSVCRT ref: 00007FF7AA3E12C9
_cexit.MSVCRT ref: 00007FF7AA3E132D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpywcslen
String ID:
API String ID: 1818741276-0
Opcode ID: ca58f7d4c2bb3a16060146a8c5e8866954e26b3c7b3bcbb768a87eadcf56310d
Instruction ID: f71b740253d800e3f24241c565690acefffeb8815fea0851fcead01efd612d86
Opcode Fuzzy Hash: ca58f7d4c2bb3a16060146a8c5e8866954e26b3c7b3bcbb768a87eadcf56310d
Instruction Fuzzy Hash: BA514231A1BE47C1FA20BB19E950779E3A1AF64780F8640BADA4D477B5DF3CA4439320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA34F Relevance: 11.9, Strings: 9, Instructions: 680COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 00007FF7AA3EBFBE, 00007FF7AA3EBFFD
too many length or distance symbols, xrefs: 00007FF7AA3EB10F
invalid distances set, xrefs: 00007FF7AA3EBC76
invalid literal/length code, xrefs: 00007FF7AA3EBEB3
invalid code -- missing end-of-block, xrefs: 00007FF7AA3EB539
invalid literal/lengths set, xrefs: 00007FF7AA3EB52D
Q?, xrefs: 00007FF7AA3EC00D
R?, xrefs: 00007FF7AA3EC1B1
invalid code lengths set, xrefs: 00007FF7AA3EB0E5

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: Q?$R?$invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-3844702651
Opcode ID: 0a663fef9c83cec9d083eff3022018e066dfa1852b02c8d1bb0ce2711f0ad37e
Instruction ID: 68b348985bc46a20dd9c9dce13a0ba06258cc9275dbbefdf6ef9d0db39d89d71
Opcode Fuzzy Hash: 0a663fef9c83cec9d083eff3022018e066dfa1852b02c8d1bb0ce2711f0ad37e
Instruction Fuzzy Hash: C3523873A19A91CBE3218F25D4406BDB7A1FB94784F518239EE5D17BA8DB3CD902CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA3D2 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 354COMMON

Download Yara Rule

Strings

??, xrefs: 00007FF7AA3EBC0A
unknown header flags set, xrefs: 00007FF7AA3EB57B
unknown compression method, xrefs: 00007FF7AA3EBF74
7?, xrefs: 00007FF7AA3EB759
R?, xrefs: 00007FF7AA3EC1B1

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: 7?$??$R?$unknown compression method$unknown header flags set
API String ID: 0-921476629
Opcode ID: 3c8ff1fc70a8dc391d74e91d08aa3f755ae9c7efd9dea3d4e9142b6c314fe0ce
Instruction ID: 96dff9e15c41f0091f4bab050587b5499cb32a0f1897c1b495e320912fac488a
Opcode Fuzzy Hash: 3c8ff1fc70a8dc391d74e91d08aa3f755ae9c7efd9dea3d4e9142b6c314fe0ce
Instruction Fuzzy Hash: F6E118B2B1A692C7F7759E14C040B69A7E1FF60784F46C17CEA5907AE8CB79D8018790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA3C3 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF7AA3EB94D

Strings

header crc mismatch, xrefs: 00007FF7AA3EBC1F
??, xrefs: 00007FF7AA3EBC0A
R?, xrefs: 00007FF7AA3EC1B1

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpy
String ID: ??$R?$header crc mismatch
API String ID: 3510742995-2654511598
Opcode ID: 83fc944472986e01a889d83ab4448b3e84fba69b40e55eb86ec645afc43f2594
Instruction ID: b0d66dbd2634a9776aefbbf244ffe245ff98b9536fa93eb4a81f360ef04a3e0b
Opcode Fuzzy Hash: 83fc944472986e01a889d83ab4448b3e84fba69b40e55eb86ec645afc43f2594
Instruction Fuzzy Hash: 6BF13672A19A91C7F7729E25C440769BBE1FF64788F85817CEE4907BA8CB79D801C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA305 Relevance: 5.4, Strings: 4, Instructions: 393COMMON

Download Yara Rule

Strings

H?, xrefs: 00007FF7AA3EAEE1
invalid distance too far back, xrefs: 00007FF7AA3EAD39
invalid distance code, xrefs: 00007FF7AA3EACAB
R?, xrefs: 00007FF7AA3EC1B1

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: H?$R?$invalid distance code$invalid distance too far back
API String ID: 0-101378682
Opcode ID: eb3f0e432a7211a2fbd26b03c68ddacb2543c7717af91c9c053bfa5ddf5e800a
Instruction ID: 25c7037daf022a561fe2d166d272c3e4cddee54f10400723b52a09dc137ba07c
Opcode Fuzzy Hash: eb3f0e432a7211a2fbd26b03c68ddacb2543c7717af91c9c053bfa5ddf5e800a
Instruction Fuzzy Hash: 25E17C32B295E1CBE3258E26D4005ADBBA1F355BC5B948179FE4A07FA4CB3DD801CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA29E Relevance: 5.2, Strings: 4, Instructions: 232COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF7AA3EBD58
unknown compression method, xrefs: 00007FF7AA3EBF74
invalid window size, xrefs: 00007FF7AA3EBFD3
R?, xrefs: 00007FF7AA3EC1B1

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: R?$incorrect header check$invalid window size$unknown compression method
API String ID: 0-2938441491
Opcode ID: 0ba922b5c250874696e753cf5180e6f6004ec5844909fae3fbdd4645d8b3c99c
Instruction ID: 9a3113edf0eca942ffa57fcbe8e34762da0e9b1ee7a8859596562212e3e313e5
Opcode Fuzzy Hash: 0ba922b5c250874696e753cf5180e6f6004ec5844909fae3fbdd4645d8b3c99c
Instruction Fuzzy Hash: 75914673A29651CBF731DF24D48066DB6E1FB50788F518139EA0987EA4CB3DD9428F90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7E20 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7AA3E7E48
FindClose.KERNEL32 ref: 00007FF7AA3E7E57

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d30bf7b694c3b10711c6e36779a1d84146394e1c413e6bea806c5511b275a8aa
Instruction ID: 5af869ca298f4ecc7ed893593bd1320bd0f0272c6b19d84637e67b7580146cd0
Opcode Fuzzy Hash: d30bf7b694c3b10711c6e36779a1d84146394e1c413e6bea806c5511b275a8aa
Instruction Fuzzy Hash: FBF0E52392D551C2FBA05B24F04C7EAB390EB81378F454326E4BA06AE4CF7CC54ADB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E17D0 Relevance: 42.2, APIs: 9, Strings: 15, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(?,401001F1,00007FFE209FA6B0,?,00000000,?,00007FF7AA3E28A6,?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EE9), ref: 00007FF7AA3E185F

Part of subcall function 00007FF7AA3E6EC0: strlen.MSVCRT ref: 00007FF7AA3E6F15
Part of subcall function 00007FF7AA3E6EC0: strlen.MSVCRT ref: 00007FF7AA3E6F3C

free.MSVCRT(?,401001F1,00007FFE209FA6B0,?,00000000,?,00007FF7AA3E28A6,?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EE9), ref: 00007FF7AA3E1954

Part of subcall function 00007FF7AA3E2290: fputs.MSVCRT ref: 00007FF7AA3E230E

fclose.MSVCRT ref: 00007FF7AA3E1A00
fclose.MSVCRT ref: 00007FF7AA3E1A08
free.MSVCRT(?,401001F1,00007FFE209FA6B0,?,00000000,?,00007FF7AA3E28A6,?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EE9), ref: 00007FF7AA3E1A23
free.MSVCRT(?,401001F1,00007FFE209FA6B0,?,00000000,?,00007FF7AA3E28A6,?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EE9), ref: 00007FF7AA3E1A5A

Part of subcall function 00007FF7AA3E13F0: malloc.MSVCRT(00000000,00007FF7AA401158,00000000,00007FF7AA401198,00007FF7AA3E4FEC,?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E1436
Part of subcall function 00007FF7AA3E13F0: fclose.MSVCRT ref: 00007FF7AA3E152B

Strings

pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF7AA3E1885
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7AA3E196F
fwrite, xrefs: 00007FF7AA3E1A3C
fopen, xrefs: 00007FF7AA3E1909
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7AA3E1929
fread, xrefs: 00007FF7AA3E1A2C
fseek, xrefs: 00007FF7AA3E1968
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7AA3E1A43
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7AA3E1A33
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7AA3E19E9
\, xrefs: 00007FF7AA3E1835
malloc, xrefs: 00007FF7AA3E19E2
Failed to create symbolic link %s!, xrefs: 00007FF7AA3E186D
%s%c%s, xrefs: 00007FF7AA3E183D
Failed to extract %s: failed to open target file!, xrefs: 00007FF7AA3E1910

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free$fclose$strlen$fputsmalloc
String ID: %s%c%s$Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$\$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 34549956-172175597
Opcode ID: 5724ef69d96d76d95a5339ad4c1e10d830051790799a94bcefe9860e8ee9ac37
Instruction ID: 48b64d6d42be4ce4b1b9e4a9c97c6423ef02e651f775ba1af9ddc2eafc2afc33
Opcode Fuzzy Hash: 5724ef69d96d76d95a5339ad4c1e10d830051790799a94bcefe9860e8ee9ac37
Instruction Fuzzy Hash: 38517211A1ED43C1FE24B626D8112B9D2816F65790FC641BDEE1D4B7E6DE2CE9078360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E13A0 Relevance: 40.6, APIs: 12, Strings: 11, Instructions: 301
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA3E1ED0: calloc.MSVCRT(00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E1EDF

Part of subcall function 00007FF7AA3E3430: GetModuleFileNameW.KERNEL32(?,00000000,00007FF7AA3E2C4D,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E3451

strcmp.MSVCRT ref: 00007FF7AA3E2CA4
free.MSVCRT(?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E2CB4

Part of subcall function 00007FF7AA3E68A0: SetEnvironmentVariableW.KERNEL32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E68BB
Part of subcall function 00007FF7AA3E68A0: free.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E68C6

Part of subcall function 00007FF7AA3E7EE0: GetConsoleWindow.KERNELBASE(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7EE6
Part of subcall function 00007FF7AA3E7EE0: GetCurrentProcessId.KERNEL32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7EF4
Part of subcall function 00007FF7AA3E7EE0: GetWindowThreadProcessId.USER32 ref: 00007FF7AA3E7F04
Part of subcall function 00007FF7AA3E7EE0: ShowWindow.USER32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7F19

strcmp.MSVCRT ref: 00007FF7AA3E2D18
strcmp.MSVCRT ref: 00007FF7AA3E2D2F
fclose.MSVCRT ref: 00007FF7AA3E2DC4
SetDllDirectoryW.KERNEL32 ref: 00007FF7AA3E2E26
strcmp.MSVCRT ref: 00007FF7AA3E2F2E
strcmp.MSVCRT ref: 00007FF7AA3E2F41
strcmp.MSVCRT ref: 00007FF7AA3E3016
strcpy.MSVCRT ref: 00007FF7AA3E305B
strcmp.MSVCRT ref: 00007FF7AA3E306F
strcmp.MSVCRT ref: 00007FF7AA3E3082

Part of subcall function 00007FF7AA3E67B0: GetEnvironmentVariableW.KERNEL32(?,00000000,00007FF7AA3E2C7E,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E67DC
Part of subcall function 00007FF7AA3E67B0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00007FF7AA3E2C7E,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E67FC

Strings

pyi-hide-console, xrefs: 00007FF7AA3E2CF3
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7AA3E2F8C
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7AA3E2DCF
minimize-early, xrefs: 00007FF7AA3E2D25
_MEIPASS2, xrefs: 00007FF7AA3E2C72, 00007FF7AA3E2CD0, 00007FF7AA3E2F07
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7AA3E2F5A
_PYI_ONEDIR_MODE, xrefs: 00007FF7AA3E2C86, 00007FF7AA3E2CB9
minimize-late, xrefs: 00007FF7AA3E2F37, 00007FF7AA3E3078
hide-late, xrefs: 00007FF7AA3E2F24, 00007FF7AA3E3065
hide-early, xrefs: 00007FF7AA3E2D0E
Failed to convert DLL search path!, xrefs: 00007FF7AA3E2F51

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strcmp$EnvironmentWindow$ProcessVariablefree$ConsoleCurrentDirectoryExpandFileModuleNameShowStringsThreadcallocfclosestrcpy
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$_MEIPASS2$_PYI_ONEDIR_MODE$hide-early$hide-late$minimize-early$minimize-late$pyi-hide-console
API String ID: 2029839851-777588379
Opcode ID: c7430f5730c40777250c49f68a6152b8f624fd18d158852c07c88803b6ec03c6
Instruction ID: c5a079131130f6a86317ed7ed1661e1cc2ef91e9439c55b239b9a726115b80dc
Opcode Fuzzy Hash: c7430f5730c40777250c49f68a6152b8f624fd18d158852c07c88803b6ec03c6
Instruction Fuzzy Hash: BCC14C22A1EE43C1FD74B766D4112BAD2D1AFA4780FC245BED94D462F6EE2CE5078720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E24E0 Relevance: 30.0, APIs: 3, Strings: 14, Instructions: 268
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcpy.MSVCRT(?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EE9), ref: 00007FF7AA3E261E
strcmp.MSVCRT ref: 00007FF7AA3E2787
_stricmp.MSVCRT(?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EE9), ref: 00007FF7AA3E2858

Strings

Referenced dependency archive %s not found., xrefs: 00007FF7AA3E2983
Archive path exceeds PATH_MAX, xrefs: 00007FF7AA3E2927
%s%c%s, xrefs: 00007FF7AA3E2747
Failed to open archive %s!, xrefs: 00007FF7AA3E294E
%s%c%s%c%s, xrefs: 00007FF7AA3E26CA
%s%c%s.pkg, xrefs: 00007FF7AA3E26F7
%s%c%s%c%s%c%s, xrefs: 00007FF7AA3E26A7
Failed to open referenced dependency archive %s., xrefs: 00007FF7AA3E296A
%s%c%s.exe, xrefs: 00007FF7AA3E2726
Failed to copy file %s from %s!, xrefs: 00007FF7AA3E2935
\, xrefs: 00007FF7AA3E26BA
Failed to extract %s from referenced dependency archive %s., xrefs: 00007FF7AA3E28C2
\, xrefs: 00007FF7AA3E268F
pyi-contents-directory, xrefs: 00007FF7AA3E266F

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _stricmpstrcmpstrcpy
String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive path exceeds PATH_MAX$Failed to copy file %s from %s!$Failed to extract %s from referenced dependency archive %s.$Failed to open archive %s!$Failed to open referenced dependency archive %s.$Referenced dependency archive %s not found.$\$\$pyi-contents-directory
API String ID: 407936607-2865169067
Opcode ID: 86279fb2cb811f1d3193e5e60f74b21c85c8b5c8b527189380d235cec9834b6d
Instruction ID: 3840d5b5e29170cf138382a0d08b334aab90f9c23c5ed7e0588e937993e9f141
Opcode Fuzzy Hash: 86279fb2cb811f1d3193e5e60f74b21c85c8b5c8b527189380d235cec9834b6d
Instruction Fuzzy Hash: FCC18521A0AE83D4FE70AB55E8012F9E390AF607C4F814179EE4D47AA5EE7CE547C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E1550 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 158
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA3EA000: malloc.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7AA3EA056

malloc.MSVCRT ref: 00007FF7AA3E15D4
malloc.MSVCRT ref: 00007FF7AA3E15EA
fread.MSVCRT ref: 00007FF7AA3E1636
ferror.MSVCRT ref: 00007FF7AA3E1647
fwrite.MSVCRT ref: 00007FF7AA3E16C1
ferror.MSVCRT ref: 00007FF7AA3E16D8
free.MSVCRT ref: 00007FF7AA3E17A7
free.MSVCRT ref: 00007FF7AA3E17AF

Part of subcall function 00007FF7AA3E21D0: fputs.MSVCRT ref: 00007FF7AA3E2279

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7AA3E15B3
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7AA3E1749
1.3.1, xrefs: 00007FF7AA3E1594
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7AA3E175D
malloc, xrefs: 00007FF7AA3E1742, 00007FF7AA3E1756
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7AA3E1783

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: malloc$ferrorfree$fputsfreadfwrite
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 1161523124-2813020118
Opcode ID: 92f64b8b11e40cd716954cf44a6e80ca731029c63296b251d89f3c90f4d037ac
Instruction ID: 9b3c707938a2672384d1dbd31e2065b93f3d6616532054c2b1956d2372526991
Opcode Fuzzy Hash: 92f64b8b11e40cd716954cf44a6e80ca731029c63296b251d89f3c90f4d037ac
Instruction Fuzzy Hash: 3851B522B1AE42C1FA70AB12D84037AE2D1AB75790F86017DEE4D477E5EF3CE5468750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7290 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC

SetConsoleCtrlHandler.KERNEL32(?,?,00000000,-00003070,00000000,00007FF7AA3E2FBD), ref: 00007FF7AA3E72D9
GetStartupInfoW.KERNEL32(?,?,00000000,-00003070,00000000,00007FF7AA3E2FBD), ref: 00007FF7AA3E7303
_fileno.MSVCRT ref: 00007FF7AA3E7346
_get_osfhandle.MSVCRT ref: 00007FF7AA3E7354
_fileno.MSVCRT ref: 00007FF7AA3E7372
_get_osfhandle.MSVCRT ref: 00007FF7AA3E7379
_fileno.MSVCRT ref: 00007FF7AA3E7397
_get_osfhandle.MSVCRT ref: 00007FF7AA3E739E
GetCommandLineW.KERNEL32(?,?,00000000,-00003070,00000000,00007FF7AA3E2FBD), ref: 00007FF7AA3E73B1
CreateProcessW.KERNELBASE ref: 00007FF7AA3E73E9
WaitForSingleObject.KERNEL32(?,?,00000000,-00003070,00000000,00007FF7AA3E2FBD), ref: 00007FF7AA3E73FD
GetExitCodeProcess.KERNELBASE ref: 00007FF7AA3E740D

Strings

Error creating child process!, xrefs: 00007FF7AA3E7420
CreateProcessW, xrefs: 00007FF7AA3E7419

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1833775142-3524285272
Opcode ID: b9b406a849bb33878a5514d97bb94623b6e5e746c138cebf7cb7df6128b9454c
Instruction ID: 049c4b1e8233a6fd49f5c8dfeec36e7081f4c29ae0f2d6526a198394b43e6690
Opcode Fuzzy Hash: b9b406a849bb33878a5514d97bb94623b6e5e746c138cebf7cb7df6128b9454c
Instruction Fuzzy Hash: 0D41873261DA82C1FA20AB60F4543AEA390FB94764F814339E96D47BE4CF7CD446CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E1A70 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA3E34E0: _wfopen.MSVCRT ref: 00007FF7AA3E3525

Part of subcall function 00007FF7AA3E7620: malloc.MSVCRT(?,00000000,?,?,00000000,?,00007FF7AA3E1AC7,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E763E
Part of subcall function 00007FF7AA3E7620: free.MSVCRT(?,00000000,?,?,00000000,?,00007FF7AA3E1AC7,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7675

fclose.MSVCRT ref: 00007FF7AA3E1C5F

Part of subcall function 00007FF7AA3EE630: fsetpos.MSVCRT ref: 00007FF7AA3EEE7A

fread.MSVCRT ref: 00007FF7AA3E1B00
malloc.MSVCRT ref: 00007FF7AA3E1B60
fread.MSVCRT ref: 00007FF7AA3E1B7D

Part of subcall function 00007FF7AA3E21D0: fputs.MSVCRT ref: 00007FF7AA3E2279

Strings

Failed to seek to cookie position!, xrefs: 00007FF7AA3E1BC5
Could not read full TOC!, xrefs: 00007FF7AA3E1C07
malloc, xrefs: 00007FF7AA3E1BEB
Failed to read cookie!, xrefs: 00007FF7AA3E1BDD
Error on file., xrefs: 00007FF7AA3E1BA3
Could not allocate buffer for TOC!, xrefs: 00007FF7AA3E1BF2
fread, xrefs: 00007FF7AA3E1BD6, 00007FF7AA3E1C00
fseek, xrefs: 00007FF7AA3E1BBE

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: freadmalloc$_wfopenfclosefputsfreefsetpos
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
API String ID: 3598739479-2084260460
Opcode ID: 7182be4058ac8a85c29cb0473fd6233a3c20cab49f980f4b1f3047a239c5c433
Instruction ID: 7e397ddbf8c110461bc538d1becd72c19330c341cbab71cd33a541684eed428e
Opcode Fuzzy Hash: 7182be4058ac8a85c29cb0473fd6233a3c20cab49f980f4b1f3047a239c5c433
Instruction Fuzzy Hash: 7651A822A1BA43C2FE25EB26D401178A790AF65784FD28279DD0C467F6EF3DE5438760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7BC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA3E7C90: GetCurrentProcess.KERNEL32 ref: 00007FF7AA3E7CB5
Part of subcall function 00007FF7AA3E7C90: OpenProcessToken.ADVAPI32 ref: 00007FF7AA3E7CC8
Part of subcall function 00007FF7AA3E7C90: GetTokenInformation.KERNELBASE ref: 00007FF7AA3E7CED
Part of subcall function 00007FF7AA3E7C90: free.MSVCRT ref: 00007FF7AA3E7D65
Part of subcall function 00007FF7AA3E7C90: FindCloseChangeNotification.KERNELBASE ref: 00007FF7AA3E7D75

Part of subcall function 00007FF7AA3E7C90: GetLastError.KERNEL32 ref: 00007FF7AA3E7D01
Part of subcall function 00007FF7AA3E7C90: calloc.MSVCRT ref: 00007FF7AA3E7D1D
Part of subcall function 00007FF7AA3E7C90: GetTokenInformation.KERNELBASE ref: 00007FF7AA3E7D3C
Part of subcall function 00007FF7AA3E7C90: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7AA3E7D58

_snwprintf.MSVCRT ref: 00007FF7AA3E7C1E
LocalFree.KERNEL32(?,?,00000000,00000000,00007FF7AA3E2E3F), ref: 00007FF7AA3E7C30
LocalFree.KERNEL32(?,?,00000000,00000000,00007FF7AA3E2E3F), ref: 00007FF7AA3E7C36
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7AA3E7C6A

Strings

Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF7AA3E7C41
S-1-3-4, xrefs: 00007FF7AA3E7BEF
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7AA3E7C04
D:(A;;FA;;;%s), xrefs: 00007FF7AA3E7C0D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Token$ConvertDescriptorFreeInformationLocalProcessSecurityString$ChangeCloseCurrentErrorFindLastNotificationOpen_snwprintfcallocfree
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 1733909625-1817031585
Opcode ID: 55cf75154907e020f5e5e0d4da8225c303db24b453226e666fa02e65105bf5d4
Instruction ID: 043f0e9bc8c0232d000d88973205b33bffcbfdda217634a1dd9b5c653c2aa3ca
Opcode Fuzzy Hash: 55cf75154907e020f5e5e0d4da8225c303db24b453226e666fa02e65105bf5d4
Instruction Fuzzy Hash: 32119821A1AD53C1FA60B754E8047F99294AF94794FC241BAEC0E477F5CE3D994BC360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7C90 Relevance: 13.6, APIs: 9, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7AA3E7CB5
OpenProcessToken.ADVAPI32 ref: 00007FF7AA3E7CC8
GetTokenInformation.KERNELBASE ref: 00007FF7AA3E7CED
GetLastError.KERNEL32 ref: 00007FF7AA3E7D01
calloc.MSVCRT ref: 00007FF7AA3E7D1D
GetTokenInformation.KERNELBASE ref: 00007FF7AA3E7D3C
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7AA3E7D58
free.MSVCRT ref: 00007FF7AA3E7D65
FindCloseChangeNotification.KERNELBASE ref: 00007FF7AA3E7D75

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Token$InformationProcess$ChangeCloseConvertCurrentErrorFindLastNotificationOpenStringcallocfree
String ID:
API String ID: 241994905-0
Opcode ID: 681063115ae79c0c80eb9e7b1944e4b48986034205a10945fd20a090fcec8f78
Instruction ID: e3815ffbb25866459bea692f9b1256a34d51f93ae025917569fa7925b7b4afa4
Opcode Fuzzy Hash: 681063115ae79c0c80eb9e7b1944e4b48986034205a10945fd20a090fcec8f78
Instruction Fuzzy Hash: C5215922A1AB46C2FA707F55E44473BE290AF94BA4F510279E95E877F4CE3CD8468720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE470 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wstat64.MSVCRT ref: 00007FF7AA3EE4A4
_wstat64.MSVCRT ref: 00007FF7AA3EE4B5
free.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3EE4C4
malloc.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3EE5FF
memcpy.MSVCRT ref: 00007FF7AA3EE611

Strings

\, xrefs: 00007FF7AA3EE53A
/, xrefs: 00007FF7AA3EE53F

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _wstat64$freemallocmemcpy
String ID: /$\
API String ID: 324876230-1600464054
Opcode ID: 23e9012790504dd564ecfada3ebc89b06a7f3f6f3913e1f435212179e3106ca1
Instruction ID: 9978b856b8d1db4b316c1484f7ab0c7c9604b1bfe54adcd8872fa0327faf0d98
Opcode Fuzzy Hash: 23e9012790504dd564ecfada3ebc89b06a7f3f6f3913e1f435212179e3106ca1
Instruction Fuzzy Hash: D841FB12E0AE53D2FA78AB15D05157DF3E2EF65740FA5427DDA4E026E0EF6CE4828710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E6C80 Relevance: 10.6, APIs: 7, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC

wcslen.MSVCRT ref: 00007FF7AA3E6CC3
wcscat.MSVCRT ref: 00007FF7AA3E6CEC
wcscat.MSVCRT ref: 00007FF7AA3E6D06
memcpy.MSVCRT ref: 00007FF7AA3E6D3E
memcpy.MSVCRT ref: 00007FF7AA3E6D8C
_findclose.MSVCRT ref: 00007FF7AA3E6DB1
_wrmdir.MSVCRT ref: 00007FF7AA3E6DBF

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpywcscat$ByteCharMultiWide_findclose_wrmdirwcslen
String ID:
API String ID: 3871113189-0
Opcode ID: 754e2cb0f036f9d43648c6de50658f8104442de2c59ea996aa55f58cd5577779
Instruction ID: e53f010626c96a8099844719c7ea3bf195426ec3d8c3b32eaa7dd59b0ef969d6
Opcode Fuzzy Hash: 754e2cb0f036f9d43648c6de50658f8104442de2c59ea996aa55f58cd5577779
Instruction Fuzzy Hash: 6E318D52629A87D0FD30BA1299451FED241AF95BD4FC14179ED0D4BAA9DE2CD2078720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E6EC0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF7AA3E6F15
strlen.MSVCRT ref: 00007FF7AA3E6F3C
strlen.MSVCRT ref: 00007FF7AA3E6F9A
strcat.MSVCRT(?,?,?,00000000,401041F1,00007FF7AA3E70F9,?,?,00000000,401021F1,00007FF7AA3E7152,?,401021F1,401031F1,00000000,00007FF7AA3E2891), ref: 00007FF7AA3E6FAC
strtok.MSVCRT ref: 00007FF7AA3E6FB9

Strings

\, xrefs: 00007FF7AA3E6F9F

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen$strcatstrtok
String ID: \
API String ID: 230112520-2967466578
Opcode ID: 7d995936eb16f3012e0ac325eddcbeeb2df909b600dfce030c247677aeacd462
Instruction ID: f3eafd47f3b5d99de7b982f5793eb0a3555503db5e6084bcadd102fd7d74dd27
Opcode Fuzzy Hash: 7d995936eb16f3012e0ac325eddcbeeb2df909b600dfce030c247677aeacd462
Instruction Fuzzy Hash: B5216122A1A983D0FD30B712D5152BDE690AF64784FC604BAE94D566E5DF2CE9078360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7020 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 67
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF7AA3E70A1
free.MSVCRT(?,?,00000000,401021F1,00007FF7AA3E7152,?,401021F1,401031F1,00000000,00007FF7AA3E2891,?,00000000,?,00000000), ref: 00007FF7AA3E70B7

Strings

WARNING: file already exists but should not: %s, xrefs: 00007FF7AA3E70DD
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7AA3E7083
%s%c%s, xrefs: 00007FF7AA3E7044
ERROR: file already exists but should not: %s, xrefs: 00007FF7AA3E70C0
\, xrefs: 00007FF7AA3E703C

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: freestrcmp
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 716601943-3501660386
Opcode ID: ee40dbf269d001c9daa33e1cc5b39d1564259fb16f763698fb8b611c66d8f1e8
Instruction ID: 736af5c51d885c5f8670cab86e2a8cd04fe93833048c2f6483b5ae777e20f940
Opcode Fuzzy Hash: ee40dbf269d001c9daa33e1cc5b39d1564259fb16f763698fb8b611c66d8f1e8
Instruction Fuzzy Hash: 06219621A2EE47C1FA30F711E8012B9E294AF60384FC640BEE94E465F5EF6CE5478320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA535 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7AA3EA62E

Strings

??, xrefs: 00007FF7AA3EA846
invalid stored block lengths, xrefs: 00007FF7AA3EA935
R?, xrefs: 00007FF7AA3EC1B1

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpy
String ID: ??$R?$invalid stored block lengths
API String ID: 3510742995-1102609967
Opcode ID: a9074fcb5bbac69ca022edfe68605a8bc2fed4334ed7893a452338e7267cd157
Instruction ID: 1a42aebccbd6ed9a489041ff2d72a774607c6e7e1c1a5f937b6b92d0b7107133
Opcode Fuzzy Hash: a9074fcb5bbac69ca022edfe68605a8bc2fed4334ed7893a452338e7267cd157
Instruction Fuzzy Hash: 6E513773A09A81CBF3359E19E44096DB7E1FB60794F96817CEA1907A94CB78D806C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7620 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,00000000,?,?,00000000,?,00007FF7AA3E1AC7,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E763E
free.MSVCRT(?,00000000,?,?,00000000,?,00007FF7AA3E1AC7,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7675

Part of subcall function 00007FF7AA3EE630: fsetpos.MSVCRT ref: 00007FF7AA3EEE7A

fread.MSVCRT ref: 00007FF7AA3E770D
memcmp.MSVCRT ref: 00007FF7AA3E773C

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: freadfreefsetposmallocmemcmp
String ID:
API String ID: 2654715521-0
Opcode ID: f4235dfdb50a7a1d8e27414920f6c90e0861fcaa00e892d39a650fe67ea2f593
Instruction ID: d419ffd2c6b3b780a31fd92028a0a3b53749b3edaf20bfdc94fe7fe17774bbd6
Opcode Fuzzy Hash: f4235dfdb50a7a1d8e27414920f6c90e0861fcaa00e892d39a650fe67ea2f593
Instruction Fuzzy Hash: A031C512B1AD56C5F9B0BA1699047BAD6C16F54BC8FDA0478DD0D077A5DE3CE147C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E6DE0 Relevance: 6.1, APIs: 4, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF7AA3E6E20
wcscat.MSVCRT ref: 00007FF7AA3E6E3A
_wunlink.MSVCRT ref: 00007FF7AA3E6E47
Sleep.KERNEL32(?,00000000,00000000,-00003070,00000000,00007FF7AA3E2FE4), ref: 00007FF7AA3E6E56

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Sleep_wunlinkwcscatwcscmp
String ID:
API String ID: 4281801176-0
Opcode ID: df0a9a588a9c06977a0d4fc13b440bbf28463773026a85216bffbdbe4c2b6a97
Instruction ID: ff30db2cf4096511e369e404373b52bf5774fa5863e1373cb493edf3ee0f8ce0
Opcode Fuzzy Hash: df0a9a588a9c06977a0d4fc13b440bbf28463773026a85216bffbdbe4c2b6a97
Instruction Fuzzy Hash: 39117522B1E953C1FA217716E9053B9D2906F90BD4F8640B9DD4E4A6E1DE7CE987C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7EE0 Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7EE6
GetCurrentProcessId.KERNEL32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7EF4
GetWindowThreadProcessId.USER32 ref: 00007FF7AA3E7F04
ShowWindow.USER32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7F19

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: 09a2fb60e85fec0266ec0d8da64730f248f16ffc073006fd1cfc563cd149c684
Instruction ID: a2ab10823b37fdd7b5ecf4098ad523f1e59d4a4cb66907fb2c7173e009445df8
Opcode Fuzzy Hash: 09a2fb60e85fec0266ec0d8da64730f248f16ffc073006fd1cfc563cd149c684
Instruction Fuzzy Hash: 06E06512E1F902C1FF247B62A80813D52D1AF94FD5F8684BAC90E07660DE2CA947C734

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EC2E0 Relevance: 5.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF7AA3EC322
memcpy.MSVCRT ref: 00007FF7AA3EC35F
memcpy.MSVCRT ref: 00007FF7AA3EC378
memcpy.MSVCRT ref: 00007FF7AA3EC3AB

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpy$malloc
String ID:
API String ID: 962570267-0
Opcode ID: 2cdf84b189eb365d70d7cc5f7cfea0c9c7646abc1bf9abf7a3f6f94aedbe2f7e
Instruction ID: 9cceb2080d2b6a83260c4c92913d9a49bb6a317b8cee25baa749a9eeab9ee834
Opcode Fuzzy Hash: 2cdf84b189eb365d70d7cc5f7cfea0c9c7646abc1bf9abf7a3f6f94aedbe2f7e
Instruction Fuzzy Hash: CB312123717650C7FBE19F62C4C8AADA696EB98B80F93503CDE1D47790DA7DD8028710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E1C90 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF7AA3E1DCB

Part of subcall function 00007FF7AA3E1A70: fread.MSVCRT ref: 00007FF7AA3E1B00
Part of subcall function 00007FF7AA3E1A70: malloc.MSVCRT ref: 00007FF7AA3E1B60
Part of subcall function 00007FF7AA3E1A70: fread.MSVCRT ref: 00007FF7AA3E1B7D
Part of subcall function 00007FF7AA3E1A70: fclose.MSVCRT ref: 00007FF7AA3E1C5F

strncmp.MSVCRT ref: 00007FF7AA3E1D8F

Strings

pyi-contents-directory, xrefs: 00007FF7AA3E1D67

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fread$fclosemallocstrcpystrncmp
String ID: pyi-contents-directory
API String ID: 1711998243-2617349511
Opcode ID: d9c2a38ecb3878c541fbd1e2e66f67447100d290538c2ed259417ad6f3de4335
Instruction ID: 5e2f06c26692f4c37ff0b80f29e1d21351650a7052d182bc60f98f245f2ae6d6
Opcode Fuzzy Hash: d9c2a38ecb3878c541fbd1e2e66f67447100d290538c2ed259417ad6f3de4335
Instruction Fuzzy Hash: 2041B762A09E46C1FA30B721E4187FED691AF61790FC242B9DB5E866E1DF3CE0478310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E1FD0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00007FF7AA3E202F

Strings

pyi-runtime-tmpdir, xrefs: 00007FF7AA3E1FFA
Cannot create temporary directory!, xrefs: 00007FF7AA3E206A

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strncmp
String ID: Cannot create temporary directory!$pyi-runtime-tmpdir
API String ID: 1114863663-3961172288
Opcode ID: 54fa69f0145584f13813d7fefa480f0cfe4eb9788e4ada5d3c05e8394b081f1d
Instruction ID: f44281240189ab9aabefeef0c703c0129d3bba3b1cd0809cb68f3a9c903d653a
Opcode Fuzzy Hash: 54fa69f0145584f13813d7fefa480f0cfe4eb9788e4ada5d3c05e8394b081f1d
Instruction Fuzzy Hash: 0A11C822A0AD46D0FE30E661D904579D6D1AB247A0F8286B9DE2E461F0EE7DE847C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E6840 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32 ref: 00007FF7AA3E7AEE
Part of subcall function 00007FF7AA3E7A80: calloc.MSVCRT ref: 00007FF7AA3E7B06

_wputenv_s.MSVCRT ref: 00007FF7AA3E6870
free.MSVCRT(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3E687B
free.MSVCRT(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3E6883

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ByteCharMultiWidefree$_wputenv_scalloc
String ID:
API String ID: 191763446-0
Opcode ID: 0a8373bf21a4107c0bebba2e61645de14f4fe05ab7c791621c4bc3a5a9f3ce11
Instruction ID: f24a560dd554d5f4f8af99a885d10e16e57d2fa887f53e5a4b598cce9a59406c
Opcode Fuzzy Hash: 0a8373bf21a4107c0bebba2e61645de14f4fe05ab7c791621c4bc3a5a9f3ce11
Instruction Fuzzy Hash: 08E01243B2A46683BE18766B29696BF81424F59FE0A45807CDC0E4FB97DD1C58474750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E5D60 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

calloc.MSVCRT(00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E5D6F

Part of subcall function 00007FF7AA3E2290: fputs.MSVCRT ref: 00007FF7AA3E230E

Strings

Cannot allocate memory for SPLASH_STATUS., xrefs: 00007FF7AA3E5D80
calloc, xrefs: 00007FF7AA3E5D79

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: callocfputs
String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
API String ID: 4281449625-799113134
Opcode ID: 614c967fe0f34c80bb3bbf7a15520b3cdbc469c154601377df2d43b924ea79eb
Instruction ID: 8fb2d94043d5a7a7b6cc2f5a596541e1e2c1ad73ae2ecf29da418df0949db5a9
Opcode Fuzzy Hash: 614c967fe0f34c80bb3bbf7a15520b3cdbc469c154601377df2d43b924ea79eb
Instruction Fuzzy Hash: 81D05B51F17D1BC2FD557756B4412F582814F54344EC684BCC91C4E3A1EDACAD434360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7DC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF7AA3E7DEA

Strings

Security descriptor is not initialized!, xrefs: 00007FF7AA3E7DFB

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: CreateDirectory
String ID: Security descriptor is not initialized!
API String ID: 4241100979-986317556
Opcode ID: e10940376923d1b1e757edb737925d403392a0c46e49f36a5e671fc05a02b0a2
Instruction ID: b93c8e67885cca0e9b535c3f89913506941cc7e66ec66cc8f424a3c928b87625
Opcode Fuzzy Hash: e10940376923d1b1e757edb737925d403392a0c46e49f36a5e671fc05a02b0a2
Instruction Fuzzy Hash: D7E06522A19A82C2FA24AB34E85427DA290BB54314FD1067DE54E4A6F4DF7DD506C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE630 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

fsetpos.MSVCRT ref: 00007FF7AA3EEE7A
_errno.MSVCRT ref: 00007FF7AA3EEE81

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _errnofsetpos
String ID:
API String ID: 4146077584-0
Opcode ID: 7625d1e045d887490c1950c4171c5cdb780fb989810e49c11675eab92612f67f
Instruction ID: 1cf92fd676ab02200581dda625eeec00712cb9616b994d5627859691ea1a1079
Opcode Fuzzy Hash: 7625d1e045d887490c1950c4171c5cdb780fb989810e49c11675eab92612f67f
Instruction Fuzzy Hash: 71019622A1EE93D2FE347616D61117DE1825FE47D0FA242BCE84D0AAE9DF2DD4434720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE3F0 Relevance: 2.5, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7AA3EE43E
memset.MSVCRT ref: 00007FF7AA3EE450

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 1cbabfa5ebb6dbaea5940a36d2c41664ef7c600b4355c000f4ed846c9c6844de
Instruction ID: 537b82adbb9f76bc486e663b999bf8b0fd361760283e01c13b44087e2de99e42
Opcode Fuzzy Hash: 1cbabfa5ebb6dbaea5940a36d2c41664ef7c600b4355c000f4ed846c9c6844de
Instruction Fuzzy Hash: 91F0F923B18A81C7E720AB29D68136DB6A0EB943E0F554234EB9C07B95DF2CD5968B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E34E0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32 ref: 00007FF7AA3E7AEE
Part of subcall function 00007FF7AA3E7A80: calloc.MSVCRT ref: 00007FF7AA3E7B06

_wfopen.MSVCRT ref: 00007FF7AA3E3525

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ByteCharMultiWide$_wfopencalloc
String ID:
API String ID: 211656410-0
Opcode ID: a301de87a1d2e55b59af2ab753c957750ab61632cfda6fa6c8d1f2cf359dd8c6
Instruction ID: c018e8e0ee66dcf7a3acf16b96d34922ac3136dd21c56f1b030d901c1394ac86
Opcode Fuzzy Hash: a301de87a1d2e55b59af2ab753c957750ab61632cfda6fa6c8d1f2cf359dd8c6
Instruction Fuzzy Hash: 84E0924270965181FA257612F9097EA96116F9AFC0F85C075EE0D0BBA98D1DC2478710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EA000 Relevance: 1.3, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7AA3EA056

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 29fb5ee6fb552e48d9ebb8bbdac26a9acd12174aecc2bf42dd3d1b00338cb64e
Instruction ID: 97d3161edaea435db522f718bde8dcba0f72ff1cd8769426cdb3a1a4f27d2e6e
Opcode Fuzzy Hash: 29fb5ee6fb552e48d9ebb8bbdac26a9acd12174aecc2bf42dd3d1b00338cb64e
Instruction Fuzzy Hash: D4214122E06F41CAFA715715E940338E2D0AB64BA5F655179CA0D47BE0DF7EDC939310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EC400 Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7AA401140), ref: 00007FF7AA3EC453

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ebb3164c573085c70e2e1d87b5fa476ab87600964c24a42412d482adad12ff23
Instruction ID: 690795f64ada4861d678cb357dbf4d1b58ecf7e623eb5b94f75acb5bbeb6e388
Opcode Fuzzy Hash: ebb3164c573085c70e2e1d87b5fa476ab87600964c24a42412d482adad12ff23
Instruction Fuzzy Hash: 82019EB2B02B01C1EE769A4AE04033CA2D0EB16FD0F945239CE4C677B0DE28D8838710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE370 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7AA3EE3C0

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d21df8cdabdd02f75570d9907e9ec577e4ac3e6a0e96abedfa81416b0ddce5ad
Instruction ID: f0a7c061229ab1bdca76c3648c58886424071006b3e4fbc4642e0280d74ce2e1
Opcode Fuzzy Hash: d21df8cdabdd02f75570d9907e9ec577e4ac3e6a0e96abedfa81416b0ddce5ad
Instruction Fuzzy Hash: 51F0DB22B19685C2E7109715E24076DA661EB947F0F554334EB6C07BD5DF7CD1928700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E1F10 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

free.MSVCRT(00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E1F24

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1d97b1c6a69d9ad58639c5b27ac48848ce784438b26c638ee1057ad201ac654b
Instruction ID: d518dea79c930fb92741038e428f8e9cac7adfa412a6b895d4b96c8b7bb756e3
Opcode Fuzzy Hash: 1d97b1c6a69d9ad58639c5b27ac48848ce784438b26c638ee1057ad201ac654b
Instruction Fuzzy Hash: 3BD0A902F1B6A7C2FE29B29B64A20B8C0004F68B60D9680B88E1D0E3A1DE0C9DC30300

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7AA3E4480 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 361libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E448F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E44AF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E44CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E44EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E450F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E452F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E454F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E456F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E458F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E45AF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E45CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E45EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E460F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E462F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E464F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E466F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E468F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E46AF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E46CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E46EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E470F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E472F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E474F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E476F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E478F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E47AF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E47CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E47EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E480F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E482F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E484F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E486F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E488F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E48AF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E48CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E48EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E490F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E492F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E494F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E496F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E498F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E49AF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E49CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7AA3E2B9D,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E49EF

Strings

Failed to get address for PyStatus_Exception, xrefs: 00007FF7AA3E4B9C
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7AA3E4AFA
Py_IsInitialized, xrefs: 00007FF7AA3E4525
Failed to get address for PyConfig_SetString, xrefs: 00007FF7AA3E4A9A
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7AA3E4885
Failed to get address for PyObject_Str, xrefs: 00007FF7AA3E4B81
Failed to get address for PyModule_GetDict, xrefs: 00007FF7AA3E4B4E
PyUnicode_AsUTF8, xrefs: 00007FF7AA3E4925
PyList_Append, xrefs: 00007FF7AA3E4765
Failed to get address for PySys_GetObject, xrefs: 00007FF7AA3E4BA5
PyUnicode_Decode, xrefs: 00007FF7AA3E4945
PyImport_ExecCodeModule, xrefs: 00007FF7AA3E4725
PyObject_Str, xrefs: 00007FF7AA3E4865
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF7AA3E4A46
Py_PreInitialize, xrefs: 00007FF7AA3E4545
Failed to get address for PyErr_Clear, xrefs: 00007FF7AA3E4AB2
Failed to get address for PyErr_Fetch, xrefs: 00007FF7AA3E4ABE
PyImport_ImportModule, xrefs: 00007FF7AA3E4745
Failed to get address for PyErr_Restore, xrefs: 00007FF7AA3E4AEE
PyConfig_SetBytesString, xrefs: 00007FF7AA3E45C5
PyStatus_Exception, xrefs: 00007FF7AA3E48C5
Failed to get address for PyList_Append, xrefs: 00007FF7AA3E4B2A
PyErr_NormalizeException, xrefs: 00007FF7AA3E4665
Failed to get address for PySys_SetObject, xrefs: 00007FF7AA3E4BAE
PyErr_Restore, xrefs: 00007FF7AA3E46C5
Failed to get address for PyConfig_Read, xrefs: 00007FF7AA3E4A82
PyUnicode_Join, xrefs: 00007FF7AA3E49C5
Failed to get address for PyMem_RawFree, xrefs: 00007FF7AA3E4B42
Py_ExitStatusException, xrefs: 00007FF7AA3E44C5
GetProcAddress, xrefs: 00007FF7AA3E4BEB
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7AA3E4B66
PyUnicode_FromString, xrefs: 00007FF7AA3E49A5
Failed to get address for Py_IsInitialized, xrefs: 00007FF7AA3E4A52
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF7AA3E4A8E
PyObject_SetAttrString, xrefs: 00007FF7AA3E4845
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7AA3E4B1E
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7AA3E4B36
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF7AA3E4AA6
PyUnicode_DecodeFSDefault, xrefs: 00007FF7AA3E4965
PyUnicode_FromFormat, xrefs: 00007FF7AA3E4985
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7AA3E4B93
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7AA3E4B6F
Failed to get address for PyImport_AddModule, xrefs: 00007FF7AA3E4B06
PyEval_EvalCode, xrefs: 00007FF7AA3E46E5
PyObject_CallFunction, xrefs: 00007FF7AA3E47E5
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7AA3E4B12
PySys_SetObject, xrefs: 00007FF7AA3E4905
PyConfig_Clear, xrefs: 00007FF7AA3E4565
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7AA3E4B78
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7AA3E4BB7
Failed to get address for Py_PreInitialize, xrefs: 00007FF7AA3E4A5E
PyErr_Occurred, xrefs: 00007FF7AA3E4685
Failed to get address for Py_DecRef, xrefs: 00007FF7AA3E4A16
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7AA3E4BC0
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7AA3E4B5A
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7AA3E4BC9
Failed to get address for Py_Finalize, xrefs: 00007FF7AA3E4A3A
PyErr_Clear, xrefs: 00007FF7AA3E4625
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7AA3E4A22
Failed to get address for PyConfig_Clear, xrefs: 00007FF7AA3E4A6A
Failed to get address for PyErr_Occurred, xrefs: 00007FF7AA3E4AD6
Failed to get address for PyErr_Print, xrefs: 00007FF7AA3E4AE2
PyErr_Print, xrefs: 00007FF7AA3E46A5
PySys_GetObject, xrefs: 00007FF7AA3E48E5
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7AA3E4BD2
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7AA3E4B8A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7AA3E4ACA
PyObject_CallFunctionObjArgs, xrefs: 00007FF7AA3E4805
Failed to get address for PyUnicode_Join, xrefs: 00007FF7AA3E4BE4
PyConfig_SetWideStringList, xrefs: 00007FF7AA3E4605
Failed to get address for Py_ExitStatusException, xrefs: 00007FF7AA3E4A2E
PyModule_GetDict, xrefs: 00007FF7AA3E47C5
PyMem_RawFree, xrefs: 00007FF7AA3E47A5
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7AA3E4A0A
Py_InitializeFromConfig, xrefs: 00007FF7AA3E4505
PyConfig_InitIsolatedConfig, xrefs: 00007FF7AA3E4585
PyObject_GetAttrString, xrefs: 00007FF7AA3E4825
Py_DecRef, xrefs: 00007FF7AA3E4488
PyImport_AddModule, xrefs: 00007FF7AA3E4705
PyRun_SimpleStringFlags, xrefs: 00007FF7AA3E48A5
PyConfig_Read, xrefs: 00007FF7AA3E45A5
Py_DecodeLocale, xrefs: 00007FF7AA3E44A5
PyConfig_SetString, xrefs: 00007FF7AA3E45E5
Py_Finalize, xrefs: 00007FF7AA3E44E5
PyErr_Fetch, xrefs: 00007FF7AA3E4645
PyUnicode_Replace, xrefs: 00007FF7AA3E49E5
PyMarshal_ReadObjectFromString, xrefs: 00007FF7AA3E4785
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF7AA3E4A76
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7AA3E4BDB

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: e49e1280d10afa41ec15a8b847495c32f9af01d79d48f5248e214f8e4bf66b76
Instruction ID: 6e6f243d160ad09f87d7e9572394dabd9fc52654475c6ad7d04b047b249f1607
Opcode Fuzzy Hash: e49e1280d10afa41ec15a8b847495c32f9af01d79d48f5248e214f8e4bf66b76
Instruction Fuzzy Hash: 7012FA65A1FF03E5FE19EB18E844178A2A16F58780BC240FAC84E0A774EF6DE507D325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7760 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00007FF7AA3E23C0,?,00000000,00000000,00007FF7AA3E7901), ref: 00007FF7AA3E7775

Part of subcall function 00007FF7AA3E2330: GetLastError.KERNEL32(?,00000000,00000000,00007FF7AA3E7901), ref: 00007FF7AA3E23B3

FormatMessageW.KERNEL32(?,00007FF7AA3E23C0,?,00000000,00000000,00007FF7AA3E7901), ref: 00007FF7AA3E77A6
WideCharToMultiByte.KERNEL32(?,00007FF7AA3E23C0,?,00000000,00000000,00007FF7AA3E7901), ref: 00007FF7AA3E77DE

Strings

PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7AA3E77FB
PyInstaller: FormatMessageW failed., xrefs: 00007FF7AA3E7817
FormatMessageW, xrefs: 00007FF7AA3E7804
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7AA3E77EF
No error messages generated., xrefs: 00007FF7AA3E780B
WideCharToMultiByte, xrefs: 00007FF7AA3E77E8

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ErrorLast$ByteCharFormatMessageMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2383786077-2573406579
Opcode ID: f12e8011a58483dd617962aa7e2c3331210bbe672b54bfdf1c49764158980d01
Instruction ID: 419b4ab9b549589c4bfb572a5374963f7869e18572ed90e3d6fdca99eb11e175
Opcode Fuzzy Hash: f12e8011a58483dd617962aa7e2c3331210bbe672b54bfdf1c49764158980d01
Instruction Fuzzy Hash: EB11B722A29E43C1FB64BB10E8047B9A350AF54394F81417AE55E566B4DF3CE547C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EDFB0 Relevance: 4.6, APIs: 3, Instructions: 141COMMON

Download Yara Rule

APIs

AreFileApisANSI.KERNEL32(?,00007FF7AA402390,00000000,?,00007FF7AA3EDEF0,00000000,00000000,?,00007FF7AA3E2CEF,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3EDFC2
IsDBCSLeadByteEx.KERNEL32(?,00007FF7AA402390,00000000,?,00007FF7AA3EDEF0,00000000,00000000,?,00007FF7AA3E2CEF,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3EE0D0

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ApisByteFileLead
String ID:
API String ID: 2314917384-0
Opcode ID: 718c74c97fb463c52b99b5c423ab5a26bd3bf6ee4f921fee69c15b64d7a4ac1f
Instruction ID: f1561ee3c0c4bdc366e8eff4146793e59b4191b489c9f10f2611f3de7cfba250
Opcode Fuzzy Hash: 718c74c97fb463c52b99b5c423ab5a26bd3bf6ee4f921fee69c15b64d7a4ac1f
Instruction Fuzzy Hash: B2412A22A0EA93D2F6755633959037AD6C15F31384FA6407ECE8A466E0DF2EECC75320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E90C0 Relevance: 4.5, Strings: 3, Instructions: 729COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 00007FF7AA3E9B49
invalid distance too far back, xrefs: 00007FF7AA3E9BC3
invalid distance code, xrefs: 00007FF7AA3E9B5D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: d838ec5af7f9aa80e0a32a3176bc22eced0e3653fccdf2b65d3da4d7ff7ba5a2
Instruction ID: 5969419825dc150598c83cefd38b2f6a940e143167faa28323f28e8362f91a90
Opcode Fuzzy Hash: d838ec5af7f9aa80e0a32a3176bc22eced0e3653fccdf2b65d3da4d7ff7ba5a2
Instruction Fuzzy Hash: A3526B33A196D0CAE720CF29E00497DFFE0F765744F558269EB9A43B92C62ED546CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F45BB Relevance: 2.3, APIs: 1, Instructions: 1098COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf3d7ae67330c36a8d1d5b1d9c49f67903b526f52cf998ae797c659ef6e2bb2
Instruction ID: 8db36b05694ac396dfff81bcbe78b24732f8e8a22bfdb474537b41559d7f13bb
Opcode Fuzzy Hash: 6bf3d7ae67330c36a8d1d5b1d9c49f67903b526f52cf998ae797c659ef6e2bb2
Instruction Fuzzy Hash: 97A2E933A2EA43C6FB55AA25950432EE690FB51784F81817DEE4E4BBA5DF3CE4428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E8520 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c5247e8e5ae1c0f1ff1869e277a4882683cc6e91f01376b60bfe87d152a30b
Instruction ID: 5e32a2f00f8889f35484a9c874f5273e0a707493e48d0cc0eae9b7714c4f0bd2
Opcode Fuzzy Hash: 23c5247e8e5ae1c0f1ff1869e277a4882683cc6e91f01376b60bfe87d152a30b
Instruction Fuzzy Hash: 86223B337201A087EA68DB1AC47497A77D0F39E795B82623EDF5A577D0CA3DA412C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3ECC70 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b846c4d0e2c1b2bd1f0efba9a29402bcb1d218dbe16fb225c1ea1697d81af2fa
Instruction ID: b8811dbcab1bfadfbeab33ddd9032c3eaee38b4249ede0c1f02c770bb1c84a72
Opcode Fuzzy Hash: b846c4d0e2c1b2bd1f0efba9a29402bcb1d218dbe16fb225c1ea1697d81af2fa
Instruction Fuzzy Hash: 9A22B133919A91C6E3769F04E00036FF7A0FB94784F42417AEA8A53AA4DB7DD895CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7F80 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f750d9511da68ba8da8e2a60d6434467626d18ff9c7d7c8e0f97984c9e16eb5
Instruction ID: fc0e2284794a5ac8a85b9ce7e061048ecb45080ef7be2f7b19bee68799f78cdf
Opcode Fuzzy Hash: 3f750d9511da68ba8da8e2a60d6434467626d18ff9c7d7c8e0f97984c9e16eb5
Instruction Fuzzy Hash: 819192A3E180E187E72E0764FC22F74AD517B22709F8C92BDE68391ED3D12CD561A354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EC650 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec84afe922c0a2f63174144b1439b1237ceca3b54fb02e19b3c015b4671d8235
Instruction ID: 68e09f97545f9dd3fb7df04f30b4a05d7751c8725db84f7aaafb5e1f5be08f60
Opcode Fuzzy Hash: ec84afe922c0a2f63174144b1439b1237ceca3b54fb02e19b3c015b4671d8235
Instruction Fuzzy Hash: 49713CB3A29691CAF7B64F18D500B2CB6E0F711B54F515138DE1907AE0CB39DDA2CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E6190 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 260libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E61A3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E61C3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E61E3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6203
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6223
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6243
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6263
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6283
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E62A3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E62C3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E62E3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6303
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6323
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6343
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6363
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6383
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E63A3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E63C3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E63E3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6403
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6423
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6443
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6463
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6483
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E64A3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E64C3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E64E3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6503
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6523
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6543
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E6563

Strings

Tcl_Alloc, xrefs: 00007FF7AA3E64F9
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7AA3E6647
Failed to get address for Tcl_GetString, xrefs: 00007FF7AA3E6662
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7AA3E66A1
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7AA3E668F
Tcl_DoOneEvent, xrefs: 00007FF7AA3E61F9
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7AA3E65A2
Tcl_EvalObjv, xrefs: 00007FF7AA3E64D9
Tk_GetNumMainWindows, xrefs: 00007FF7AA3E6559
Tcl_GetString, xrefs: 00007FF7AA3E63F9
Tcl_ConditionFinalize, xrefs: 00007FF7AA3E62F9
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7AA3E6596
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7AA3E65AE
Tcl_EvalEx, xrefs: 00007FF7AA3E64B9
Tcl_ThreadAlert, xrefs: 00007FF7AA3E6379
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7AA3E6650
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7AA3E661A
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7AA3E6659
Failed to get address for Tcl_Finalize, xrefs: 00007FF7AA3E65BA
Failed to get address for Tcl_Alloc, xrefs: 00007FF7AA3E66AA
Tcl_ConditionNotify, xrefs: 00007FF7AA3E6319
Tcl_Free, xrefs: 00007FF7AA3E6519
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7AA3E6602
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7AA3E6632
Tcl_GetCurrentThread, xrefs: 00007FF7AA3E6299
Tcl_CreateInterp, xrefs: 00007FF7AA3E61B9
Tcl_NewByteArrayObj, xrefs: 00007FF7AA3E6439
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7AA3E65C6
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7AA3E65D2
Tcl_DeleteInterp, xrefs: 00007FF7AA3E6259
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7AA3E660E
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7AA3E666B
Tcl_MutexUnlock, xrefs: 00007FF7AA3E62D9
GetProcAddress, xrefs: 00007FF7AA3E66C3
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7AA3E6626
Tcl_FinalizeThread, xrefs: 00007FF7AA3E6239
Tcl_GetObjResult, xrefs: 00007FF7AA3E6479
Failed to get address for Tcl_Free, xrefs: 00007FF7AA3E66B3
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7AA3E6698
Tk_Init, xrefs: 00007FF7AA3E6539
Tcl_SetVar2, xrefs: 00007FF7AA3E63B9
Tcl_CreateObjCommand, xrefs: 00007FF7AA3E63D9
Tcl_FindExecutable, xrefs: 00007FF7AA3E61D9
Tcl_MutexLock, xrefs: 00007FF7AA3E62B9
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7AA3E65F6
Tcl_EvalFile, xrefs: 00007FF7AA3E6499
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7AA3E663E
Tcl_Init, xrefs: 00007FF7AA3E619C
Tcl_ConditionWait, xrefs: 00007FF7AA3E6339
Failed to get address for Tcl_Init, xrefs: 00007FF7AA3E658A
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7AA3E65EA
Tcl_Finalize, xrefs: 00007FF7AA3E6219
Tcl_GetVar2, xrefs: 00007FF7AA3E6399
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7AA3E657E
Tcl_ThreadQueueEvent, xrefs: 00007FF7AA3E6359
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7AA3E667D
Tcl_NewStringObj, xrefs: 00007FF7AA3E6419
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7AA3E6686
Failed to get address for Tk_Init, xrefs: 00007FF7AA3E66BC
Tcl_SetVar2Ex, xrefs: 00007FF7AA3E6459
Tcl_CreateThread, xrefs: 00007FF7AA3E6279
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7AA3E6674
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7AA3E65DE

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: fe2894239f1b48e2a4a604613faffa84ac2c3dcd80e7092e4ad8d95df84a7332
Instruction ID: cbdcfd8339f8e853bd4588f264cb883c5686011576b2016319504e082754713b
Opcode Fuzzy Hash: fe2894239f1b48e2a4a604613faffa84ac2c3dcd80e7092e4ad8d95df84a7332
Instruction Fuzzy Hash: 70E1D765A2FF03D1FE59EB19E954178E2A16F14784BC240BED80E09674EF7DA50BC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E3700 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 260stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3726
strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E37AF
strcmp.MSVCRT ref: 00007FF7AA3E37BE
strcmp.MSVCRT ref: 00007FF7AA3E37D1
strcmp.MSVCRT ref: 00007FF7AA3E37E4
strcmp.MSVCRT ref: 00007FF7AA3E37FB
strcmp.MSVCRT ref: 00007FF7AA3E3812
strcmp.MSVCRT ref: 00007FF7AA3E3829
strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E3846
strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E3863
strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E3880
strtoul.MSVCRT ref: 00007FF7AA3E38C5
calloc.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3913
calloc.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3927
strncmp.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3998
strncmp.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E39B1
mbstowcs.MSVCRT ref: 00007FF7AA3E39DD
_wcsdup.MSVCRT ref: 00007FF7AA3E39E8
strncmp.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3A18
strcmp.MSVCRT ref: 00007FF7AA3E3A4D
strncmp.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3A6C
strcmp.MSVCRT ref: 00007FF7AA3E3AB5

Strings

optimize, xrefs: 00007FF7AA3E3822
pyi-, xrefs: 00007FF7AA3E3751
verbose, xrefs: 00007FF7AA3E37CA
hash_seed, xrefs: 00007FF7AA3E3879
utf8, xrefs: 00007FF7AA3E3A11
unbuffered, xrefs: 00007FF7AA3E37F4
dev, xrefs: 00007FF7AA3E3A65

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strcmpstrncmp$calloc$_wcsdupmbstowcsstrtoul
String ID: dev$hash_seed$optimize$pyi-$unbuffered$utf8$verbose
API String ID: 2207410382-1583030999
Opcode ID: 2d1a19d6990cd4f4ae62d797e184bda15c22d14e0018529d6f51f6fd44eb6687
Instruction ID: a2b3f9d665131728343689d201b1125b42c31a350dfe0fe8e15ae8bab9d65334
Opcode Fuzzy Hash: 2d1a19d6990cd4f4ae62d797e184bda15c22d14e0018529d6f51f6fd44eb6687
Instruction Fuzzy Hash: 1AA15F62B1A943D5FE74BB12D4002BAE690AF54780FCA44FDDE4D4A6B1DF6DE5438320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F2890 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 238COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7AA3F29AD
memset.MSVCRT ref: 00007FF7AA3F2A3E
fputwc.MSVCRT ref: 00007FF7AA3F2ABE
fputwc.MSVCRT ref: 00007FF7AA3F2B1E
fputwc.MSVCRT ref: 00007FF7AA3F2B7E

Strings

o, xrefs: 00007FF7AA3F2B9D
o, xrefs: 00007FF7AA3F2A50
o, xrefs: 00007FF7AA3F28F5
o, xrefs: 00007FF7AA3F28A4
o, xrefs: 00007FF7AA3F29BE
o, xrefs: 00007FF7AA3F29F9

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputwc$memset
String ID: o$o$o$o$o$o
API String ID: 822753988-2858737866
Opcode ID: 278f7780cede6ee9ca3639ac4cfd32249976c8c72b48b6ea96b22295a8153b28
Instruction ID: 401b143f71ad0532ac9b1bbb6a37e086bf13510eb2470cb4c65ac1e2b6f34b3c
Opcode Fuzzy Hash: 278f7780cede6ee9ca3639ac4cfd32249976c8c72b48b6ea96b22295a8153b28
Instruction Fuzzy Hash: AE915623E2AA43C6FB346E56914073EB6D1AB04740F829179CE5E4B6F1DA3CE8528310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F0100 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7AA3F021D
memset.MSVCRT ref: 00007FF7AA3F02AE
fputc.MSVCRT ref: 00007FF7AA3F0329
fputc.MSVCRT ref: 00007FF7AA3F037B
fputc.MSVCRT ref: 00007FF7AA3F03C9

Strings

o, xrefs: 00007FF7AA3F03E5
o, xrefs: 00007FF7AA3F0114
o, xrefs: 00007FF7AA3F022E
o, xrefs: 00007FF7AA3F0165
o, xrefs: 00007FF7AA3F02C0
o, xrefs: 00007FF7AA3F0269

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputc$memset
String ID: o$o$o$o$o$o
API String ID: 2944404495-2858737866
Opcode ID: 635cc509fca95c22da8796b4187b55a0c08c534790152e697fac5d5879f1d58d
Instruction ID: cd965b667dd41b6368b53d97b6eca41d9795c531c7ede92a5eda77070811fc77
Opcode Fuzzy Hash: 635cc509fca95c22da8796b4187b55a0c08c534790152e697fac5d5879f1d58d
Instruction Fuzzy Hash: 0C815E23F26683C7FBB55A19A14073DA6D1AB01750F414179DE5E1E6E1EA3CFD42C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E4D60 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA3E3700: calloc.MSVCRT(00000000,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3726
Part of subcall function 00007FF7AA3E3700: strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E37AF
Part of subcall function 00007FF7AA3E3700: strcmp.MSVCRT ref: 00007FF7AA3E37BE
Part of subcall function 00007FF7AA3E3700: strcmp.MSVCRT ref: 00007FF7AA3E37D1
Part of subcall function 00007FF7AA3E3700: strcmp.MSVCRT ref: 00007FF7AA3E37E4
Part of subcall function 00007FF7AA3E3700: strcmp.MSVCRT ref: 00007FF7AA3E37FB
Part of subcall function 00007FF7AA3E3700: strcmp.MSVCRT ref: 00007FF7AA3E3812
Part of subcall function 00007FF7AA3E3700: strcmp.MSVCRT ref: 00007FF7AA3E3829
Part of subcall function 00007FF7AA3E3700: strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E3846
Part of subcall function 00007FF7AA3E3700: strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E3863
Part of subcall function 00007FF7AA3E3700: strncmp.MSVCRT(00000000,00000000,?,00000000), ref: 00007FF7AA3E3880
Part of subcall function 00007FF7AA3E3700: strtoul.MSVCRT ref: 00007FF7AA3E38C5

Part of subcall function 00007FF7AA3E3FC0: calloc.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00007FF7AA3E4DEC), ref: 00007FF7AA3E3FE0

fflush.MSVCRT ref: 00007FF7AA3E4E1E
fflush.MSVCRT ref: 00007FF7AA3E4E2D

Strings

Failed to start embedded python interpreter!, xrefs: 00007FF7AA3E4E70
Failed to set run-time options!, xrefs: 00007FF7AA3E4EEE
Failed to parse run-time options!, xrefs: 00007FF7AA3E4EA3
Failed to set module search paths!, xrefs: 00007FF7AA3E4EDC
Failed to set sys.argv!, xrefs: 00007FF7AA3E4EE5
Failed to pre-initialize embedded python interpreter!, xrefs: 00007FF7AA3E4EAC
Failed to set python home path!, xrefs: 00007FF7AA3E4ED3
Failed to set program name!, xrefs: 00007FF7AA3E4ECA
Failed to allocate PyConfig structure! Unsupported python version?, xrefs: 00007FF7AA3E4EB5

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strcmp$strncmp$callocfflush$strtoul
String ID: Failed to allocate PyConfig structure! Unsupported python version?$Failed to parse run-time options!$Failed to pre-initialize embedded python interpreter!$Failed to set module search paths!$Failed to set program name!$Failed to set python home path!$Failed to set run-time options!$Failed to set sys.argv!$Failed to start embedded python interpreter!
API String ID: 4178785873-3807717293
Opcode ID: 146588e39bfc09d17a7e13df8ec44e5740a96b0879bf06e1c9e5f07172f711ad
Instruction ID: 12947e7dd90e02e127ca2f208ac795646e6c00b6ae007c4121dc939ecc26947e
Opcode Fuzzy Hash: 146588e39bfc09d17a7e13df8ec44e5740a96b0879bf06e1c9e5f07172f711ad
Instruction Fuzzy Hash: 5641B011A1EE47D1FE24B725E9111B9D3A0AFA47C0FC600B9DE0E466B2EF2DE5078324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E13F0 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA3E34E0: _wfopen.MSVCRT ref: 00007FF7AA3E3525

Part of subcall function 00007FF7AA3EE630: fsetpos.MSVCRT ref: 00007FF7AA3EEE7A

malloc.MSVCRT(00000000,00007FF7AA401158,00000000,00007FF7AA401198,00007FF7AA3E4FEC,?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E1436
fread.MSVCRT ref: 00007FF7AA3E14F0
free.MSVCRT(00000000,00007FF7AA401158,00000000,00007FF7AA401198,00007FF7AA3E4FEC,?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E1521
fclose.MSVCRT ref: 00007FF7AA3E152B

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7AA3E148C
malloc, xrefs: 00007FF7AA3E14A4
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7AA3E146B
fread, xrefs: 00007FF7AA3E1508
fseek, xrefs: 00007FF7AA3E1485
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7AA3E150F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7AA3E14AB

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _wfopenfclosefreadfreefsetposmalloc
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 992631249-3659356012
Opcode ID: 8040ca6edf8fc77f2289d5229afc01172d03bf31662efbf504a4b205f422bbca
Instruction ID: e1cb66fd593d083c19f5cd863d1224ae19e1c019177502a36e1ff098307b104d
Opcode Fuzzy Hash: 8040ca6edf8fc77f2289d5229afc01172d03bf31662efbf504a4b205f422bbca
Instruction Fuzzy Hash: 0A31AD52B1BA53D1FE60B752D9016B9C6916F31BC0FC240B9DE0E0B7E6EE2DA1078320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E59C0 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 139stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EA9), ref: 00007FF7AA3E59E9
strlen.MSVCRT ref: 00007FF7AA3E5A40
memcpy.MSVCRT ref: 00007FF7AA3E5A82
strlen.MSVCRT ref: 00007FF7AA3E5AAA
strlen.MSVCRT ref: 00007FF7AA3E5ABC

Part of subcall function 00007FF7AA3E31C0: strlen.MSVCRT ref: 00007FF7AA3E31FB
Part of subcall function 00007FF7AA3E31C0: strncat.MSVCRT ref: 00007FF7AA3E3213
Part of subcall function 00007FF7AA3E31C0: strlen.MSVCRT ref: 00007FF7AA3E3221

strncpy.MSVCRT ref: 00007FF7AA3E5B2C
strncpy.MSVCRT ref: 00007FF7AA3E5B49
strncpy.MSVCRT ref: 00007FF7AA3E5B74
free.MSVCRT(?,00000000,?,00000000,?,?,00000000,00000000,00007FF7AA3E2EA9), ref: 00007FF7AA3E5BAE

Part of subcall function 00007FF7AA3E1F40: _stricmp.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E1FA3

Strings

SPLASH: Cannot find requirement %s in archive., xrefs: 00007FF7AA3E5BC9
SPLASH: Cannot extract requirement %s., xrefs: 00007FF7AA3E5ADE

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen$strncpy$_stricmpcallocfreememcpystrncat
String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
API String ID: 986776209-4094522769
Opcode ID: 1a47553765d1957d65dc7bdad22abb3f032ecfa06dec96ee915649798ea874b6
Instruction ID: 148f4ae9689f02ecc15de6fc40ee9dcf76aaab671b3c2bf57b05a5dbf65a3156
Opcode Fuzzy Hash: 1a47553765d1957d65dc7bdad22abb3f032ecfa06dec96ee915649798ea874b6
Instruction Fuzzy Hash: 4F51F853B1A982C2F924BB12D8153BAD695FF54BC4F8A40BDEE4D477A6CE3CD5028320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E29A0 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 124COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF7AA3E2AF7

Strings

__main__, xrefs: 00007FF7AA3E29C7
\, xrefs: 00007FF7AA3E2A55
Absolute path to script exceeds PATH_MAX, xrefs: 00007FF7AA3E2B3E
__file__, xrefs: 00007FF7AA3E2A8E
%s%c%s.py, xrefs: 00007FF7AA3E2A60
Failed to execute script '%s' due to unhandled exception!, xrefs: 00007FF7AA3E2B6A
Failed to unmarshal code object for %s, xrefs: 00007FF7AA3E2B47
Could not get __main__ module's dict., xrefs: 00007FF7AA3E2B15
_pyi_main_co, xrefs: 00007FF7AA3E2ACB
Could not get __main__ module., xrefs: 00007FF7AA3E2B0C

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free
String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to execute script '%s' due to unhandled exception!$Failed to unmarshal code object for %s$\$__file__$__main__$_pyi_main_co
API String ID: 1294909896-3844934790
Opcode ID: 52c0473f6df9ddebf92829e1d8fdfcceb54c06465e974849f4d1ce4d3b9bbf2e
Instruction ID: cb90c99f023ecf55cc0dfc3233d0a0adbfcf7704361eb761a688afadf1c76e8c
Opcode Fuzzy Hash: 52c0473f6df9ddebf92829e1d8fdfcceb54c06465e974849f4d1ce4d3b9bbf2e
Instruction Fuzzy Hash: 4751312262AE47C2FE25AB51E84457DA3A0BB54B80FC580B9DE0E477B1DE7DE546C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E52B0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 00007FF7AA3E5320
strncpy.MSVCRT ref: 00007FF7AA3E5336
strncpy.MSVCRT ref: 00007FF7AA3E534C
calloc.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E5381
malloc.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E53A1
malloc.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E53C1
memcpy.MSVCRT ref: 00007FF7AA3E53ED
memcpy.MSVCRT ref: 00007FF7AA3E5400
memcpy.MSVCRT ref: 00007FF7AA3E5413
free.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E541B

Part of subcall function 00007FF7AA3E21D0: fputs.MSVCRT ref: 00007FF7AA3E2279

Strings

Cannot allocate memory for necessary files., xrefs: 00007FF7AA3E5424

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memcpystrncpy$malloc$callocfputsfree
String ID: Cannot allocate memory for necessary files.
API String ID: 756735427-2795144771
Opcode ID: 6e6b0eac2277b668256d20dc08db14afeef494fd687b3f9fdb51dbac0fe1e736
Instruction ID: e400dd8009a9879d5052c99a676c69ecb0af78f1bec8ff5e45354c8bf1881fef
Opcode Fuzzy Hash: 6e6b0eac2277b668256d20dc08db14afeef494fd687b3f9fdb51dbac0fe1e736
Instruction Fuzzy Hash: 3D410062B17A42D6EE25EB12C5452BDA2D1FB14B81FC2447DDE0C0BBA6DF3CE1528360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F37E0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 414COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7AA3F3957

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e9dbd4d0ef0df457af75d63c0a234be279d9f6b1de3d1ee0de50c696d690b36c
Instruction ID: 93b0ff052a488acfe36aa82708fba5449bf843b64e96c4e7e4bce155005c3205
Opcode Fuzzy Hash: e9dbd4d0ef0df457af75d63c0a234be279d9f6b1de3d1ee0de50c696d690b36c
Instruction Fuzzy Hash: FF025973A2AA43C7FF789A16E05077EB791EB14740F4141BDD76E4BAA1DB2CE4428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F1060 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 391COMMON

Download Yara Rule

APIs

fputc.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AA3EFAFD), ref: 00007FF7AA3F12B9

Strings

., xrefs: 00007FF7AA3F11D4

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputc
String ID: .
API String ID: 1992160199-248832578
Opcode ID: 122219fc7cfa75e3959974da5968a099eb5a29f0b57d8d497eab761109a43e66
Instruction ID: 6dab2cd85a8519f31b5e344616257cb5f7221ed2f4cbfe24439e739779a4319f
Opcode Fuzzy Hash: 122219fc7cfa75e3959974da5968a099eb5a29f0b57d8d497eab761109a43e66
Instruction Fuzzy Hash: 1DF17133A2AA43C7FB749A16F05173EF7A1EB54740F81417DDB9E4AAA1CB2DE4428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F2310 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3F23DA
fputwc.MSVCRT ref: 00007FF7AA3F2447
fwprintf.MSVCRT ref: 00007FF7AA3F251D
fwprintf.MSVCRT ref: 00007FF7AA3F2537

Strings

%-*.*S, xrefs: 00007FF7AA3F252D
%*.*S, xrefs: 00007FF7AA3F2363
%.*S, xrefs: 00007FF7AA3F2510

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fwprintf$fputwcstrlen
String ID: %*.*S$%-*.*S$%.*S
API String ID: 3854221471-2115465065
Opcode ID: 5ad481ce38ecb52435a682d5a421e2a6b3f0d95fa3e28bbd96dc99fb2b47f9c2
Instruction ID: 563ba6999700fe30824884d0fbb83e634b9896ffb46d23769d9559c0d16c539f
Opcode Fuzzy Hash: 5ad481ce38ecb52435a682d5a421e2a6b3f0d95fa3e28bbd96dc99fb2b47f9c2
Instruction Fuzzy Hash: A3519473A25A43C6FF74AA46E05163EF3A1EB44750F81917DDB5E8B6A5CA3CE4028B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F2120 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

fputwc.MSVCRT ref: 00007FF7AA3F21F5
fwprintf.MSVCRT ref: 00007FF7AA3F22D7

Strings

%*.*s, xrefs: 00007FF7AA3F216D
%.*s, xrefs: 00007FF7AA3F22B0
%-*.*s, xrefs: 00007FF7AA3F22CD
_MEI%d, xrefs: 00007FF7AA3F2122

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputwcfwprintf
String ID: %*.*s$%-*.*s$%.*s$_MEI%d
API String ID: 3232229890-1691410145
Opcode ID: ebfa802009c912ebd865038a8a7942d71413b88daf93316cfeae70b159e0f680
Instruction ID: 00817daddfa3c26c948acceba8fc49956b525f3a30a0001e5dc3d1f8dc5268ef
Opcode Fuzzy Hash: ebfa802009c912ebd865038a8a7942d71413b88daf93316cfeae70b159e0f680
Instruction Fuzzy Hash: 50516433A25A03DAFF74AB56E45063DF3A1EB44750F41C17DDB5E8B6A0DA2CE8428B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE1D0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3EE1EE
_stat64.MSVCRT ref: 00007FF7AA3EE204
_stat64.MSVCRT ref: 00007FF7AA3EE215
free.MSVCRT(?,?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3EE224
malloc.MSVCRT(?,?,?,?,?,00007FF7AA3E1366), ref: 00007FF7AA3EE34E
memcpy.MSVCRT ref: 00007FF7AA3EE35F

Strings

\, xrefs: 00007FF7AA3EE299
/, xrefs: 00007FF7AA3EE29E

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _stat64$freemallocmemcpystrlen
String ID: /$\
API String ID: 4289191721-1600464054
Opcode ID: a404128838270cfd53adb9c0ff58c1924b98eb580030a439bab3da3e4b6c42aa
Instruction ID: 1d347e52215d424bbe9f7a49a49b6daec0a457c904b42b3cb58d4a640acd8087
Opcode Fuzzy Hash: a404128838270cfd53adb9c0ff58c1924b98eb580030a439bab3da3e4b6c42aa
Instruction Fuzzy Hash: 66415F12A1EE92D1FA34AA25E45023CE2D1AF65750FA5437DDB9E02AE1DF1DB4838710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7830 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,0000018E4F4813D0,4F4813D000000001,00000000,00007FF7AA3E7A1E,4F4813D000000001,00000000,?,00007FF7AA3E13C5,?,?,00000000,00007FF7AA3E1315), ref: 00007FF7AA3E7864
WideCharToMultiByte.KERNEL32 ref: 00007FF7AA3E78AE
calloc.MSVCRT ref: 00007FF7AA3E78C6

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF7AA3E78E5
win32_utils_to_utf8, xrefs: 00007FF7AA3E78EE
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7AA3E7879
Out of memory., xrefs: 00007FF7AA3E78F5
WideCharToMultiByte, xrefs: 00007FF7AA3E7872, 00007FF7AA3E78DE

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1374691127-27947307
Opcode ID: 10621f273093aeafe8d0f47f93c854732b48dcafdb85ad1d5253d9e282c8ce0e
Instruction ID: b2db5daba61e1f41d8442b45ac9074d79f8cf034a9317d78b0c3b2f575f045aa
Opcode Fuzzy Hash: 10621f273093aeafe8d0f47f93c854732b48dcafdb85ad1d5253d9e282c8ce0e
Instruction Fuzzy Hash: 57110422E2BF87C1FA64AB16AC00779D2919FA47D4F854279D81E467F0EF2CA587C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7910 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 49COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7AA3E793F
calloc.MSVCRT ref: 00007FF7AA3E7953
WideCharToMultiByte.KERNEL32 ref: 00007FF7AA3E797E

Strings

win32_wcs_to_mbs, xrefs: 00007FF7AA3E79AD
Failed to encode filename as ANSI., xrefs: 00007FF7AA3E7994
Failed to get ANSI buffer size., xrefs: 00007FF7AA3E79A4
Out of memory., xrefs: 00007FF7AA3E79B4
WideCharToMultiByte, xrefs: 00007FF7AA3E798D, 00007FF7AA3E799D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
API String ID: 1374691127-3831141058
Opcode ID: f47a8ee0085ebfbaf498f4f4992bb07378281e3537b7dad908a1a97b20c9311f
Instruction ID: fc663c8291b31c811fcffcc6eb9df04fc970210531acd229e95a9b839f368b59
Opcode Fuzzy Hash: f47a8ee0085ebfbaf498f4f4992bb07378281e3537b7dad908a1a97b20c9311f
Instruction Fuzzy Hash: 9B11BB22A1AE43C2FE54EB11EC4067992915F947A4F85837DE41E466F4EF6CE5878310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7120 Relevance: 13.6, APIs: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA3E34E0: _wfopen.MSVCRT ref: 00007FF7AA3E3525

ferror.MSVCRT ref: 00007FF7AA3E7183
feof.MSVCRT ref: 00007FF7AA3E718F
fread.MSVCRT ref: 00007FF7AA3E71A9
fwrite.MSVCRT ref: 00007FF7AA3E71C1
ferror.MSVCRT ref: 00007FF7AA3E71CE
fclose.MSVCRT ref: 00007FF7AA3E71E4
clearerr.MSVCRT ref: 00007FF7AA3E71F8
fclose.MSVCRT ref: 00007FF7AA3E7205
fclose.MSVCRT ref: 00007FF7AA3E720D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fclose$ferror$_wfopenclearerrfeoffreadfwrite
String ID:
API String ID: 1088953109-0
Opcode ID: cbfedd6e88c280e90ecdd6ee3e3ef0a565d66dac5174f4f30b1251cea7277b63
Instruction ID: 629021170c5ae7f679da170bfdce13c8eb70dbe9fd774797c76aa9f068ab6fe6
Opcode Fuzzy Hash: cbfedd6e88c280e90ecdd6ee3e3ef0a565d66dac5174f4f30b1251cea7277b63
Instruction Fuzzy Hash: 49211611B0FA83C2F96A71239A613BDC1C11F65BD0E8601BDED1D5BBE6EE1CA9034320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EDAA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7AA3FD4C0,00007FF7AA3FD4C0,?,?,00007FF7AA3E0000,?,00007FF7AA3ED8A1), ref: 00007FF7AA3EDB63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7AA3FD4C0,00007FF7AA3FD4C0,?,?,00007FF7AA3E0000,?,00007FF7AA3ED8A1), ref: 00007FF7AA3EDBC7
memcpy.MSVCRT ref: 00007FF7AA3EDBE0
GetLastError.KERNEL32(?,?,?,?,00007FF7AA3FD4C0,00007FF7AA3FD4C0,?,?,00007FF7AA3E0000,?,00007FF7AA3ED8A1), ref: 00007FF7AA3EDC23

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF7AA3EDC29
Address %p has no image-section, xrefs: 00007FF7AA3EDBF4
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7AA3EDC17

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: ac377124520f9478e38bdf8e726e6866ee1a9daf6e7feb1dc7c811cc560be949
Instruction ID: a866c9b3479cc2ec55dedd60f2254dac7ec77335224bfabef62bca7d450a0b63
Opcode Fuzzy Hash: ac377124520f9478e38bdf8e726e6866ee1a9daf6e7feb1dc7c811cc560be949
Instruction Fuzzy Hash: B3417561A1AE47C1FE21AB55D8446B8A790EB54FC0F9640BADE0E473B4DE3CE547C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7470 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF7AA3E7489
_strdup.MSVCRT ref: 00007FF7AA3E74B4
_errno.MSVCRT ref: 00007FF7AA3E74D8
_errno.MSVCRT ref: 00007FF7AA3E74F6
strerror.MSVCRT ref: 00007FF7AA3E74FE

Strings

LOADER: failed to allocate argv_pyi: %s, xrefs: 00007FF7AA3E74E5
LOADER: failed to strdup argv[%d]: %s, xrefs: 00007FF7AA3E7503

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: _errno$_strdupcallocstrerror
String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
API String ID: 1567652794-2782260415
Opcode ID: d3fbfd2a3e19ab06a9085d0b7d2add80a3df39176c7e5e49379b72d8ed301cc1
Instruction ID: 35bbeaf3ae914a3b6398e824c6c2419b822ab8a518e982d255486900aa7d4d65
Opcode Fuzzy Hash: d3fbfd2a3e19ab06a9085d0b7d2add80a3df39176c7e5e49379b72d8ed301cc1
Instruction Fuzzy Hash: 26116D22A1BA43C6FB20BB55D841579E2D0AF58781F8645BDDE0D473B1EE2CA4468320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7A80 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC
MultiByteToWideChar.KERNEL32 ref: 00007FF7AA3E7AEE
calloc.MSVCRT ref: 00007FF7AA3E7B06

Strings

MultiByteToWideChar, xrefs: 00007FF7AA3E7ABA, 00007FF7AA3E7B1E
win32_utils_from_utf8, xrefs: 00007FF7AA3E7B2E
Failed to get wchar_t buffer size., xrefs: 00007FF7AA3E7B25
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7AA3E7AC1
Out of memory., xrefs: 00007FF7AA3E7B35

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1374691127-876015163
Opcode ID: 2ac019bb220f1e5592d698f0f472354611e59ba99ee9ea5776c466d634b59f30
Instruction ID: 9f8c6c3bddbb05fa3d428c842b441d0896cd1daba0ba444f396928e7aa01cdeb
Opcode Fuzzy Hash: 2ac019bb220f1e5592d698f0f472354611e59ba99ee9ea5776c466d634b59f30
Instruction Fuzzy Hash: D5117F22B1BE43C1FE60AB16E810379E6959F547D4F8981B9D91E4A7F4EE2CA5078320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F0A40 Relevance: 10.9, APIs: 7, Instructions: 351COMMON

Download Yara Rule

APIs

fputc.MSVCRT(?,?,?,?,00007FF7AA3F0887,?,?,?,00000000,?,00007FF7AA3F0484), ref: 00007FF7AA3F0C8D
fputc.MSVCRT(?,?,?,?,00007FF7AA3F0887,?,?,?,00000000,?,00007FF7AA3F0484), ref: 00007FF7AA3F0CA0
fputc.MSVCRT(?,?,?,?,00007FF7AA3F0887,?,?,?,00000000,?,00007FF7AA3F0484), ref: 00007FF7AA3F0D09

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 7aaa8780a501f10c35e72f21a1f6a78fe25f27a0f915b35d8529c1a82c5d05bb
Instruction ID: aced106555e09354782af9ad08de1a05cbf39ac139badc78bf95a1ef4db37c60
Opcode Fuzzy Hash: 7aaa8780a501f10c35e72f21a1f6a78fe25f27a0f915b35d8529c1a82c5d05bb
Instruction Fuzzy Hash: 50E16533A26A43C7FFB49A19D15473EB7D1EB15740F82417DCB9A4A6A1EA2CFC428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E5590 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 157COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF7AA3E579A

Strings

_image_data, xrefs: 00007FF7AA3E5783
tclInit, xrefs: 00007FF7AA3E55ED
rename ::source ::_source, xrefs: 00007FF7AA3E565A
tcl_findLibrary, xrefs: 00007FF7AA3E5614
exit, xrefs: 00007FF7AA3E5638
source, xrefs: 00007FF7AA3E567A

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free
String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
API String ID: 1294909896-1126984729
Opcode ID: f5932ce80a0084c5119ee1f27d3cfd0e947d8995a96b6197cd0cdc0c0f595579
Instruction ID: 87ce14b453adfa84aa9ce77bbe6153896b8578451b6e2807e9596634551005b6
Opcode Fuzzy Hash: f5932ce80a0084c5119ee1f27d3cfd0e947d8995a96b6197cd0cdc0c0f595579
Instruction Fuzzy Hash: E5712076A1AE46C2FB14AB26E85436CA360FB58B84F82817ADA4E57370DF7CD547C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E4F20 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3E4F47
free.MSVCRT(?,?,?,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E4FB3

Strings

utf-8, xrefs: 00007FF7AA3E4F4C
Module object for %s is NULL!, xrefs: 00007FF7AA3E5014
Failed to get _MEIPASS as PyObject., xrefs: 00007FF7AA3E503D
strict, xrefs: 00007FF7AA3E4F53
_MEIPASS, xrefs: 00007FF7AA3E4F72

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: freestrlen
String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
API String ID: 322734593-985300917
Opcode ID: 12839e1e6e95211b04b121684f5269545b04bbc55d955947553f10d94a991eb3
Instruction ID: cf09ca16b82f9cb6d6b10c531e6b6ccc70647c9037aaa7b0d902164cc9106674
Opcode Fuzzy Hash: 12839e1e6e95211b04b121684f5269545b04bbc55d955947553f10d94a991eb3
Instruction Fuzzy Hash: A8315012A1BD03D1FD24BB52E95407DE3A1AF14B94B8644BADE0D0B7B1DE7CE4478360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E5140 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 81stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3E51B1

Strings

utf-8, xrefs: 00007FF7AA3E51BC
Failed to append PYZ entry to sys.path!, xrefs: 00007FF7AA3E5215
path, xrefs: 00007FF7AA3E516E
Installing PYZ: Could not get sys.path!, xrefs: 00007FF7AA3E522F
%U?%llu, xrefs: 00007FF7AA3E51D0
strict, xrefs: 00007FF7AA3E51C3

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen
String ID: %U?%llu$Failed to append PYZ entry to sys.path!$Installing PYZ: Could not get sys.path!$path$strict$utf-8
API String ID: 39653677-372213108
Opcode ID: d2d8521611c24ce5a1f8c8ad5e01bbe6569efc10161effd633e17e272b802c18
Instruction ID: 12908066e65efc9d9cbd4d728e366570a43875d0dee47a97a8baba9c93274e95
Opcode Fuzzy Hash: d2d8521611c24ce5a1f8c8ad5e01bbe6569efc10161effd633e17e272b802c18
Instruction Fuzzy Hash: 10314E22B1BD57D5FE15AB12EC0407DA3A1AF54BD0B8644BADD0E4B7B0DE6CE4478360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E3310 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA3E67B0: GetEnvironmentVariableW.KERNEL32(?,00000000,00007FF7AA3E2C7E,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E67DC
Part of subcall function 00007FF7AA3E67B0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00007FF7AA3E2C7E,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E67FC

strtok.MSVCRT ref: 00007FF7AA3E334F
strtok.MSVCRT ref: 00007FF7AA3E3398
strlen.MSVCRT ref: 00007FF7AA3E33D3
strncat.MSVCRT ref: 00007FF7AA3E33EB
strlen.MSVCRT ref: 00007FF7AA3E33FD

Strings

PATH, xrefs: 00007FF7AA3E332D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Environmentstrlenstrtok$ExpandStringsVariablestrncat
String ID: PATH
API String ID: 4159994607-1036084923
Opcode ID: 336e7ce789043f162b7a024e5c71824fd93b43bf61823aa5537c5a1e3f600e2b
Instruction ID: 08ff34d0c42752c396c98b507e5b5249649673fb43678c26b00fe97ec9ce7d0c
Opcode Fuzzy Hash: 336e7ce789043f162b7a024e5c71824fd93b43bf61823aa5537c5a1e3f600e2b
Instruction Fuzzy Hash: 66214F01B1BA43D4FE31722299067B9D5C06F557D0F8A44FDEE4D467E6EE2DA5438320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E5070 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 55stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3E5091

Part of subcall function 00007FF7AA3E21D0: fputs.MSVCRT ref: 00007FF7AA3E2279

Strings

utf-8, xrefs: 00007FF7AA3E5096
Failed to append PYZ entry to sys.path!, xrefs: 00007FF7AA3E50FD
path, xrefs: 00007FF7AA3E50DB
Installing PYZ: Could not get sys.path!, xrefs: 00007FF7AA3E510F
%U?%llu, xrefs: 00007FF7AA3E50B6
strict, xrefs: 00007FF7AA3E509D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputsstrlen
String ID: %U?%llu$Failed to append PYZ entry to sys.path!$Installing PYZ: Could not get sys.path!$path$strict$utf-8
API String ID: 3651013575-372213108
Opcode ID: 013b57e152159c54bfef7958b13755f9506e2f2b82d09c3de63bc2a21c09813d
Instruction ID: 71f7fe3d2655b8868393f50b83ae4ae44ad45bd40c3a3ebd2c23a3e5c837c364
Opcode Fuzzy Hash: 013b57e152159c54bfef7958b13755f9506e2f2b82d09c3de63bc2a21c09813d
Instruction Fuzzy Hash: BB112E26B1AD57C1FE14AB66E80007DA3A0AF58FD0B8640BACD0E4B370DE6CE5578360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E3DA0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF7AA3E3F54
free.MSVCRT ref: 00007FF7AA3E3F5E
free.MSVCRT ref: 00007FF7AA3E3F6B

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7AA3E7B6B), ref: 00007FF7AA3E7AAC

Part of subcall function 00007FF7AA3E7A80: MultiByteToWideChar.KERNEL32 ref: 00007FF7AA3E7AEE
Part of subcall function 00007FF7AA3E7A80: calloc.MSVCRT ref: 00007FF7AA3E7B06

Strings

base_library.zip, xrefs: 00007FF7AA3E3DBD
\, xrefs: 00007FF7AA3E3DFD
lib-dynload, xrefs: 00007FF7AA3E3DF1

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free$ByteCharMultiWide$calloc
String ID: \$base_library.zip$lib-dynload
API String ID: 1462977401-722148078
Opcode ID: b08f97a5fd674ac6ad4eae09256742df02618db5a5f662c51e3357e251219c37
Instruction ID: c6fde04a289461891df237c3278c341daa9dfc405a446d02bdc17271352b63c4
Opcode Fuzzy Hash: b08f97a5fd674ac6ad4eae09256742df02618db5a5f662c51e3357e251219c37
Instruction Fuzzy Hash: B021873361AE42C6FA30AB14E8413BEA290EF94354FD601BAE54D867B6DF2CD506CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE8E4 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7AA3EE8F8
TlsGetValue.KERNEL32 ref: 00007FF7AA3EE92F
GetLastError.KERNEL32 ref: 00007FF7AA3EE934
LeaveCriticalSection.KERNEL32 ref: 00007FF7AA3EE9F3
free.MSVCRT ref: 00007FF7AA3EEA14
DeleteCriticalSection.KERNEL32 ref: 00007FF7AA3EEA3D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 34b7d706fda5853f974561f5dd42d7315be6b136ece6ea68cf8886336452eda8
Instruction ID: 5efd3cc80697ee28687b85dc7cacadb56d1d90d018a3f95e7b4ceccb9153e323
Opcode Fuzzy Hash: 34b7d706fda5853f974561f5dd42d7315be6b136ece6ea68cf8886336452eda8
Instruction Fuzzy Hash: 15210B25A1BD02D1FA55BB05E944378A2A0BF14B94FE600B9EA0D476B4CF3CB897D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E66E0 Relevance: 8.8, APIs: 7, Instructions: 70stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3E6700
strlen.MSVCRT ref: 00007FF7AA3E6710
strlen.MSVCRT ref: 00007FF7AA3E6720
malloc.MSVCRT ref: 00007FF7AA3E6748
strcat.MSVCRT ref: 00007FF7AA3E6765
strcat.MSVCRT ref: 00007FF7AA3E677A
strcat.MSVCRT ref: 00007FF7AA3E678C

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strcatstrlen$malloc
String ID:
API String ID: 3624720838-0
Opcode ID: 3b9145f703ee4dfcc72c7a742b6e94a3501f07ba0b59668b95fd3c8ca7c9286c
Instruction ID: 0f2411eaad8ba98f151c02553fd8686cde61500271410b79e92eeb1c9a7d428c
Opcode Fuzzy Hash: 3b9145f703ee4dfcc72c7a742b6e94a3501f07ba0b59668b95fd3c8ca7c9286c
Instruction Fuzzy Hash: 1B119355B0BEA3C0FC7AB513451467AC5C26F60BD4E9B54B8DC4E0A7A1EF3CA8474320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F2E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3F2EA0

Strings

+, xrefs: 00007FF7AA3F2F05

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen
String ID: +
API String ID: 39653677-2126386893
Opcode ID: 8f4eff69880137de31fd3222a91098d5ae818de58902d240349e39133d178d6d
Instruction ID: 589b02c3ff309ac3e13354cb202098253c53479ac15d559ec9a49941e79efccb
Opcode Fuzzy Hash: 8f4eff69880137de31fd3222a91098d5ae818de58902d240349e39133d178d6d
Instruction Fuzzy Hash: 1351B32362D643CBFB24AA65E05067EF790E711750F41817DEB9A4BAD5CB2CE5028B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F0650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3F06E0

Strings

+, xrefs: 00007FF7AA3F0745

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen
String ID: +
API String ID: 39653677-2126386893
Opcode ID: 517a51e55f0a15ba60128462b4ad0720dd336abf597f7cf8090b62665adf0f22
Instruction ID: c04a25427b29a59905d317875136ae55c703e2823166c177a1c76a3c3001cdd7
Opcode Fuzzy Hash: 517a51e55f0a15ba60128462b4ad0720dd336abf597f7cf8090b62665adf0f22
Instruction Fuzzy Hash: DA512B2362D643CBFAB49A29D44067EF790E742750F4141BCDB994BBD1EB2CE9068F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EDD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF7AA3EDD27

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: e42087ad24ec66d2f980fd4a66c7d73152566b9268eee95d05c180d167fa2e8d
Instruction ID: a84ccc4c085bc5048ad9f1391905f23ea14141ac7612d30cffef3432d4d501b0
Opcode Fuzzy Hash: e42087ad24ec66d2f980fd4a66c7d73152566b9268eee95d05c180d167fa2e8d
Instruction Fuzzy Hash: 78217122E0BA06C1FA756615D59437D91C29FF4BE4F9685BECA1D472F4CE2CA8838360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E3430 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00000000,00007FF7AA3E2C4D,?,?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E3451

Part of subcall function 00007FF7AA3E7830: WideCharToMultiByte.KERNEL32(?,?,?,?,0000018E4F4813D0,4F4813D000000001,00000000,00007FF7AA3E7A1E,4F4813D000000001,00000000,?,00007FF7AA3E13C5,?,?,00000000,00007FF7AA3E1315), ref: 00007FF7AA3E7864

Part of subcall function 00007FF7AA3E21D0: fputs.MSVCRT ref: 00007FF7AA3E2279

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7AA3E3478
GetModuleFileNameW, xrefs: 00007FF7AA3E3488
Failed to get executable path., xrefs: 00007FF7AA3E348F

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWidefputs
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 1732685965-1977442011
Opcode ID: 1b4fd387b19d415f0ae9e3f207abd188174f3ee418a8750729de1caaa0f162d9
Instruction ID: ba44e4dcf5729a26e062c0af30ae29a16f6e213552b271414a033b9d815ffc20
Opcode Fuzzy Hash: 1b4fd387b19d415f0ae9e3f207abd188174f3ee418a8750729de1caaa0f162d9
Instruction Fuzzy Hash: 67F08C12B1E913D1FA31B314E8063BA82909F687C0FC640BAE80D462E5EE5CEA07C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F5D40 Relevance: 6.4, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7AA3F5DE4
LeaveCriticalSection.KERNEL32 ref: 00007FF7AA3F5E23
free.MSVCRT ref: 00007FF7AA3F5E9D
LeaveCriticalSection.KERNEL32 ref: 00007FF7AA3F5EC6

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: CriticalLeaveSection$free
String ID:
API String ID: 2017658852-0
Opcode ID: 154e1c8a763c3e099863f86716ab779371983d20a216819c0515ac9a00ac6a3d
Instruction ID: d93e3c6b5c87749c16f0e5b8303fcee7f992207c50e62f7a2abbd5d6aee4d5ac
Opcode Fuzzy Hash: 154e1c8a763c3e099863f86716ab779371983d20a216819c0515ac9a00ac6a3d
Instruction Fuzzy Hash: 0F515E32A2BB07D0FE55AB09AA44379E251AF54780FC640BED90D4B3F5DE3CA842D360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F2560 Relevance: 6.2, APIs: 4, Instructions: 241COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7AA3F2614

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 9a518fdffd66d2e108fcccc9feed70f014e3bb42d983b9a5ce2dc7af7710cf51
Instruction ID: 514fbfd7f20bb442d5ed012b84f5a99c3bd1e66a964759b11a55b382383de977
Opcode Fuzzy Hash: 9a518fdffd66d2e108fcccc9feed70f014e3bb42d983b9a5ce2dc7af7710cf51
Instruction Fuzzy Hash: D5910673A26A43CBFB749A5AD45077DF790EB14750F41C179CB5A8BBA1CA2CF4428B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EFE00 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7AA3EFEB4

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1e1596b1602fe8297962fe8334e97b1661b864439f5db71fa3bb102b6063bc1f
Instruction ID: 2526b8936df4eeec8f369e26a4e1f69eb0563b8ecc42369df8c5ecc77d7cb932
Opcode Fuzzy Hash: 1e1596b1602fe8297962fe8334e97b1661b864439f5db71fa3bb102b6063bc1f
Instruction Fuzzy Hash: F8911332A16A43CBF7749A2AD14073DF3D0EB65790F45817ACB5A47BA1DA6CF8438710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F0EE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF7AA3F0F06
fputc.MSVCRT ref: 00007FF7AA3F0FD0

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fputclocaleconv
String ID:
API String ID: 697933784-0
Opcode ID: 2462c2aa1bb4d8724967216a063fddce5aeee6988b2e657d43dab1def66d05a4
Instruction ID: 50c9f4d800eae822c62debf9b91d06dd7caea8fc3f2ee27fb1313cc57d769d81
Opcode Fuzzy Hash: 2462c2aa1bb4d8724967216a063fddce5aeee6988b2e657d43dab1def66d05a4
Instruction Fuzzy Hash: 3B41EA63E25A43C6F774AA66E08133DF2A0EB14750F910179DB6D4ABE5DA2CE4838720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F3DF0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7AA3F3E61
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7AA3F3EA0
MultiByteToWideChar.KERNEL32 ref: 00007FF7AA3F3EEA
_errno.MSVCRT ref: 00007FF7AA3F3EFB

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: 871a653a972762b5aa3541784eed597620ee304f51438dd8a7c372969824c607
Instruction ID: 6ed6f8a78c164e2c3fdca5dbe7b36340e716865c21f2e35ff318044fdb17e7f7
Opcode Fuzzy Hash: 871a653a972762b5aa3541784eed597620ee304f51438dd8a7c372969824c607
Instruction Fuzzy Hash: A231077362EA42C6FF286A25650037DA5A0AF54794F8141FEED698B7F4CA3CD8428750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EF672 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3EFA37

Strings

(null), xrefs: 00007FF7AA3EF6B0
(null), xrefs: 00007FF7AA3EF686

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen
String ID: (null)$(null)
API String ID: 39653677-1601437019
Opcode ID: c6ccbf005a554d61add540d2c8a4524aa37f9808ee7e146845aa225edad9e4f3
Instruction ID: 447daea8d3de3c8a890ad4f2a0e0adfbec23f3a0373abca10b36059dc4767e46
Opcode Fuzzy Hash: c6ccbf005a554d61add540d2c8a4524aa37f9808ee7e146845aa225edad9e4f3
Instruction Fuzzy Hash: 9F011E12F5FF43C1FD25BA15D4110BDE6916F90784BDA81BED90E0A7B6EEADE4028360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F1A72 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AA3F2017

Strings

(null), xrefs: 00007FF7AA3F1C97
(null), xrefs: 00007FF7AA3F1A8B

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strlen
String ID: (null)$(null)
API String ID: 39653677-1601437019
Opcode ID: 754a90e4a97f0c4f4f0240e6f9a2bc7685a699bba6d340ddc210489529e9ef83
Instruction ID: 7fc7849130f7d37bf401312350f72eb74562a6752c7440c7ebf595340ba1f987
Opcode Fuzzy Hash: 754a90e4a97f0c4f4f0240e6f9a2bc7685a699bba6d340ddc210489529e9ef83
Instruction Fuzzy Hash: 01018013F2BE43D1FD55B641A4000BEE6516F80744BE681BEEA0E0E3B6DE2CE002D321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E7F30 Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7F36
GetCurrentProcessId.KERNEL32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7F44
GetWindowThreadProcessId.USER32 ref: 00007FF7AA3E7F54
ShowWindow.USER32(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E7F6C

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowThread
String ID:
API String ID: 242035731-0
Opcode ID: 1bbe3e935b35c5ada93282552c9509787084080afc66163de99b79c4f62e172f
Instruction ID: 65d9270407416ce891f2ff2cc347703c045003b90f5c335f684b92cf3f78c974
Opcode Fuzzy Hash: 1bbe3e935b35c5ada93282552c9509787084080afc66163de99b79c4f62e172f
Instruction Fuzzy Hash: 5BE06512E2F902C2FE203B61E80817D52F0AF95FD5F8681BAC80D07664DE2CA947C734

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3ED790 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AA3E1247), ref: 00007FF7AA3ED909

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7AA3EDA8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF7AA3EDA7B

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: bd8e28c4fc8de318fc0fd6089deb048166f687b0a75beb5f7c1d2293399d5957
Instruction ID: f714c57d5f60e5605848e93570132a332b7940d24c1d7a77b710dbacda32bb0e
Opcode Fuzzy Hash: bd8e28c4fc8de318fc0fd6089deb048166f687b0a75beb5f7c1d2293399d5957
Instruction Fuzzy Hash: 0A51B622F1A946C5FB21AB25D8407B8A7A0BF14B94F864176EA1D077B4CF3CE597C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3ED700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7AA3ED75A

Strings

Unknown error, xrefs: 00007FF7AA3ED724
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7AA3ED74D

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: f3aae9f8f3e31acca840360f469f0033d0b1f46ef4bb42b49239d200e67d97ca
Instruction ID: b31911014f332051577681c00031dd72d88785ca87db4fa2295d9d93b1e2270b
Opcode Fuzzy Hash: f3aae9f8f3e31acca840360f469f0033d0b1f46ef4bb42b49239d200e67d97ca
Instruction Fuzzy Hash: 0CF02816A19E86C3F621BB25E9010BDE360EB197C0F81927ADE4D97261DF1CE483C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EF781 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 00007FF7AA3EF783
strlen.MSVCRT ref: 00007FF7AA3EF8E2

Strings

(null), xrefs: 00007FF7AA3EF78B

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strerrorstrlen
String ID: (null)
API String ID: 960536887-3941151225
Opcode ID: 2fefff8186f7da2c86f2b310be3d9068beff996998c7ce148b6b4446c939ade1
Instruction ID: ffa63b8008e017168aee21c7c11eeb1888a6e888da18ecaed17e613e6c365637
Opcode Fuzzy Hash: 2fefff8186f7da2c86f2b310be3d9068beff996998c7ce148b6b4446c939ade1
Instruction Fuzzy Hash: 59E01A11B5BB43C1FC15761298001FEE2915F90784BDA40BEE94E0A7A6DE6DE4025361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3F1D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 00007FF7AA3F1D26
strlen.MSVCRT ref: 00007FF7AA3F1EB0

Strings

(null), xrefs: 00007FF7AA3F1D2E

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: strerrorstrlen
String ID: (null)
API String ID: 960536887-3941151225
Opcode ID: 71cbff93383048081f044aa9ef8d0fbc8b51277d3f4312b238588aa78397d57f
Instruction ID: 04441dcada2ee4af937968bf65727fe71367d41d16c78320d7985ea07499109e
Opcode Fuzzy Hash: 71cbff93383048081f044aa9ef8d0fbc8b51277d3f4312b238588aa78397d57f
Instruction Fuzzy Hash: 1FE04F12B2F953D1FD45B21160000BEE2526F80780FE641BEEB4E093A6DF3DF0068361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E3670 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E3698
free.MSVCRT(?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E36AD
free.MSVCRT(?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E36C8
free.MSVCRT(?,?,00000000,00000000,00007FF7AA3E4D6F), ref: 00007FF7AA3E36DD

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f86ae3c9c6dbd652120d74c6359917269129aa60a76a8fb9e4a7551486ccf767
Instruction ID: e29d7aa7faca9c2ed63fb14d2374bd15fe57a7bc0b7ad5e45a3e3b9a4ef4a2c0
Opcode Fuzzy Hash: f86ae3c9c6dbd652120d74c6359917269129aa60a76a8fb9e4a7551486ccf767
Instruction Fuzzy Hash: 82019613A16955C2FE707A27E59127DE690FF94781F5240B8CA0E47772DE28E8834310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3EE959 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7AA3EE96D
TlsGetValue.KERNEL32 ref: 00007FF7AA3EE99B
GetLastError.KERNEL32 ref: 00007FF7AA3EE9A0
LeaveCriticalSection.KERNEL32 ref: 00007FF7AA3EE9E4

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: db01d7ab52360ac0f821d949f100b4be6f3a2703338c736f70b236b5b81c1523
Instruction ID: 663c8cff2dc705a9713fdc075956ae49aa4068ad67aec333257c1eb4ad05ef27
Opcode Fuzzy Hash: db01d7ab52360ac0f821d949f100b4be6f3a2703338c736f70b236b5b81c1523
Instruction Fuzzy Hash: F1014022A0ED02D1FA65A715E90423892A0AF10B94FE600BAD91D076B4DF3DAC93D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AA3E5DA0 Relevance: 5.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

free.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E5DBD
free.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E5DCE
free.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E5DDF
free.MSVCRT(?,00007FF7AA402390,?,?,00000000), ref: 00007FF7AA3E5DE7

Memory Dump Source

Source File: 00000000.00000002.1952862015.00007FF7AA3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AA3E0000, based on PE: true

Associated: 00000000.00000002.1952825236.00007FF7AA3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952898056.00007FF7AA3F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952930266.00007FF7AA401000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952963512.00007FF7AA403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1953048205.00007FF7AA405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7aa3e0000_pythoninzoo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9e93fdac97db8a8d97b9f3e85edd1bf7ba4d81281e70b845996b21b01ec9574e
Instruction ID: a7150d83eb5d1477235be289a1eda354fc15a41cf8a3130369dfc58cd670994a
Opcode Fuzzy Hash: 9e93fdac97db8a8d97b9f3e85edd1bf7ba4d81281e70b845996b21b01ec9574e
Instruction Fuzzy Hash: A2F05E12B0BA92C1FD29BE63AA6437DD2516F60B80F86407C8B0D5B692CF6C68524320

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: pythoninzoo.exePID: 1892, Parent PID: 6956COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	1578
Total number of Limit Nodes:	16

Executed Functions

Function 70A0A7B0 Relevance: 624.0, APIs: 334, Strings: 21, Instructions: 2756stringCOMMON

Download Yara Rule

APIs

Part of subcall function 70A05FD0: getenv.MSVCRT ref: 70A06066

strncmp.MSVCRT ref: 70A0A891
strchr.MSVCRT ref: 70A0A8A2
free.MSVCRT ref: 70A0A990
free.MSVCRT ref: 70A0A99F
strncmp.MSVCRT ref: 70A0A9C7
strncmp.MSVCRT ref: 70A0A9ED
strncmp.MSVCRT ref: 70A0AA1C
strncmp.MSVCRT ref: 70A0AA9C
strncmp.MSVCRT ref: 70A0AAB9
strncmp.MSVCRT ref: 70A0AAEB
strncmp.MSVCRT ref: 70A0AB0B
strncmp.MSVCRT ref: 70A0AB28
strncmp.MSVCRT ref: 70A0AB45
strchr.MSVCRT ref: 70A0AB5F
strchr.MSVCRT ref: 70A0AB86
free.MSVCRT ref: 70A0ABCA
free.MSVCRT ref: 70A0AC1C
atof.MSVCRT ref: 70A0AC29
_errno.MSVCRT ref: 70A0ACD4
free.MSVCRT ref: 70A0AD6A
atof.MSVCRT ref: 70A0ADBB
_time64.MSVCRT ref: 70A0ADC6
_errno.MSVCRT ref: 70A0B006
fprintf.MSVCRT ref: 70A0B033
fputc.MSVCRT ref: 70A0B040
fclose.MSVCRT ref: 70A0B048
fputc.MSVCRT ref: 70A0B063
_errno.MSVCRT ref: 70A0BC4C
free.MSVCRT ref: 70A0BEA4
_errno.MSVCRT ref: 70A0C317
_errno.MSVCRT ref: 70A0C321
strerror.MSVCRT ref: 70A0C325
fprintf.MSVCRT ref: 70A0C337
fprintf.MSVCRT ref: 70A0C35B
fprintf.MSVCRT ref: 70A0C36A
fputc.MSVCRT ref: 70A0C377
fclose.MSVCRT ref: 70A0C37F
fprintf.MSVCRT ref: 70A0C39F
fputc.MSVCRT ref: 70A0C3B3

Strings

pyarmor-test-0001, xrefs: 70A0B270
pytransform.log, xrefs: 70A0AFEE, 70A0B21E, 70A0B4A5, 70A0B695, 70A0B847, 70A0B969, 70A0BA69, 70A0BB57, 70A0BC67, 70A0BE31, 70A0BF1C, 70A0BF8E, 70A0BFFE, 70A0C09C, 70A0C0EF, 70A0C1CE, 70A0C291, 70A0C2FF, 70A0C41C, 70A0C5CC, 70A0C709, 70A0C7CC, 70A0C86E, 70A0C9BB, 70A0CA95, 70A0CBD1, 70A0CD04, 70A0CD92, 70A0CECC, 70A0D228, 70A0D339, 70A0D473, 70A0D507, 70A0D647, 70A0D7B9
_vax_%s, xrefs: 70A0B294
*IFIPV4:, xrefs: 70A0AAD6
clickbank, xrefs: 70A0B2A6
*, xrefs: 70A0BE07
license.c, xrefs: 70A0B014, 70A0B4F0, 70A0B882, 70A0B98D, 70A0BAAB, 70A0BB94, 70A0BC8B, 70A0C138, 70A0C202, 70A0C34A, 70A0C72D, 70A0C81E, 70A0C8A2, 70A0C923, 70A0C976, 70A0CA27, 70A0CA65, 70A0CAD2, 70A0CB61, 70A0CC0E, 70A0CC9D, 70A0CCD4, 70A0CD62, 70A0CDB6, 70A0CE45, 70A0CE9C, 70A0CF28, 70A0CF7F, 70A0CFB6, 70A0CFED, 70A0D02B, 70A0D0BC, 70A0D113, 70A0D14A, 70A0D181, 70A0D1B8, 70A0D27A, 70A0D35D, 70A0D3EC, 70A0D423, 70A0D4B7, 70A0D562, 70A0D599, 70A0D5D7, 70A0D66A, 70A0D724, 70A0D789, 70A0D814, 70A0D8B3, 70A0D8EA, 70A0D921, 70A0D958, 70A0D98F
*DOMAIN:, xrefs: 70A0AB18
*HARDDISK:, xrefs: 70A0AA89
regnow, xrefs: 70A0D071
*CODE:, xrefs: 70A0BD21
*FLAGS:, xrefs: 70A0AA0A
*IFIPV6:, xrefs: 70A0AAF8
*VERSION:, xrefs: 70A0A852, 70A0A9B5
*IFMAC:, xrefs: 70A0AAA9
Pyarmor, xrefs: 70A0D08E
%s,%d,0x%x,, xrefs: 70A0B01B, 70A0B4F7, 70A0B889, 70A0B994, 70A0BAB2, 70A0BB9B, 70A0BC92, 70A0C13F, 70A0C209, 70A0C351, 70A0C734, 70A0C825, 70A0C8A9, 70A0C92A, 70A0C97D, 70A0CA2E, 70A0CA6C, 70A0CAD9, 70A0CB68, 70A0CC15, 70A0CCA4, 70A0CCDB, 70A0CD69, 70A0CDBD, 70A0CE4C, 70A0CEA3, 70A0CF2F, 70A0CF86, 70A0CFBD, 70A0CFF4, 70A0D032, 70A0D0C3, 70A0D11A, 70A0D151, 70A0D188, 70A0D1BF, 70A0D281, 70A0D364, 70A0D3F3, 70A0D42A, 70A0D4BE, 70A0D569, 70A0D5A0, 70A0D5DE, 70A0D671, 70A0D72B, 70A0D790, 70A0D81B, 70A0D8BA, 70A0D8F1, 70A0D928, 70A0D95F, 70A0D996
*FIXKEY:, xrefs: 70A0AB35
*TIME:, xrefs: 70A0A9DD
%s, xrefs: 70A0B246, 70A0B4CD, 70A0B6BD, 70A0B870, 70A0BA99, 70A0BB82, 70A0BE59, 70A0BF45, 70A0BFB9, 70A0C027, 70A0C118, 70A0C2BC, 70A0C32A, 70A0C5F5, 70A0C9E4, 70A0CAC0, 70A0CBFC, 70A0CD2F, 70A0CE77, 70A0CEF5, 70A0CF5A, 70A0D0EE, 70A0D1EA, 70A0D20A, 70A0D25A, 70A0D455, 70A0D4E9, 70A0D52F, 70A0D609, 70A0D629, 70A0D756, 70A0D7E1, 70A0D88E, 70A0D9C1, 70A0D9E1
shareit, xrefs: 70A0D054

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strncmp$free$_errnofprintf$fputc$strchr$atoffclose$_time64getenvstrerror
String ID: %s$%s,%d,0x%x,$*$*CODE:$*DOMAIN:$*FIXKEY:$*FLAGS:$*HARDDISK:$*IFIPV4:$*IFIPV6:$*IFMAC:$*TIME:$*VERSION:$Pyarmor$_vax_%s$clickbank$license.c$pyarmor-test-0001$pytransform.log$regnow$shareit
API String ID: 1877277240-1732257083
Opcode ID: b5da418139bb80263280cf045c409efdef0a7cbd51e346d68e2e65665660ba34
Instruction ID: 9e1d1b8ada2dcebee2fe6bcc057d11c69bf52c235d1179b5613465b19a765894
Opcode Fuzzy Hash: b5da418139bb80263280cf045c409efdef0a7cbd51e346d68e2e65665660ba34
Instruction Fuzzy Hash: 42338B7171874ADAEB159B21FA1079D23A5FB88BC4F44422AD94E5B36CEF3CE509C312

Uniqueness

Uniqueness Score: -1.00%

Function 70A0E6F0 Relevance: 28.8, APIs: 2, Strings: 17, Instructions: 293
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 70A0E80F
strncmp.MSVCRT ref: 70A0E81D

Strings

ssO|i, xrefs: 70A0E770
Marshal loads failed, xrefs: 70A0EB79
NULL code object, xrefs: 70A0EA7B
Invalid parameter, xrefs: 70A0E910
Check the restrict mode of module failed, xrefs: 70A0EB2B
Python interpreter is debug version, xrefs: 70A0E940
The python version in runtime is different from the build time, xrefs: 70A0E8B1
This obfuscated script is obfuscated by old PyArmor, xrefs: 70A0EB4F
The runtime library doesn't support Advanced Mode, xrefs: 70A0EA5D
Loaded module __main__ not found in sys.modules, xrefs: 70A0EB9D
Restore module failed, xrefs: 70A0EB01
Enable restrict mode failed, xrefs: 70A0EBC1
Check restrict mode of module failed, xrefs: 70A0EAD3
Incompatible core library, xrefs: 70A0EBE9
The runtime library doesn't support Super Mode, xrefs: 70A0E961
Got string from code object failed, xrefs: 70A0E7DC, 70A0E9F7
<frozen pyarmor>, xrefs: 70A0E6FC

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strlenstrncmp
String ID: <frozen pyarmor>$Check restrict mode of module failed$Check the restrict mode of module failed$Enable restrict mode failed$Got string from code object failed$Incompatible core library$Invalid parameter$Loaded module __main__ not found in sys.modules$Marshal loads failed$NULL code object$Python interpreter is debug version$Restore module failed$The python version in runtime is different from the build time$The runtime library doesn't support Advanced Mode$The runtime library doesn't support Super Mode$This obfuscated script is obfuscated by old PyArmor$ssO|i
API String ID: 1310274236-189690365
Opcode ID: c76b4630db5dba8b94918e888814963c6e56fdf8d1109c16338af8bbd98566b7
Instruction ID: e8202e0a391df97a66eca3d7aa74d733dc9f664c9cb6af039623d3c9ba643694
Opcode Fuzzy Hash: c76b4630db5dba8b94918e888814963c6e56fdf8d1109c16338af8bbd98566b7
Instruction Fuzzy Hash: 20D14E72B09B09D5EB15CF15F88035963B5F799B88F844226D90E87728EF7CE688E341

Uniqueness

Uniqueness Score: -1.00%

Function 70A0F7C0 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 70A0F909
free.MSVCRT ref: 70A0F911

Strings

obfmode.c, xrefs: 70A0FC10, 70A0FE31
code, xrefs: 70A0FC17, 70A0FE38

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: freememcpy
String ID: code$obfmode.c
API String ID: 3223336191-930819804
Opcode ID: d329ae663741e68fb104a1155cc33e79a0b0d93b18f1703381ebdfdd3d687840
Instruction ID: 6d99e43c4c39d4b7d73b4afd8a3a486c73782635fb562a4f4ca258d941a8b4c3
Opcode Fuzzy Hash: d329ae663741e68fb104a1155cc33e79a0b0d93b18f1703381ebdfdd3d687840
Instruction Fuzzy Hash: BAF16B72608B49DAEB11CF25F58035A73B5F789B84F548216DA4E97B6CEB3CE941CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A70C90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlWow64SetThreadContext.NTDLL ref: 70A70CF0

Strings

ntdll.dll, xrefs: 70A70C94
NtSetInformationThread, xrefs: 70A70CAE

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: ContextThreadWow64
String ID: NtSetInformationThread$ntdll.dll
API String ID: 983334009-3743287242
Opcode ID: 92c065ca89abec1997848133b4d1076c9b5e49955e8ffd3d9a29227274912c27
Instruction ID: 2fc8b2a801552d3e1343ac4fbba029e5866327fdd9809e1ff4e8e36d5b005223
Opcode Fuzzy Hash: 92c065ca89abec1997848133b4d1076c9b5e49955e8ffd3d9a29227274912c27
Instruction Fuzzy Hash: E8F01535B18A48C9EB609B16FCA074A6360F39CB88F544225DA9D87774EF6CD709CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A6FFB0 Relevance: 4.4, APIs: 3, Instructions: 651
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 70A70013
memcpy.MSVCRT ref: 70A70030
free.MSVCRT ref: 70A700E6

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: 791c4f8927b015886fb24a50f2ab30a87ed52ce1407ff1ffaec066b77c2a18e9
Instruction ID: 3f854b4e0b4bd2c5154bee269f092218abfe356dd434d68adafe375f0becdec5
Opcode Fuzzy Hash: 791c4f8927b015886fb24a50f2ab30a87ed52ce1407ff1ffaec066b77c2a18e9
Instruction Fuzzy Hash: 3E42A131605B58C6EB248B50EC91B6E2724F799B8AF51E236DA4EEB75CCF3CE5048341

Uniqueness

Uniqueness Score: -1.00%

Function 70A199F0 Relevance: 2280.3, APIs: 1190, Strings: 109, Instructions: 7009libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 70A19C99
GetProcAddress.KERNEL32 ref: 70A19CB5
GetProcAddress.KERNEL32 ref: 70A19CCA
GetProcAddress.KERNEL32 ref: 70A19CDF
GetProcAddress.KERNEL32 ref: 70A19CFB
GetProcAddress.KERNEL32 ref: 70A19D17
_errno.MSVCRT ref: 70A1A6E7

Strings

Py_ReprEnter, xrefs: 70A19E3E, 70A1CA21, 70A1CA5A
PyBytes_FromStringAndSize, xrefs: 70A1A42D
PyEval_SetProfile, xrefs: 70A1A0C9, 70A20CE8, 70A20D21
PyBytes_Size, xrefs: 70A1E337, 70A1E410, 70A1E449
PyImport_GetMagicNumber, xrefs: 70A1A16A, 70A205F2, 70A2062B
Py_InteractiveFlag, xrefs: 70A19D7D, 70A19D98, 70A1BC17, 70A1BC50
aes, xrefs: 70A1A607
PyUnicodeUCS2_Format, xrefs: 70A1DD8D
pyshield.lic, xrefs: 70A1A662
PyString_Format, xrefs: 70A1A4B9
PyDict_Copy, xrefs: 70A19F02, 70A21A12, 70A21A4B
PyUnicode_AsUTF8String, xrefs: 70A1A481
PyCell_Set, xrefs: 70A19EA0, 70A1D45F, 70A1D498
PyEval_GetGlobals, xrefs: 70A1A0AD, 70A20E28, 70A20E61
PyUnicode_Fill, xrefs: 70A1D91B, 70A1DAD5, 70A1DB0E
PyString_Type, xrefs: 70A19CD5
PySys_SetObject, xrefs: 70A1A32A, 70A1F250, 70A1F289
PyUnicode_FromString, xrefs: 70A1A49D
PyTuple_GetSlice, xrefs: 70A1A377, 70A1EEBE, 70A1EEF7
Py_CompileStringExFlags, xrefs: 70A1DD46, 70A1DF78, 70A1DFB1
_pytransform.c, xrefs: 70A1A756, 70A1A8BE, 70A1B0D1, 70A1B17E, 70A1B4FE, 70A1BA8F, 70A1BCAE, 70A1BD9E, 70A1BFAE, 70A1C398, 70A1C6FA, 70A1CB61, 70A1CD9C, 70A1D021, 70A1D08D, 70A1D0C1, 70A1D4D1
PyFunction_Type, xrefs: 70A19CC0, 70A1AD4B, 70A1AD84
PyUnicodeUCS2_FromString, xrefs: 70A1E075
PyThreadState_Get, xrefs: 70A1A33F, 70A1F110, 70A1F149
PyBool_FromLong, xrefs: 70A19E6F, 70A1CEC8, 70A1CF01
Py_InspectFlag, xrefs: 70A19D5A, 70A19D6F, 70A1AF8F, 70A1AFC8
PyObject_Print, xrefs: 70A1A2A5, 70A1F806, 70A1F83F
Py_CompileString, xrefs: 70A1A4D5
Py_BuildValue, xrefs: 70A19E0D, 70A1C67A, 70A1C6B3
PySys_GetObject, xrefs: 70A1A30E, 70A1F362, 70A1F39B
PyUnicodeUCS4_Format, xrefs: 70A1DDA9, 70A1DE66, 70A1DE9F
PyUnicode_Format, xrefs: 70A1DD71
loads, xrefs: 70A1A520
PyObject_SetAttrString, xrefs: 70A1A2BA, 70A1F6F4, 70A1F72D
PyString_AsStringAndSize, xrefs: 70A1E5F2, 70A1E7AC, 70A1E7E5
wrapper.c, xrefs: 70A1A808, 70A1A911, 70A1A9EE, 70A1AAAD, 70A1AB80, 70A1AC50, 70A1AD20, 70A1AE14, 70A1AEB1, 70A1AEEE, 70A1AF64, 70A1B021, 70A1B33E, 70A1B57E, 70A1B64C, 70A1B890, 70A1B98E, 70A1BBEC, 70A1BCE1, 70A1BE7C, 70A1BF77, 70A1C035, 70A1C1AA, 70A1C221, 70A1C30A, 70A1C361, 70A1C408, 70A1C4E5, 70A1C64F, 70A1C72A, 70A1C877, 70A1C955, 70A1C98C, 70A1C9F6, 70A1CB0A, 70A1CBE2, 70A1CCBF, 70A1CE9D, 70A1CF3A, 70A1D111, 70A1D181, 70A1D2CD, 70A1D3A3, 70A1D3DA, 70A1D434, 70A1D548, 70A1D5E7, 70A1D6C2, 70A1D76E, 70A1D80B, 70A1D88C, 70A1D998, 70A1DA35, 70A1DAAA, 70A1DB47, 70A1DBA2, 70A1DC5C, 70A1DCF9, 70A1DE3B, 70A1DED8, 70A1DF4D, 70A1DFEA, 70A1E045, 70A1E15B, 70A1E1F8, 70A1E26D, 70A1E30A, 70A1E3E5, 70A1E482, 70A1E4F7, 70A1E594, 70A1E66F, 70A1E70C, 70A1E781, 70A1E81E, 70A1E8DD, 70A1E97A, 70A1E9EF, 70A1EA8C, 70A1EB2F, 70A1EBCC, 70A1EC41, 70A1ECDE, 70A1ED81, 70A1EE1E, 70A1EE93, 70A1EF30, 70A1EFD3, 70A1F070, 70A1F0E5, 70A1F182, 70A1F225, 70A1F2C2, 70A1F337, 70A1F3D4, 70A1F477, 70A1F514, 70A1F589, 70A1F626, 70A1F6C9, 70A1F766, 70A1F7DB, 70A1F878, 70A1F91B, 70A1F9B8, 70A1FA2D, 70A1FACA, 70A1FB6D, 70A1FC0A, 70A1FC7F, 70A1FD1C, 70A1FDBF, 70A1FE5C, 70A1FED1, 70A1FF6E, 70A20011, 70A200AE, 70A20123, 70A201C0, 70A20263, 70A20300, 70A20375, 70A20412, 70A204B5, 70A20552, 70A205C7, 70A20664, 70A20707, 70A207A4, 70A20819, 70A208B6, 70A20959, 70A209F6, 70A20A6B, 70A20B08, 70A20BAB, 70A20C48, 70A20CBD, 70A20D5A, 70A20DFD, 70A20E9A, 70A20F0F, 70A20FAC, 70A2104F, 70A210EC, 70A21161, 70A211FE, 70A212A1, 70A2133E, 70A213B3, 70A21450, 70A214F3, 70A21590, 70A21605, 70A216A2, 70A21745, 70A217E2, 70A21857, 70A218F4, 70A2196F, 70A219E7, 70A21A84, 70A21B27, 70A21BC4, 70A21C39, 70A21CD6, 70A21D64, 70A21E01, 70A21E76, 70A21F13
PyDict_SetItemString, xrefs: 70A19F3A, 70A1DC87, 70A1DCC0
PyErr_Fetch, xrefs: 70A19F8E, 70A21C64, 70A21C9D
PyObject_Size, xrefs: 70A1A2D6, 70A1F5B4, 70A1F5ED
PyList_Size, xrefs: 70A1A1D3, 70A2014E, 70A20187
PyImport_GetModuleDict, xrefs: 70A1A186, 70A204E0, 70A20519
PyModule_GetDict, xrefs: 70A1FA58, 70A1FA91
PyBytes_AsStringAndSize, xrefs: 70A1A411
PyBytes_AsString, xrefs: 70A1E368, 70A1E522, 70A1E55B
dumps, xrefs: 70A1A540
PyErr_NoMemory, xrefs: 70A19FC6, 70A21882, 70A218BB
pytransform.log, xrefs: 70A1A727, 70A1A7E4, 70A1A8EB, 70A1A9CA, 70A1AA87, 70A1AB5C, 70A1AC2C, 70A1ACFC, 70A1ADEE, 70A1AF3E, 70A1B0AB, 70A1B14C, 70A1B2A0, 70A1B2F1, 70A1B54A, 70A1B60F, 70A1B6FE, 70A1B757, 70A1B7AE, 70A1B86C, 70A1B93E, 70A1B9DC, 70A1BADC, 70A1BB38, 70A1BBAF, 70A1BDEC, 70A1BE58, 70A1BF32, 70A1BFF3, 70A1C0E0, 70A1C257, 70A1C3DD, 70A1C583, 70A1C5C0, 70A1C62C, 70A1C83D, 70A1C9D3, 70A1CBA8, 70A1CD5B, 70A1CE63, 70A1CFE4, 70A1D1CA, 70A1D2A3, 70A1D40A, 70A1D5A6, 70A1D744, 70A1D862, 70A1D957, 70A1DA69, 70A1DC1B, 70A1DDFA, 70A1DF0C, 70A1E11A, 70A1E22C, 70A1E3A4, 70A1E4B6, 70A1E62E, 70A1E740, 70A1E89C, 70A1E9AE, 70A1EAEE, 70A1EC00, 70A1ED40, 70A1EE52, 70A1EF92, 70A1F0A4, 70A1F1E4, 70A1F2F6, 70A1F436, 70A1F548, 70A1F688, 70A1F79A, 70A1F8DA, 70A1F9EC, 70A1FB2C, 70A1FC3E, 70A1FD7E, 70A1FE90, 70A1FFD0, 70A200E2, 70A20222, 70A20334, 70A20474, 70A20586, 70A206C6, 70A207D8, 70A20918, 70A20A2A, 70A20B6A, 70A20C7C, 70A20DBC, 70A20ECE, 70A2100E, 70A21120, 70A21260, 70A21372, 70A214B2, 70A215C4, 70A21704, 70A21816, 70A219A6, 70A21AE6, 70A21BF8, 70A21D23, 70A21E35
PyObject_Type, xrefs: 70A1A2F2, 70A1F4A2, 70A1F4DB
license.c, xrefs: 70A1BA0E, 70A1C129, 70A1C27B, 70A1C51C, 70A1C781, 70A1C7D8, 70A1CAB3, 70A1CCFD, 70A1D1F4, 70A1D684
PyEval_GetLocals, xrefs: 70A1A091, 70A20F3A, 70A20F73
PyTuple_Size, xrefs: 70A1A3C4, 70A1A449, 70A1EB5A, 70A1EB93
PyDict_SetItem, xrefs: 70A19F56, 70A1D9C3, 70A1D9FC
Py_IncRef, xrefs: 70A19DCF, 70A1C060, 70A1C099
Py_DebugFlag, xrefs: 70A19DA6, 70A19DC1, 70A1BEA7, 70A1BEE0
PyEval_GetFrame, xrefs: 70A1A075, 70A2107A, 70A210B3
PyUnicodeUCS4_FromString, xrefs: 70A1E091, 70A1E186, 70A1E1BF
PyMarshal_WriteObjectToFile, xrefs: 70A1A258, 70A1FB98, 70A1FBD1
sha256, xrefs: 70A1A622
PyMarshal_WriteObjectToString, xrefs: 70A1A23C, 70A1FCAA, 70A1FCE3
PyExc_RuntimeError, xrefs: 70A19D3E, 70A1B8BB, 70A1B8F4
PyEval_GetBuiltins, xrefs: 70A1A059, 70A2118C, 70A211C5
PyImport_AddModule, xrefs: 70A1A116, 70A20984, 70A209BD
PyLong_AsLong, xrefs: 70A1A1E8, 70A2003C, 70A20075
PyErr_SetString, xrefs: 70A1A021, 70A213DE, 70A21417
PyMarshal_ReadObjectFromString, xrefs: 70A1A220, 70A1FDEA, 70A1FE23
%s,%d,0x%x,, xrefs: 70A1A75D, 70A1A80F, 70A1A8C5, 70A1A918, 70A1A9F5, 70A1AAB4, 70A1AB87, 70A1AC57, 70A1AD27, 70A1AE1B, 70A1AEB8, 70A1AEF5, 70A1AF6B, 70A1B028, 70A1B0D8, 70A1B185, 70A1B345, 70A1B505, 70A1B585, 70A1B653, 70A1B897, 70A1B995, 70A1BA15, 70A1BA96, 70A1BBF3, 70A1BCB5, 70A1BCE8, 70A1BDA5, 70A1BE83, 70A1BF7E, 70A1BFB5, 70A1C03C, 70A1C130, 70A1C1B1, 70A1C228, 70A1C282, 70A1C311, 70A1C368, 70A1C39F, 70A1C40F, 70A1C4EC, 70A1C523, 70A1C656, 70A1C701, 70A1C731, 70A1C788, 70A1C7DF, 70A1C87E, 70A1C95C, 70A1C993, 70A1C9FD, 70A1CABA, 70A1CB11, 70A1CB68, 70A1CBE9, 70A1CCC6, 70A1CD04, 70A1CDA3, 70A1CEA4, 70A1CF41, 70A1D028, 70A1D094, 70A1D0C8, 70A1D118, 70A1D188, 70A1D1FB, 70A1D2D4, 70A1D3AA, 70A1D3E1, 70A1D43B, 70A1D4D8, 70A1D54F, 70A1D5EE, 70A1D68B, 70A1D6C9, 70A1D775, 70A1D812, 70A1D893, 70A1D99F, 70A1DA3C, 70A1DAB1, 70A1DB4E, 70A1DBA9, 70A1DC63, 70A1DD00, 70A1DE42, 70A1DEDF, 70A1DF54, 70A1DFF1, 70A1E04C, 70A1E162, 70A1E1FF, 70A1E274, 70A1E311, 70A1E3EC, 70A1E489, 70A1E4FE, 70A1E59B, 70A1E676, 70A1E713, 70A1E788, 70A1E825, 70A1E8E4, 70A1E981, 70A1E9F6, 70A1EA93, 70A1EB36, 70A1EBD3, 70A1EC48, 70A1ECE5, 70A1ED88, 70A1EE25, 70A1EE9A, 70A1EF37, 70A1EFDA, 70A1F077, 70A1F0EC, 70A1F189, 70A1F22C, 70A1F2C9, 70A1F33E, 70A1F3DB, 70A1F47E, 70A1F51B, 70A1F590, 70A1F62D, 70A1F6D0, 70A1F76D, 70A1F7E2, 70A1F87F, 70A1F922, 70A1F9BF, 70A1FA34, 70A1FAD1, 70A1FB74, 70A1FC11, 70A1FC86, 70A1FD23, 70A1FDC6, 70A1FE63, 70A1FED8, 70A1FF75, 70A20018, 70A200B5, 70A2012A, 70A201C7, 70A2026A, 70A20307, 70A2037C, 70A20419, 70A204BC, 70A20559, 70A205CE, 70A2066B, 70A2070E, 70A207AB, 70A20820, 70A208BD, 70A20960, 70A209FD, 70A20A72, 70A20B0F, 70A20BB2, 70A20C4F, 70A20CC4, 70A20D61, 70A20E04, 70A20EA1, 70A20F16, 70A20FB3, 70A21056, 70A210F3, 70A21168, 70A21205, 70A212A8, 70A21345, 70A213BA, 70A21457, 70A214FA, 70A21597, 70A2160C, 70A216A9, 70A2174C, 70A217E9, 70A2185E, 70A218FB, 70A21976, 70A219EE, 70A21A8B, 70A21B2E, 70A21BCB, 70A21C40, 70A21CDD, 70A21D6B, 70A21E08, 70A21E7D, 70A21F1A
PyUnicode_Type, xrefs: 70A1A992, 70A1AA19, 70A1AA52
Py_DecRef, xrefs: 70A19DF1, 70A1C433, 70A1C46C
PyImport_ExecCodeModule, xrefs: 70A1A132, 70A20844, 70A2087D
_Py_NoneStruct, xrefs: 70A19CF1, 70A1ABAB, 70A1ABE4
PyFrame_Type, xrefs: 70A19CAB, 70A1AC7B, 70A1ACB4
PyExc_ImportError, xrefs: 70A19D29, 70A1B677, 70A1B6B0
PyLong_FromLong, xrefs: 70A1A204, 70A1A26D, 70A1FEFC, 70A1FF35
_Py_TrueStruct, xrefs: 70A19D0D, 70A1AE3F, 70A1AE78
PyImport_ImportModule, xrefs: 70A1A1A2, 70A203A0, 70A203D9
PyEval_EvalFrameEx, xrefs: 70A1E84B, 70A1E908, 70A1E941
PyArg_ParseTuple, xrefs: 70A19E53, 70A1CC0D, 70A1CC46
PyString_Size, xrefs: 70A1A465
PyDict_Clear, xrefs: 70A19EED, 70A1D612, 70A1D64B
3des, xrefs: 70A1A5F2
PyType_GenericNew, xrefs: 70A1A3E0, 70A1EA1A, 70A1EA53
marshal, xrefs: 70A1A507
PyDict_GetItemString, xrefs: 70A19F1E, 70A21D8F, 70A21DC8
PyUnicodeUCS2_AsUTF8String, xrefs: 70A1E0C2
PyErr_Print, xrefs: 70A19FF7, 70A21630, 70A21669
Py_Exit, xrefs: 70A19E29, 70A1C8A2, 70A1C8DB
%s, xrefs: 70A1AFFC, 70A1B49C, 70A1B63A, 70A1B727, 70A1BB0C, 70A1BB7A, 70A1BBDA, 70A1BC89, 70A1BE17, 70A1BF14, 70A1C023, 70A1C109, 70A1C1DC, 70A1C1FC, 70A1C33C, 70A1C4A0, 70A1C4C0, 70A1C54E, 70A1C5EB, 70A1C75C, 70A1C7B3, 70A1C80A, 70A1C865, 70A1C90F, 70A1CA8E, 70A1CAE5, 70A1CB3C, 70A1CBD0, 70A1CC7A, 70A1CC9A, 70A1CD2F, 70A1CD8A, 70A1CE2E, 70A1CE8B, 70A1CF73, 70A1D00F, 70A1D143, 70A1D37E, 70A1D503, 70A1D523, 70A1D5D5, 70A1D844, 70A1D986, 70A1DA98, 70A1DB7D, 70A1DC4A, 70A1DD2F, 70A1DE29, 70A1DF3B, 70A1E020, 70A1E149, 70A1E25B, 70A1E3D3, 70A1E4E5, 70A1E65D, 70A1E76F, 70A1E8CB, 70A1E9DD, 70A1EB1D, 70A1EC2F, 70A1ED6F, 70A1EE81, 70A1EFC1, 70A1F0D3, 70A1F213, 70A1F325, 70A1F465, 70A1F577, 70A1F6B7, 70A1F7C9, 70A1F909, 70A1FA1B, 70A1FB5B, 70A1FC6D, 70A1FDAD, 70A1FEBF, 70A1FFFF, 70A20111, 70A20251, 70A20363, 70A204A3, 70A205B5, 70A206F5, 70A20807, 70A20947, 70A20A59, 70A20B99, 70A20CAB, 70A20DEB, 70A20EFD, 70A2103D, 70A2114F, 70A2128F, 70A213A1, 70A214E1, 70A215F3, 70A21733, 70A21845, 70A2192A, 70A2194A, 70A219D5, 70A21B15, 70A21C27, 70A21D52, 70A21E64
license.lic, xrefs: 70A1B38E
PyEval_SetTrace, xrefs: 70A1A0E5, 70A20BD6, 70A20C0F
_PyEval_EvalFrameDefault, xrefs: 70A1A3F5
PyErr_Restore, xrefs: 70A1A00C, 70A2151E, 70A21557
PyCFunction_Call, xrefs: 70A19EB5, 70A1D799, 70A1D7D2
PyErr_Occurred, xrefs: 70A19FDB, 70A21770, 70A217A9
PyObject_GetAttrString, xrefs: 70A1A289, 70A1F946, 70A1F97F
PyUnicodeUCS4_AsUTF8String, xrefs: 70A1E0DE, 70A1E298, 70A1E2D1
PyCode_Type, xrefs: 70A19C88, 70A1AAD8, 70A1AB11
PyString_FromStringAndSize, xrefs: 70A1E5C1, 70A1E69A, 70A1E6D3
PyFrame_LocalsToFast, xrefs: 70A1A101, 70A20A96, 70A20ACF
PyList_GetItem, xrefs: 70A1A1BE, 70A2028E, 70A202C7
PyImport_ExecCodeModuleEx, xrefs: 70A1A14E, 70A20732, 70A2076B
PyTuple_GetItem, xrefs: 70A1A35B, 70A1EFFE, 70A1F037
PyEval_EvalCode, xrefs: 70A1A03D, 70A212CC, 70A21305
PyTuple_New, xrefs: 70A1A38C, 70A1EDAC, 70A1EDE5
PyErr_Format, xrefs: 70A19FAA, 70A21B52, 70A21B8B
PyErr_Clear, xrefs: 70A19F72, 70A21EA1, 70A21EDA
PyTuple_SetItem, xrefs: 70A1A3A8, 70A1EC6C, 70A1ECA5
sprng, xrefs: 70A1A63D
PyCFunction_NewEx, xrefs: 70A19ED1, 70A1D8B7, 70A1D8F0
PyByteArray_AsString, xrefs: 70A19E84, 70A1D2F8, 70A1D331

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: AddressProc$_errno
String ID: %s$%s,%d,0x%x,$3des$PyArg_ParseTuple$PyBool_FromLong$PyByteArray_AsString$PyBytes_AsString$PyBytes_AsStringAndSize$PyBytes_FromStringAndSize$PyBytes_Size$PyCFunction_Call$PyCFunction_NewEx$PyCell_Set$PyCode_Type$PyDict_Clear$PyDict_Copy$PyDict_GetItemString$PyDict_SetItem$PyDict_SetItemString$PyErr_Clear$PyErr_Fetch$PyErr_Format$PyErr_NoMemory$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyErr_SetString$PyEval_EvalCode$PyEval_EvalFrameEx$PyEval_GetBuiltins$PyEval_GetFrame$PyEval_GetGlobals$PyEval_GetLocals$PyEval_SetProfile$PyEval_SetTrace$PyExc_ImportError$PyExc_RuntimeError$PyFrame_LocalsToFast$PyFrame_Type$PyFunction_Type$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ExecCodeModuleEx$PyImport_GetMagicNumber$PyImport_GetModuleDict$PyImport_ImportModule$PyList_GetItem$PyList_Size$PyLong_AsLong$PyLong_FromLong$PyMarshal_ReadObjectFromString$PyMarshal_WriteObjectToFile$PyMarshal_WriteObjectToString$PyModule_GetDict$PyObject_GetAttrString$PyObject_Print$PyObject_SetAttrString$PyObject_Size$PyObject_Type$PyString_AsStringAndSize$PyString_Format$PyString_FromStringAndSize$PyString_Size$PyString_Type$PySys_GetObject$PySys_SetObject$PyThreadState_Get$PyTuple_GetItem$PyTuple_GetSlice$PyTuple_New$PyTuple_SetItem$PyTuple_Size$PyType_GenericNew$PyUnicodeUCS2_AsUTF8String$PyUnicodeUCS2_Format$PyUnicodeUCS2_FromString$PyUnicodeUCS4_AsUTF8String$PyUnicodeUCS4_Format$PyUnicodeUCS4_FromString$PyUnicode_AsUTF8String$PyUnicode_Fill$PyUnicode_Format$PyUnicode_FromString$PyUnicode_Type$Py_BuildValue$Py_CompileString$Py_CompileStringExFlags$Py_DebugFlag$Py_DecRef$Py_Exit$Py_IncRef$Py_InspectFlag$Py_InteractiveFlag$Py_ReprEnter$_PyEval_EvalFrameDefault$_Py_NoneStruct$_Py_TrueStruct$_pytransform.c$aes$dumps$license.c$license.lic$loads$marshal$pyshield.lic$pytransform.log$sha256$sprng$wrapper.c
API String ID: 1566810575-3086871561
Opcode ID: 69c82d6439344a6fbf665a47c574794baa237b27a545d618bd60931fe19f736f
Instruction ID: c6d15e650cbbfc270a07c374445c2311c5310b700580a82d554581e20cfc369d
Opcode Fuzzy Hash: 69c82d6439344a6fbf665a47c574794baa237b27a545d618bd60931fe19f736f
Instruction Fuzzy Hash: 2FE38EB0B19712E9EB049B11F91079C23A5FB99BC4F844226D94E5B3A8DF3CF646C316

Uniqueness

Uniqueness Score: -1.00%

Function 70A0DA10 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70A05FD0: getenv.MSVCRT ref: 70A06066

_errno.MSVCRT ref: 70A0DA91

Part of subcall function 70A0A7B0: strncmp.MSVCRT ref: 70A0A891
Part of subcall function 70A0A7B0: strchr.MSVCRT ref: 70A0A8A2

free.MSVCRT ref: 70A0DA6F

Strings

%s,%d,0x%x,, xrefs: 70A0DAD2, 70A0DB61
pytransform.log, xrefs: 70A0DAA7
license.lic, xrefs: 70A0DA1E
license.c, xrefs: 70A0DACB, 70A0DB5A
product.key, xrefs: 70A0DA3A
%s, xrefs: 70A0DB89

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errnofreegetenvstrchrstrncmp
String ID: %s$%s,%d,0x%x,$license.c$license.lic$product.key$pytransform.log
API String ID: 2166687660-2554675036
Opcode ID: f49bbfc885949fc6f5b7b13ad9905d3abf42234ccb0454b874f8190444b7fbc6
Instruction ID: f6921e39fbe2ea8bfa082a9b4ee5395fcf71dbb820493b4c50599c7430b0b608
Opcode Fuzzy Hash: f49bbfc885949fc6f5b7b13ad9905d3abf42234ccb0454b874f8190444b7fbc6
Instruction Fuzzy Hash: 1B31E671B2831699EF019B61F90179D63A1AB89BC4F844226ED4D1B76CEF3CF906C306

Uniqueness

Uniqueness Score: -1.00%

Function 70A04A00 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70A6FFB0: malloc.MSVCRT ref: 70A70013
Part of subcall function 70A6FFB0: memcpy.MSVCRT ref: 70A70030
Part of subcall function 70A6FFB0: free.MSVCRT ref: 70A700E6

_errno.MSVCRT ref: 70A04A89
fprintf.MSVCRT ref: 70A04AB5
fprintf.MSVCRT ref: 70A04AC7
fputc.MSVCRT ref: 70A04AD4
fclose.MSVCRT ref: 70A04ADC
fprintf.MSVCRT ref: 70A04AFF
fputc.MSVCRT ref: 70A04B13

Strings

%s,%d,0x%x,, xrefs: 70A04A9D, 70A04B35
pytransform.log, xrefs: 70A04A6A
!, xrefs: 70A04AB5
protect.c, xrefs: 70A04A96, 70A04B2E
%s, xrefs: 70A04B5E

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fprintf$fputc$_errnofclosefreemallocmemcpy
String ID: %s$%s,%d,0x%x,$protect.c$pytransform.log$!
API String ID: 4098992662-152705595
Opcode ID: f4f11d98654f22f3108b67875ee014831f8f5b40bde045c54f5d2bc865fddc6d
Instruction ID: ce169459db75e4695f2d7c2963c1d399baeddfc44ec2600ce0a200b673199cc4
Opcode Fuzzy Hash: f4f11d98654f22f3108b67875ee014831f8f5b40bde045c54f5d2bc865fddc6d
Instruction Fuzzy Hash: E331B4517182819EEB159B36B950BAD6B70EF86BC8F484165DECD0736AEE2CF403C319

Uniqueness

Uniqueness Score: -1.00%

Function 70A94ED0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 70A94F2E
CreateFileMappingA.KERNEL32 ref: 70A94F85
MapViewOfFile.KERNEL32 ref: 70A94FB1
CloseHandle.KERNEL32 ref: 70A94FBD
GetLastError.KERNEL32 ref: 70A94FC8
_errno.MSVCRT ref: 70A94FD0

Strings

@, xrefs: 70A9508D
, xrefs: 70A94F0C
@, xrefs: 70A95034

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: File_errno$CloseCreateErrorHandleLastMappingView
String ID: $@$@
API String ID: 896588047-3743272326
Opcode ID: ad2b5d174cbbaebff85b719ff44f08ee0dbd8e41e6a4b1a3aa829fbda9743842
Instruction ID: cee35e83c8d40c509c7011d4e926b2c1f3f4ee977901ab9e023c1a7fa3cdb22f
Opcode Fuzzy Hash: ad2b5d174cbbaebff85b719ff44f08ee0dbd8e41e6a4b1a3aa829fbda9743842
Instruction Fuzzy Hash: 2B413473F206608AEB224B16AC00B4D62A5B74DFB5F490326DE7A077D8EB7CD9408344

Uniqueness

Uniqueness Score: -1.00%

Function 70A0DC10 Relevance: 15.6, APIs: 4, Strings: 6, Instructions: 579stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A0DC3F
strncmp.MSVCRT ref: 70A0DC4D
free.MSVCRT ref: 70A0DCF7
free.MSVCRT ref: 70A0DDBC

Strings

__spec__, xrefs: 70A0DE55
obfmode.c, xrefs: 70A0E550, 70A0E600
__main__, xrefs: 70A0DE37, 70A0DE93, 70A0E360, 70A0E4C7
__mp_main__, xrefs: 70A0E091, 70A0E37E, 70A0E4E5
__parents_main__, xrefs: 70A0E3A0, 70A0E3FA
frame, xrefs: 70A0E557, 70A0E607

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: free$strlenstrncmp
String ID: __main__$__mp_main__$__parents_main__$__spec__$frame$obfmode.c
API String ID: 2569063720-2363144754
Opcode ID: 9a45565e18b75a5447e2f016580587f7e659d027c769f9bb72108192bcf79f9e
Instruction ID: 57daabeed09556e80a5bddd4dce35138cf8524be36cbd361d1afad0cbb098257
Opcode Fuzzy Hash: 9a45565e18b75a5447e2f016580587f7e659d027c769f9bb72108192bcf79f9e
Instruction Fuzzy Hash: D432ED72A09608D6EB15CB21FA4036D2766B749B88F404629CD0F4B7ACFB7CE985D701

Uniqueness

Uniqueness Score: -1.00%

Function 70A0FEA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_time64.MSVCRT ref: 70A0FF62

Strings

This function could not be called from the plain script, xrefs: 70A10038
Invalid license, xrefs: 70A10017
Internal buffer error, xrefs: 70A10067

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _time64
String ID: Internal buffer error$Invalid license$This function could not be called from the plain script
API String ID: 1670930206-992726897
Opcode ID: 8f5478012960a087b17e483251a11bef36eed269b5a20717267066c89d0467ec
Instruction ID: ffb9c6a7a9d7fc9b9715c256910517946ad9987e26b53f77d39ad43e34d9fba7
Opcode Fuzzy Hash: 8f5478012960a087b17e483251a11bef36eed269b5a20717267066c89d0467ec
Instruction Fuzzy Hash: 37414A32A09A0AD1EB119B25F89035D73A4FB89B94F544726DD0ED7B78EF3CE685C201

Uniqueness

Uniqueness Score: -1.00%

Function 70A70DE0 Relevance: 6.0, APIs: 4, Instructions: 38
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 70A70E0C
GetThreadContext.KERNEL32 ref: 70A70E14
GetCurrentThread.KERNEL32 ref: 70A70E70
SetThreadContext.KERNEL32 ref: 70A70E78

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Thread$ContextCurrent
String ID:
API String ID: 195563550-0
Opcode ID: 99d3b8c55569807b5a3df5e2c7eff14ca15bcf6d4e21b9a73be53227edca2030
Instruction ID: 1eddd6dec481bea909cc2e88b09db8f3e19057b72cd79a9069f816696097565b
Opcode Fuzzy Hash: 99d3b8c55569807b5a3df5e2c7eff14ca15bcf6d4e21b9a73be53227edca2030
Instruction Fuzzy Hash: B3112532508744C9EB518B25F918B1EB3E2F788794F509629F6C99669CCFBCC189CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A96550 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 70A9658E

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 55520103505fb2b0f5347ec77b52210e5f6cab78dcb607584f853220d99b3cc2
Instruction ID: 718997596fe409d23c43e28f549ccab20ff1ae5dcb4ef59b1ee5d8ebc4f539c1
Opcode Fuzzy Hash: 55520103505fb2b0f5347ec77b52210e5f6cab78dcb607584f853220d99b3cc2
Instruction Fuzzy Hash: D9F01CB033603086EB330522C700F6C26E85F06790E7A410A99164EEECE55FC685AF4E

Uniqueness

Uniqueness Score: -1.00%

Function 70A70BE0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feaaaa0cf51caa3f99b8a002e9c14e1708ff5625ace8c5f16572cee7fcd3e753
Instruction ID: cbaeaf6c6e5f43d82b82c2969cc58d8f7f5016185a0d7430ba8a2f7ee5861c2d
Opcode Fuzzy Hash: feaaaa0cf51caa3f99b8a002e9c14e1708ff5625ace8c5f16572cee7fcd3e753
Instruction Fuzzy Hash: C3F0EC60F06201CEF7156B726E42B1D11A16FAC344F90F538E409C129CE72CF584CB51

Uniqueness

Uniqueness Score: -1.00%

Function 70A94120 Relevance: 1.5, APIs: 1, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 70A943C2

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: ad683bb627b7ab02320f166490d90dff12a04f907f4fe6b01c8a673c6386ec2c
Instruction ID: 8064f0211f80f956083993993018be11ab48410aace7100781154c00130ccf7b
Opcode Fuzzy Hash: ad683bb627b7ab02320f166490d90dff12a04f907f4fe6b01c8a673c6386ec2c
Instruction Fuzzy Hash: 2F9178B2720B9486DB558F26D04175D3BE5F709FD8F18421AEE8A1B39CDBB8C895C384

Uniqueness

Uniqueness Score: -1.00%

Function 70A70F60 Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT(?,?,000001DFC7EC15D0,0000001B,70A7397D,000001DFC7EC15D0,?,?,70A763A5,?,70A996E0,00000000,70A70998), ref: 70A70F6F

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1c8bdaffa960dfd775ff7fe1b80783ca916ac178948a71f1648bfeba0ed92fb6
Instruction ID: c06845344927dd6f3f8a447f7d926b4fa5ab7602ccac4f79e03a75aa26130cca
Opcode Fuzzy Hash: 1c8bdaffa960dfd775ff7fe1b80783ca916ac178948a71f1648bfeba0ed92fb6
Instruction Fuzzy Hash: 61D02262B8BA1181C50D8B533C402AC85866B4DBE0E08C0309E8C57304EC2C80834300

Uniqueness

Uniqueness Score: -1.00%

Function 70A70FE0 Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 70A70FF0

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9287e08c20975ed3c19586d29dd955b81908fc052125fea48543a92b48a8a35e
Instruction ID: 37ad8e1b3b36a6959367083b20d05beb5750edcd6c0f735069558d2b0438d4bb
Opcode Fuzzy Hash: 9287e08c20975ed3c19586d29dd955b81908fc052125fea48543a92b48a8a35e
Instruction Fuzzy Hash: 43C08CA6A13A00C1FF198BB2FC503383220AF5CF05F189010CE0A463408F2C90D18701

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFDFAC22C00 Relevance: 80.8, APIs: 44, Strings: 2, Instructions: 313windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC1EAF0: GetDC.USER32 ref: 00007FFDFAC1EB22
Part of subcall function 00007FFDFAC1EAF0: SelectPalette.GDI32 ref: 00007FFDFAC1EBB9
Part of subcall function 00007FFDFAC1EAF0: RealizePalette.GDI32 ref: 00007FFDFAC1EBC5
Part of subcall function 00007FFDFAC1EAF0: GetBkMode.GDI32(?,?,00000000,00007FFDFAC1F5D1), ref: 00007FFDFAC1EBD1

SetROP2.GDI32 ref: 00007FFDFAC22C7E
SelectClipRgn.GDI32 ref: 00007FFDFAC22C99
CreateCompatibleDC.GDI32 ref: 00007FFDFAC22CEC
CreatePatternBrush.GDI32 ref: 00007FFDFAC22CF9
SetBrushOrgEx.GDI32 ref: 00007FFDFAC22D14
SelectObject.GDI32 ref: 00007FFDFAC22D20
SetTextAlign.GDI32 ref: 00007FFDFAC22D31
SetTextColor.GDI32 ref: 00007FFDFAC22D3D
SetBkMode.GDI32 ref: 00007FFDFAC22D4B
SetBkColor.GDI32 ref: 00007FFDFAC22D56
GetTextExtentPointA.GDI32 ref: 00007FFDFAC22D6E
GetTextMetricsW.GDI32 ref: 00007FFDFAC22D7B
CreateCompatibleBitmap.GDI32 ref: 00007FFDFAC22D94
SelectObject.GDI32 ref: 00007FFDFAC22DA3
PatBlt.GDI32 ref: 00007FFDFAC22DC9
BitBlt.GDI32 ref: 00007FFDFAC22E42
PatBlt.GDI32 ref: 00007FFDFAC22E65
BitBlt.GDI32 ref: 00007FFDFAC22ED4
SelectObject.GDI32 ref: 00007FFDFAC22EE0
DeleteObject.GDI32 ref: 00007FFDFAC22EE9
DeleteDC.GDI32 ref: 00007FFDFAC22EF2
SelectObject.GDI32 ref: 00007FFDFAC22F03
DeleteObject.GDI32 ref: 00007FFDFAC22F0E
SetTextAlign.GDI32 ref: 00007FFDFAC22F32
SetTextColor.GDI32 ref: 00007FFDFAC22F3E
SetBkMode.GDI32 ref: 00007FFDFAC22F4C

Part of subcall function 00007FFDFAC236B0: sin.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFDFAC23721
Part of subcall function 00007FFDFAC236B0: cos.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFDFAC2373F
Part of subcall function 00007FFDFAC236B0: GetTextMetricsW.GDI32 ref: 00007FFDFAC23770

CreateCompatibleDC.GDI32 ref: 00007FFDFAC22F90
SetTextAlign.GDI32 ref: 00007FFDFAC22FA1
SetTextColor.GDI32 ref: 00007FFDFAC22FAD
SetBkMode.GDI32 ref: 00007FFDFAC22FBB
SetBkColor.GDI32 ref: 00007FFDFAC22FC6
GetTextExtentPointA.GDI32 ref: 00007FFDFAC22FDB
GetTextMetricsW.GDI32 ref: 00007FFDFAC22FE8
CreateCompatibleBitmap.GDI32 ref: 00007FFDFAC23001
SelectObject.GDI32 ref: 00007FFDFAC23010
BitBlt.GDI32 ref: 00007FFDFAC2308F
SelectObject.GDI32 ref: 00007FFDFAC2309B
DeleteObject.GDI32 ref: 00007FFDFAC230A4
DeleteDC.GDI32 ref: 00007FFDFAC230AD
SetBkMode.GDI32 ref: 00007FFDFAC230B9
SelectPalette.GDI32 ref: 00007FFDFAC230CC
RealizePalette.GDI32 ref: 00007FFDFAC230D5
ReleaseDC.USER32 ref: 00007FFDFAC230FC
DeleteDC.GDI32 ref: 00007FFDFAC2310C

Strings

b, xrefs: 00007FFDFAC22E59
unexpected drawable type in stipple, xrefs: 00007FFDFAC22CDF

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Text$ObjectSelect$Delete$ColorCreateMode$CompatiblePalette$AlignMetrics$BitmapBrushExtentPointRealize$ClipPatternRelease
String ID: b$unexpected drawable type in stipple
API String ID: 3943515398-268975484
Opcode ID: b4405ffdbca2a76212e8db5cca80c5ef91652ec258bae54aa501eff6a6602e72
Instruction ID: 2d001d22f4643454da50b7378e0848c1f200722f77d5de8e0e8c63aae0d8927f
Opcode Fuzzy Hash: b4405ffdbca2a76212e8db5cca80c5ef91652ec258bae54aa501eff6a6602e72
Instruction Fuzzy Hash: 01E14C3AB18A418AE714CF22E85496EB7A5FF89BD4F004675EE5953B5CDF7CE0488B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC25B20 Relevance: 54.7, APIs: 28, Strings: 3, Instructions: 462windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32 ref: 00007FFDFAC25BBB
CreateCompatibleDC.GDI32 ref: 00007FFDFAC25BCC
SelectObject.GDI32 ref: 00007FFDFAC25BE0
SelectPalette.GDI32 ref: 00007FFDFAC25BFE
RealizePalette.GDI32 ref: 00007FFDFAC25C0C
UpdateColors.GDI32 ref: 00007FFDFAC25C19
SelectPalette.GDI32 ref: 00007FFDFAC25C2A
RealizePalette.GDI32 ref: 00007FFDFAC25C36
UpdateColors.GDI32 ref: 00007FFDFAC25C43
BitBlt.GDI32 ref: 00007FFDFAC25C7B
SelectPalette.GDI32 ref: 00007FFDFAC25C98
SelectObject.GDI32 ref: 00007FFDFAC25CA6
SetBkMode.GDI32 ref: 00007FFDFAC25CB3
SelectPalette.GDI32 ref: 00007FFDFAC25CC7
RealizePalette.GDI32 ref: 00007FFDFAC25CD0
ReleaseDC.USER32 ref: 00007FFDFAC25CE4
SelectPalette.GDI32 ref: 00007FFDFAC2627A
DeleteDC.GDI32 ref: 00007FFDFAC26283

Strings

Only ZPixmap types are implemented, xrefs: 00007FFDFAC25B5D
XGetImageZPixmap Failure, xrefs: 00007FFDFAC25B56
, xrefs: 00007FFDFAC25DCD

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$Select$Realize$ColorsCompatibleCreateObjectUpdate$BitmapDeleteModeRelease
String ID: $Only ZPixmap types are implemented$XGetImageZPixmap Failure
API String ID: 4159931456-2551037732
Opcode ID: 6a6bd77d5322f6a8cdc0dccac20a0be8946d8bc4d5fc59f52d7e85e1d38f83e1
Instruction ID: 61d30f9f9cf3cb11cebe5376fc641594976127d7a3098652d288dfbc89d02995
Opcode Fuzzy Hash: 6a6bd77d5322f6a8cdc0dccac20a0be8946d8bc4d5fc59f52d7e85e1d38f83e1
Instruction Fuzzy Hash: BC227276B1878582E7688F15E854A2EB7E5FB89B80F045179DEAD03B98DF3CE454CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A227E0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 156memoryfileCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 70A2282C
CreateFileA.KERNEL32 ref: 70A22860
GlobalAlloc.KERNEL32 ref: 70A2287A
DeviceIoControl.KERNEL32 ref: 70A228F4
GlobalFree.KERNEL32 ref: 70A2290A
_snprintf.MSVCRT ref: 70A22947
CreateFileA.KERNEL32 ref: 70A22974
GlobalAlloc.KERNEL32 ref: 70A22995
GlobalAlloc.KERNEL32 ref: 70A229A4
DeviceIoControl.KERNEL32 ref: 70A229EC
GlobalFree.KERNEL32 ref: 70A22A05
GlobalFree.KERNEL32 ref: 70A22A0A
CloseHandle.KERNEL32 ref: 70A22A14
GlobalFree.KERNEL32 ref: 70A22A36

Part of subcall function 70A224D0: GetLastError.KERNEL32 ref: 70A224D4
Part of subcall function 70A224D0: FormatMessageA.KERNEL32 ref: 70A22505
Part of subcall function 70A224D0: LocalFree.KERNEL32 ref: 70A22526

Strings

platforms/windows/hdinfo.c, xrefs: 70A22917
\\.\PhysicalDrive%d, xrefs: 70A2293B
SCSIDISK, xrefs: 70A228A4
\\.\Scsi%d, xrefs: 70A227F5
/%d:, xrefs: 70A227E6
Empty serial number, xrefs: 70A22910

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
String ID: /%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d$platforms/windows/hdinfo.c
API String ID: 1119308327-2400754906
Opcode ID: cdc5ca99754b0ed8af1e0c1fc3391b6fed3b1e63f17cefb8642155568022127a
Instruction ID: 78b29783421bd9483aabc46b8ce1290c77c7cf321ccdab8d0dbf543897946013
Opcode Fuzzy Hash: cdc5ca99754b0ed8af1e0c1fc3391b6fed3b1e63f17cefb8642155568022127a
Instruction Fuzzy Hash: FA51E131704A808AE7249F22F914B4B7764F788BE4F444325AE5E4BBD8CF7CC6068704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC328B0 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 342stringwindowCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC3292C
memset.VCRUNTIME140 ref: 00007FFDFAC32A33
CreateDIBSection.GDI32 ref: 00007FFDFAC32B9B
CreateDIBSection.GDI32 ref: 00007FFDFAC32C38
memset.VCRUNTIME140 ref: 00007FFDFAC32C60
CreateIconIndirect.USER32 ref: 00007FFDFAC32C69
DeleteObject.GDI32 ref: 00007FFDFAC32C76
DeleteObject.GDI32 ref: 00007FFDFAC32C80
DeleteObject.GDI32 ref: 00007FFDFAC32D4E

Strings

window ?-default? image1 ?image2 ...?, xrefs: 00007FFDFAC328F9
PHOTO, xrefs: 00007FFDFAC32AFC
failed to create mask bitmap for "%s", xrefs: 00007FFDFAC32D7D
ICONPHOTO, xrefs: 00007FFDFAC32B11, 00007FFDFAC32DEA
-default, xrefs: 00007FFDFAC32925
IMAGE, xrefs: 00007FFDFAC32DDF
failed to create an iconphoto with image "%s", xrefs: 00007FFDFAC32DC5
ICON, xrefs: 00007FFDFAC32D3E
MASK, xrefs: 00007FFDFAC32D97
failed to create icon for "%s", xrefs: 00007FFDFAC32D24
can't use "%s" as iconphoto: not a photo image, xrefs: 00007FFDFAC32AE3

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: CreateDeleteObject$Sectionmemset$IconIndirectstrcmp
String ID: -default$ICON$ICONPHOTO$IMAGE$MASK$PHOTO$can't use "%s" as iconphoto: not a photo image$failed to create an iconphoto with image "%s"$failed to create icon for "%s"$failed to create mask bitmap for "%s"$window ?-default? image1 ?image2 ...?
API String ID: 1159928025-2276822187
Opcode ID: a165a81dc936974a4db731693267ae276b03021c49225d228d89733a0f1ccc46
Instruction ID: cfcb4d2dd21c6ee54beea8c946a14546481714477b7ec98e87eb685a050c2704
Opcode Fuzzy Hash: a165a81dc936974a4db731693267ae276b03021c49225d228d89733a0f1ccc46
Instruction Fuzzy Hash: 9AF18E36B09B4686EB18CF65E860AAD37A1FB48B88F044576CE1E57798EF7CE055C340

Uniqueness

Uniqueness Score: -1.00%

Function 70A22B90 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 171fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 70A22BB5
wsprintfA.USER32 ref: 70A22BC7
CreateFileA.KERNEL32 ref: 70A22BF4
memset.MSVCRT ref: 70A22C33
DeviceIoControl.KERNEL32 ref: 70A22C69
CloseHandle.KERNEL32 ref: 70A22C76
isxdigit.MSVCRT ref: 70A22CF3
isxdigit.MSVCRT ref: 70A22D20
isprint.MSVCRT ref: 70A22D4B
memcpy.MSVCRT ref: 70A22DDB
CloseHandle.KERNEL32 ref: 70A22DE3

Strings

\\.\PhysicalDrive%d, xrefs: 70A22BC0
/%d:, xrefs: 70A22B96

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
String ID: /%d:$\\.\PhysicalDrive%d
API String ID: 2355516209-72258043
Opcode ID: 30f747ad7a7eb893f58eb9baf259ccbdc94368a5531370d9905ee84ac7e1ee0b
Instruction ID: 0d7b3137eaeb007d479d6924609eaa03627adb4b49fa2c675c148a31f9b832b7
Opcode Fuzzy Hash: 30f747ad7a7eb893f58eb9baf259ccbdc94368a5531370d9905ee84ac7e1ee0b
Instruction Fuzzy Hash: 22513672218B8095E701CB22F84475FBBA6BBCA795F444225EE9A47B9DDF7CC508C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A380F0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 70A38146
CryptAcquireContextA.ADVAPI32 ref: 70A38166
CryptGenRandom.ADVAPI32 ref: 70A38177
CryptReleaseContext.ADVAPI32 ref: 70A3818D
clock.MSVCRT ref: 70A381D0
clock.MSVCRT ref: 70A381E3
clock.MSVCRT ref: 70A381EC
clock.MSVCRT ref: 70A38203

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 70A38135, 70A3815C
(, xrefs: 70A3814E
src/prngs/rng_get_bytes.c, xrefs: 70A38250
out != NULL, xrefs: 70A38257

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Cryptclock$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
API String ID: 2525729555-3762154145
Opcode ID: fc793f130eee9d6fe5856a492ae082c48102eab86eaee6756813012a7edc1188
Instruction ID: a8ec404c47e84b9e32cf0793c61425bd677adc6d0f6f02ad6f5924d66923671b
Opcode Fuzzy Hash: fc793f130eee9d6fe5856a492ae082c48102eab86eaee6756813012a7edc1188
Instruction Fuzzy Hash: F431F232708B4081E711CB66E84475EBAB5B78CBC0F804625DE8A8372CEF7DDA4AC340

Uniqueness

Uniqueness Score: -1.00%

Function 70A22540 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI ref: 70A22571
GetProcessHeap.KERNEL32 ref: 70A225ED
HeapFree.KERNEL32 ref: 70A225F7
GetProcessHeap.KERNEL32 ref: 70A22617
HeapFree.KERNEL32 ref: 70A22628
GetProcessHeap.KERNEL32 ref: 70A2262F
HeapAlloc.KERNEL32 ref: 70A22639
GetAdaptersAddresses.IPHLPAPI ref: 70A22659

Strings

platforms/windows/hdinfo.c, xrefs: 70A22687
%02x:%02x:%02x:%02x:%02x:%02x, xrefs: 70A225B7
Too small size, xrefs: 70A22680

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesFree$Alloc
String ID: %02x:%02x:%02x:%02x:%02x:%02x$Too small size$platforms/windows/hdinfo.c
API String ID: 3314560173-3552495142
Opcode ID: 542046e599156e828d7f4f9cdf4c090b56c29f6628748238c11a617c781fcf51
Instruction ID: adc38e0a36bc108657f6ab604fd605db90014fb713c36f7ad70899483e02aae4
Opcode Fuzzy Hash: 542046e599156e828d7f4f9cdf4c090b56c29f6628748238c11a617c781fcf51
Instruction Fuzzy Hash: 3831F6226082919ED710DBBAF910B2E7BA1F789B95F484236BD598379CDF3CD504DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC1AC50 Relevance: 21.5, APIs: 9, Strings: 3, Instructions: 498windowCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FFDFAC1AD7C
GetOpenFileNameW.COMDLG32 ref: 00007FFDFAC1AFFD
GetSaveFileNameW.COMDLG32 ref: 00007FFDFAC1B005
GetTickCount.KERNEL32 ref: 00007FFDFAC1B01C
GetTickCount.KERNEL32 ref: 00007FFDFAC1B028
PeekMessageW.USER32 ref: 00007FFDFAC1B055
GetTickCount.KERNEL32 ref: 00007FFDFAC1B05B
EnableWindow.USER32 ref: 00007FFDFAC1B06B
CommDlgExtendedError.COMDLG32 ref: 00007FFDFAC1B081

Strings

INVALID_FILENAME, xrefs: 00007FFDFAC1B0EF
invalid filename "%s", xrefs: 00007FFDFAC1B0C1
FILEDIALOG, xrefs: 00007FFDFAC1B0F6

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: CountTick$FileNameWindow$CommEnableErrorExtendedLongMessageOpenPeekSave
String ID: FILEDIALOG$INVALID_FILENAME$invalid filename "%s"
API String ID: 1712915689-2150970497
Opcode ID: b2759095a66e626bf69ecae4b55da3a0a8e32eea4cbff814ad608586a120621f
Instruction ID: ad205aa872f17304d7503878acd76a99ff47be829541b641481af6d10a8e94ec
Opcode Fuzzy Hash: b2759095a66e626bf69ecae4b55da3a0a8e32eea4cbff814ad608586a120621f
Instruction Fuzzy Hash: 2D42623AB08B8686EB188F25E8646BD37A1FB48B84F4451B2DE2D037E8DF79D554C740

Uniqueness

Uniqueness Score: -1.00%

Function 70A22A90 Relevance: 16.6, APIs: 11, Instructions: 78memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 70A22AAB
HeapAlloc.KERNEL32 ref: 70A22ABF
GetNetworkParams.IPHLPAPI ref: 70A22AF7
GetProcessHeap.KERNEL32 ref: 70A22B19
HeapFree.KERNEL32 ref: 70A22B23
GetProcessHeap.KERNEL32 ref: 70A22B40
HeapFree.KERNEL32 ref: 70A22B4A
GetProcessHeap.KERNEL32 ref: 70A22B51
HeapAlloc.KERNEL32 ref: 70A22B5B
GetProcessHeap.KERNEL32 ref: 70A22B76
HeapFree.KERNEL32 ref: 70A22B80

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$NetworkParams
String ID:
API String ID: 3483679945-0
Opcode ID: 76efa96e1acd114793a94f8b7d214b5392da9615bece9c3d993956f0684706fd
Instruction ID: f001f7b95b3045b3e0a64c44733ca262071fd889bcad5d2c2ea1eb7a63568a38
Opcode Fuzzy Hash: 76efa96e1acd114793a94f8b7d214b5392da9615bece9c3d993956f0684706fd
Instruction Fuzzy Hash: A311571170160568DA14EBB3BD00B6E97922FCEBD5F488236AD2D973ACEE3CE5428310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC2BB70 Relevance: 16.6, APIs: 11, Instructions: 75keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 00007FFDFAC2BB84
GetKeyState.USER32 ref: 00007FFDFAC2BB95
GetKeyState.USER32 ref: 00007FFDFAC2BBB0
GetKeyState.USER32 ref: 00007FFDFAC2BBC7
GetKeyState.USER32 ref: 00007FFDFAC2BBDC
GetKeyState.USER32 ref: 00007FFDFAC2BBF1
GetKeyState.USER32 ref: 00007FFDFAC2BC06
GetKeyState.USER32 ref: 00007FFDFAC2BC1D
GetKeyState.USER32 ref: 00007FFDFAC2BC34
GetKeyState.USER32 ref: 00007FFDFAC2BC4B
GetKeyState.USER32 ref: 00007FFDFAC2BC62

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 98f52b6337070ba2003eff1c74b65ff3ecd04ed43030bd47901021b998995126
Instruction ID: 7d4e7d7522ca5cef6464f685fde569e97fea9d74df643c5aecda6aacc98b3beb
Opcode Fuzzy Hash: 98f52b6337070ba2003eff1c74b65ff3ecd04ed43030bd47901021b998995126
Instruction Fuzzy Hash: AF217F77F1461767F7082F61ACE16686356FFE8B22F87093CE61B433958E7E884A4210

Uniqueness

Uniqueness Score: -1.00%

Function 70A22360 Relevance: 15.1, APIs: 10, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 70A223B3
HeapFree.KERNEL32 ref: 70A223BD
GetProcessHeap.KERNEL32 ref: 70A223D7
HeapFree.KERNEL32 ref: 70A223E8
GetProcessHeap.KERNEL32 ref: 70A223EF
HeapAlloc.KERNEL32 ref: 70A223F9
GetAdaptersAddresses.IPHLPAPI ref: 70A2241D
memcpy.MSVCRT ref: 70A22470
GetProcessHeap.KERNEL32 ref: 70A22489
HeapFree.KERNEL32 ref: 70A22493

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Heap$Process$Free$AdaptersAddressesAllocmemcpy
String ID:
API String ID: 3510192139-0
Opcode ID: d2da9af87d846cd1c589f1e7d865ef595ba3dcf19010ff1e0370907bd33b5295
Instruction ID: 458859146df9df8e722937a6f6652994330ec62641a27ba8f336e36acaa7ef1c
Opcode Fuzzy Hash: d2da9af87d846cd1c589f1e7d865ef595ba3dcf19010ff1e0370907bd33b5295
Instruction Fuzzy Hash: 8B3104227145919ED701EB6AF900F5E23A6A789BD5F888139EE0E87B18DF38C941C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC62AD0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 147clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FFDFAC62CF3
EmptyClipboard.USER32 ref: 00007FFDFAC62CF9
SetClipboardData.USER32 ref: 00007FFDFAC62D04
CloseClipboard.USER32 ref: 00007FFDFAC62D0A

Strings

CLIPBOARD, xrefs: 00007FFDFAC62C48
format "%s" does not match current format "%s" for %s, xrefs: 00007FFDFAC62C1B
FORMAT_MISMATCH, xrefs: 00007FFDFAC62C41

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Clipboard$CloseDataEmptyOpen
String ID: CLIPBOARD$FORMAT_MISMATCH$format "%s" does not match current format "%s" for %s
API String ID: 1836560592-2768785289
Opcode ID: 5b5e4d14323701bdf1e075d8f60dcdaf01b020174bc5ab1551e4944da312ec4f
Instruction ID: cabf8f1e37f1712295a4a73439589ba7cc7f45067af98ffa053097f5b199688a
Opcode Fuzzy Hash: 5b5e4d14323701bdf1e075d8f60dcdaf01b020174bc5ab1551e4944da312ec4f
Instruction Fuzzy Hash: 8E615F3AB09B8682E748DF11E8606AD77A4FB88B94F048575DE6D03399DF3CE465C740

Uniqueness

Uniqueness Score: -1.00%

Function 70A95380 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 70A95394
RtlLookupFunctionEntry.KERNEL32 ref: 70A953AB
RtlVirtualUnwind.KERNEL32 ref: 70A953ED
SetUnhandledExceptionFilter.KERNEL32 ref: 70A95431
UnhandledExceptionFilter.KERNEL32 ref: 70A9543E
GetCurrentProcess.KERNEL32 ref: 70A95444
TerminateProcess.KERNEL32 ref: 70A95452
abort.MSVCRT ref: 70A95458

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 38f15871d2c854c23405dd6262a20182c3bbfa91e52b680f2e394a1181f99296
Instruction ID: 9fbf7b8e9ebe23eaa7d49609bebf5e78dcff67f58d670e554323d142bdd2cea8
Opcode Fuzzy Hash: 38f15871d2c854c23405dd6262a20182c3bbfa91e52b680f2e394a1181f99296
Instruction Fuzzy Hash: 3021F371A19B00D9EB009B65FC9079933A4FB1CB84F54422AD94E97728EF3CE659C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC27B00 Relevance: 10.7, APIs: 7, Instructions: 171keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC276D0: GetMenuItemCount.USER32 ref: 00007FFDFAC2772C
Part of subcall function 00007FFDFAC276D0: RemoveMenu.USER32 ref: 00007FFDFAC2774B

ClientToScreen.USER32 ref: 00007FFDFAC27C3F
GetSystemMetrics.USER32 ref: 00007FFDFAC27C7F
GetAsyncKeyState.USER32 ref: 00007FFDFAC27C8E
GetAsyncKeyState.USER32 ref: 00007FFDFAC27CA7
TrackPopupMenu.USER32 ref: 00007FFDFAC27CD7
GetCursorPos.USER32 ref: 00007FFDFAC27CF2
WindowFromPoint.USER32 ref: 00007FFDFAC27D05

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Menu$AsyncState$ClientCountCursorFromItemMetricsPointPopupRemoveScreenSystemTrackWindow
String ID:
API String ID: 2544695384-0
Opcode ID: 2b1d08f2c3ea8af079228691d4a642af7da79c396882fa4667ecbe12fbd774bf
Instruction ID: 0fb2c756012133d7d9d0c63fde9b52390205d48486ef04b17e44cef3c6e532e9
Opcode Fuzzy Hash: 2b1d08f2c3ea8af079228691d4a642af7da79c396882fa4667ecbe12fbd774bf
Instruction Fuzzy Hash: 8571973AB08A4686E7189F16E860A7E77B0FB85B94F14407ADE2E47798DF7CD445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A0F220 Relevance: 7.7, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 70A0F371
free.MSVCRT ref: 70A0F379

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: c444df6bb9278b759edb4c92ef3de79f9680b9097f7200271ba5b738b486f019
Instruction ID: e6c9761d233015bb53eb81191f737d25446d12432f865c4322a4ad81bab5a319
Opcode Fuzzy Hash: c444df6bb9278b759edb4c92ef3de79f9680b9097f7200271ba5b738b486f019
Instruction Fuzzy Hash: F451E3727182488AE720DF25F94179EB3A0FB45BD4F584126EE4A97B68EB3CD941CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC18C00 Relevance: 7.6, APIs: 5, Instructions: 122memoryclipboardCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 00007FFDFAC18D42
GlobalLock.KERNEL32 ref: 00007FFDFAC18D67
memcpy.VCRUNTIME140 ref: 00007FFDFAC18D7F
GlobalUnlock.KERNEL32 ref: 00007FFDFAC18D87
SetClipboardData.USER32 ref: 00007FFDFAC18DA7

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Global$AllocClipboardDataLockUnlockmemcpy
String ID:
API String ID: 6447982-0
Opcode ID: ade569a4155f222b326d017dce30bd9a4e3990725a8d45d592ba5696f356a521
Instruction ID: b2d35f73da0ad19fd539280433de1d5182f4fc4128956f02462857d8b6a411f1
Opcode Fuzzy Hash: ade569a4155f222b326d017dce30bd9a4e3990725a8d45d592ba5696f356a521
Instruction Fuzzy Hash: 4851842770D68592EF188F15E860BB967A1FB99F84F4885B2DA6E073D8DF6CE441C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A952A0 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 70A952E5
GetCurrentProcessId.KERNEL32 ref: 70A952F0
GetCurrentThreadId.KERNEL32 ref: 70A952F9
GetTickCount.KERNEL32 ref: 70A95301
QueryPerformanceCounter.KERNEL32 ref: 70A9530E

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 71deaa8847ac07225c0b9a9975ff01b325f0ff8b50d971686cfb165e8d7fa5ce
Instruction ID: f3761bca60c6665eaf21dabe3c1515b7f0bc0244d165cda119bf1216d62064c8
Opcode Fuzzy Hash: 71deaa8847ac07225c0b9a9975ff01b325f0ff8b50d971686cfb165e8d7fa5ce
Instruction Fuzzy Hash: 5B118C26B2AA1186FF104B25F80475963A0B74CBE1F4807359E9D47BA8DF3CE58A8704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACBEB80 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 453COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFACBEEFD

Strings

Selection, xrefs: 00007FFDFACBEF1B
TkBTreeLinesTo couldn't find node, xrefs: 00007FFDFACBECEC, 00007FFDFACBED7C
TkBTreeLinesTo couldn't find line, xrefs: 00007FFDFACBECAC, 00007FFDFACBED43

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: memset
String ID: Selection$TkBTreeLinesTo couldn't find line$TkBTreeLinesTo couldn't find node
API String ID: 2221118986-1902325206
Opcode ID: 6f41e9f3e9cb74426df841e28ef7e397bfb36f867d1e3b2a6228df84d8072b0c
Instruction ID: 0b4fe927ddeb67edc8103b20d09797ad8859cedc323d3c5d31e2a1345a40b3a8
Opcode Fuzzy Hash: 6f41e9f3e9cb74426df841e28ef7e397bfb36f867d1e3b2a6228df84d8072b0c
Instruction Fuzzy Hash: 8C22A23AB09A8286EB58CF25D460AAE77A0FB84BC4F454076DE6D0779DEF39E450C740

Uniqueness

Uniqueness Score: -1.00%

Function 70A2BD40 Relevance: 6.3, Strings: 4, Instructions: 1259COMMON

Download Yara Rule

Strings

out != NULL, xrefs: 70A2C158, 70A2C67F, 70A2CAE8, 70A2CFFF
src/misc/base64/base64_decode.c, xrefs: 70A2C138, 70A2C151, 70A2C16A, 70A2C678, 70A2C691, 70A2C6AA, 70A2CAC8, 70A2CAE1, 70A2CAFA, 70A2CFF8, 70A2D011, 70A2D02A
outlen != NULL, xrefs: 70A2C13F, 70A2C6B1, 70A2CACF, 70A2D031
in != NULL, xrefs: 70A2C171, 70A2C698, 70A2CB01, 70A2D018

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID: in != NULL$out != NULL$outlen != NULL$src/misc/base64/base64_decode.c
API String ID: 0-942433653
Opcode ID: a1de569a620ad6ff2f642f603163c984532097288b5ba575777088c551e4dda7
Instruction ID: e60192b28be501d8954a71bf973623ecc9666a3dbc64f14321bf5c3566e74413
Opcode Fuzzy Hash: a1de569a620ad6ff2f642f603163c984532097288b5ba575777088c551e4dda7
Instruction Fuzzy Hash: 0192677391C6C887D307CE24A86435E7A22A3D6357F898234EF071B39AE279DE59C351

Uniqueness

Uniqueness Score: -1.00%

Function 70A06A70 Relevance: 4.5, APIs: 3, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 70A06A7D
VirtualAlloc.KERNEL32 ref: 70A06ACF
VirtualAlloc.KERNEL32 ref: 70A06AFE

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: AllocVirtual$InfoSystem
String ID:
API String ID: 2622297391-0
Opcode ID: fe55c1f7d03c7a422dae360c7401d7161339d05867d57ba79a64ce01e6a7934a
Instruction ID: 33b6be65b563c75e3afce24196251af1cc13739e1f0d932138555b3f6047f12b
Opcode Fuzzy Hash: fe55c1f7d03c7a422dae360c7401d7161339d05867d57ba79a64ce01e6a7934a
Instruction Fuzzy Hash: FF01A2F0B1650882EF21A722B92975962A26B5CBD9F048B35DE2F5B79CFF2CD1408704

Uniqueness

Uniqueness Score: -1.00%

Function 70A70CFC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa936f450e0f3f2617054bbf92e3b1eb155860729415d7dd4d522b3eeb6c5f3
Instruction ID: fd78f73fd857ad01888a3b82d4976e574b0f55c983f5049707155319d51e2956
Opcode Fuzzy Hash: aaa936f450e0f3f2617054bbf92e3b1eb155860729415d7dd4d522b3eeb6c5f3
Instruction Fuzzy Hash: ED110A72629240CFE3A09F08E880B1BB6A0E384755F10A125F69ACB7A9D7BCD944CF40

Uniqueness

Uniqueness Score: -1.00%

Function 70A70C60 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b231fa2c38acbe48e7bf5c74ad7afed36afc1c14d16ceeaf8f4259ab533eb8f
Instruction ID: d256035e1214daee13d89cc389c642cca2901f452f5ecbe8af555c351e81e58c
Opcode Fuzzy Hash: 9b231fa2c38acbe48e7bf5c74ad7afed36afc1c14d16ceeaf8f4259ab533eb8f
Instruction Fuzzy Hash: F4D02220B18A00C1E702930BEC90B192734632D340FC0E236C80ECB3B8DF0CCA838B04

Uniqueness

Uniqueness Score: -1.00%

Function 70A97091 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591221a1b99675f22eb83b5d891223287c6b87fad5a8bb23c57e6a131d1777ce
Instruction ID: 115114f5337861c6fd239d043092bc179c1bc58a6644257ec6b0e148e1a7739a
Opcode Fuzzy Hash: 591221a1b99675f22eb83b5d891223287c6b87fad5a8bb23c57e6a131d1777ce
Instruction Fuzzy Hash: 41A00216C4DC10C0D6001B00D981B605128E30A341F1472345139515178B6C92069204

Uniqueness

Uniqueness Score: -1.00%

Function 70A04B80 Relevance: 119.4, APIs: 63, Strings: 5, Instructions: 431stringfileCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A04BEF
fwrite.MSVCRT ref: 70A04CA8
fclose.MSVCRT ref: 70A04CC6
_errno.MSVCRT ref: 70A04D1A
_errno.MSVCRT ref: 70A04D53
fprintf.MSVCRT ref: 70A04D80
_errno.MSVCRT ref: 70A04D85
strerror.MSVCRT ref: 70A04D89
fprintf.MSVCRT ref: 70A04D9E
fputc.MSVCRT ref: 70A04DAB
fclose.MSVCRT ref: 70A04DB3
_errno.MSVCRT ref: 70A04DBF
strerror.MSVCRT ref: 70A04DC3
fprintf.MSVCRT ref: 70A04DE5
fputc.MSVCRT ref: 70A04DF9
_errno.MSVCRT ref: 70A04EB7
strerror.MSVCRT ref: 70A04EBB

Strings

%s,%d,0x%x,, xrefs: 70A04D68, 70A04E43, 70A04EF5, 70A04FF5, 70A05151, 70A051BC, 70A0529A, 70A052D1
pytransform.log, xrefs: 70A04D3B, 70A04E0A, 70A04F8F, 70A05055, 70A0517A
_pytransform.c, xrefs: 70A04D61, 70A04E3C, 70A04EEE, 70A04FEE, 70A050C3, 70A0514A, 70A051B5, 70A05293, 70A052CA
inbuf, xrefs: 70A050CA
%s, xrefs: 70A04F49, 70A04FB7, 70A0507E, 70A050AC, 70A051A3

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$fprintfstrerror$fclosefputc$fwrite
String ID: %s$%s,%d,0x%x,$_pytransform.c$inbuf$pytransform.log
API String ID: 3108438096-3708888661
Opcode ID: a55d836d327e1af174a548d8b552348d7f06c546fdb5a134832f79d2b8d03740
Instruction ID: 8fa3ec4edb807e7096d6f92c165c0945545b6d6b1b146ac59512dc101ca6a1b1
Opcode Fuzzy Hash: a55d836d327e1af174a548d8b552348d7f06c546fdb5a134832f79d2b8d03740
Instruction Fuzzy Hash: CEF19EA0B19755DAEA049B22F91075D23A1BB89BC4F84422ADD0E5B76CEF7CF506C306

Uniqueness

Uniqueness Score: -1.00%

Function 70A146D0 Relevance: 94.8, APIs: 47, Strings: 7, Instructions: 338stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 70A14705
free.MSVCRT ref: 70A14763
_errno.MSVCRT ref: 70A147EF
_errno.MSVCRT ref: 70A14855

Part of subcall function 70A04900: fseek.MSVCRT ref: 70A04954
Part of subcall function 70A04900: malloc.MSVCRT ref: 70A0496E
Part of subcall function 70A04900: fclose.MSVCRT ref: 70A049A3

_errno.MSVCRT ref: 70A148B4
fprintf.MSVCRT ref: 70A1491A
fprintf.MSVCRT ref: 70A14929
fputc.MSVCRT ref: 70A14936
fclose.MSVCRT ref: 70A1493E
fprintf.MSVCRT ref: 70A1495E
fputc.MSVCRT ref: 70A14972
_errno.MSVCRT ref: 70A149B6

Strings

%s,%d,0x%x,, xrefs: 70A14910, 70A149E5, 70A14A25, 70A14A84, 70A14BD8, 70A14C15, 70A14CAC
pytransform.log, xrefs: 70A1483D, 70A1489C, 70A148D7, 70A14A57, 70A14B5E
_pytransform.c, xrefs: 70A14909, 70A149DE, 70A14A1E, 70A14A7D, 70A14BD1, 70A14C0E, 70A14CA5
__main__, xrefs: 70A146DD
.pye, xrefs: 70A146FE
__file__, xrefs: 70A1477D
%s, xrefs: 70A14B29, 70A14C40, 70A14C60, 70A14C80, 70A14CD7

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$fprintf$fclosefputc$freefseekmallocstrrchr
String ID: %s$%s,%d,0x%x,$.pye$__file__$__main__$_pytransform.c$pytransform.log
API String ID: 1013380922-457461209
Opcode ID: 431b95b56443553a57ea2ac8de9552749471941d4e935affe51f32742e70cae2
Instruction ID: c214cab25dc08cb896b5134ca0eb39040fb7e6a18611103d7a92f9e82fd673cf
Opcode Fuzzy Hash: 431b95b56443553a57ea2ac8de9552749471941d4e935affe51f32742e70cae2
Instruction Fuzzy Hash: F6D18F70B19716DAEA059B16E910B9D2371BB88BC4F844229DD0E5B36CEF7CF946C306

Uniqueness

Uniqueness Score: -1.00%

Function 70A185C0 Relevance: 84.3, APIs: 44, Strings: 4, Instructions: 322COMMON

Download Yara Rule

APIs

fread.MSVCRT ref: 70A18609
fclose.MSVCRT ref: 70A18614
_errno.MSVCRT ref: 70A1871C

Part of subcall function 70A0A420: malloc.MSVCRT ref: 70A0A43D

free.MSVCRT ref: 70A18664
_errno.MSVCRT ref: 70A186B9
_errno.MSVCRT ref: 70A18776
_errno.MSVCRT ref: 70A1893A
fprintf.MSVCRT ref: 70A18965
fprintf.MSVCRT ref: 70A18974
fputc.MSVCRT ref: 70A18981
fclose.MSVCRT ref: 70A18989
fprintf.MSVCRT ref: 70A189A9
fputc.MSVCRT ref: 70A189BD
_errno.MSVCRT ref: 70A18A8F

Strings

%s,%d,0x%x,, xrefs: 70A187C7, 70A18884, 70A1895B, 70A189E5, 70A18A25, 70A18AE5, 70A18B25
pytransform.log, xrefs: 70A1879A, 70A18857, 70A18922, 70A18A77
_pytransform.c, xrefs: 70A187C0, 70A1887D, 70A18954, 70A189DE, 70A18A1E, 70A18ADE, 70A18B1E
%s, xrefs: 70A18A59, 70A18AB9, 70A18B50, 70A18B70

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$fprintf$fclosefputc$freadfreemalloc
String ID: %s$%s,%d,0x%x,$_pytransform.c$pytransform.log
API String ID: 957815278-2792274189
Opcode ID: 11e58edd4ef3a8724539842ac44357ecae7bd813ba5d4c92a1e09bb8ff544fbf
Instruction ID: 01351576caccf2c462e61d9669d9f1e009ce352a321ab7897783774ddeef12f9
Opcode Fuzzy Hash: 11e58edd4ef3a8724539842ac44357ecae7bd813ba5d4c92a1e09bb8ff544fbf
Instruction Fuzzy Hash: 7DC1B2A0719342D9EA059B12EA10BAD2366FB89BC5F84422ADD0E5776CDF3CF546C307

Uniqueness

Uniqueness Score: -1.00%

Function 70A231A0 Relevance: 77.4, APIs: 28, Strings: 16, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 70A231DE

Part of subcall function 70A22E60: strlen.MSVCRT ref: 70A22E83

fprintf.MSVCRT ref: 70A23217
fputc.MSVCRT ref: 70A23249

Part of subcall function 70A22540: GetAdaptersAddresses.IPHLPAPI ref: 70A22571
Part of subcall function 70A22540: GetProcessHeap.KERNEL32 ref: 70A225ED
Part of subcall function 70A22540: HeapFree.KERNEL32 ref: 70A225F7

fprintf.MSVCRT ref: 70A23278

Part of subcall function 70A22360: GetProcessHeap.KERNEL32 ref: 70A223B3
Part of subcall function 70A22360: HeapFree.KERNEL32 ref: 70A223BD

fputc.MSVCRT ref: 70A232AB

Part of subcall function 70A226B0: GetAdaptersAddresses.IPHLPAPI ref: 70A226E4
Part of subcall function 70A226B0: inet_ntoa.WS2_32 ref: 70A22725
Part of subcall function 70A226B0: GetProcessHeap.KERNEL32 ref: 70A22740
Part of subcall function 70A226B0: HeapFree.KERNEL32 ref: 70A2274A

fprintf.MSVCRT ref: 70A232DA
fputc.MSVCRT ref: 70A232EE

Part of subcall function 70A22A90: GetProcessHeap.KERNEL32 ref: 70A22AAB
Part of subcall function 70A22A90: HeapAlloc.KERNEL32 ref: 70A22ABF
Part of subcall function 70A22A90: GetNetworkParams.IPHLPAPI ref: 70A22AF7
Part of subcall function 70A22A90: GetProcessHeap.KERNEL32 ref: 70A22B19
Part of subcall function 70A22A90: HeapFree.KERNEL32 ref: 70A22B23

fprintf.MSVCRT ref: 70A2331D
fwrite.MSVCRT ref: 70A2333E
strchr.MSVCRT ref: 70A2336B
fputc.MSVCRT ref: 70A23382
fwrite.MSVCRT ref: 70A233A3
fprintf.MSVCRT ref: 70A233CB
strchr.MSVCRT ref: 70A233D8
fprintf.MSVCRT ref: 70A233F9
fputc.MSVCRT ref: 70A23412
fwrite.MSVCRT ref: 70A23433
malloc.MSVCRT ref: 70A2343D
fwrite.MSVCRT ref: 70A237D7
fwrite.MSVCRT ref: 70A237F8
fwrite.MSVCRT ref: 70A23819
fwrite.MSVCRT ref: 70A2383A

Strings

%02x:, xrefs: 70A236EE
Failed to get harddisk information., xrefs: 70A237C2
Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 70A23329
%02x, xrefs: 70A2374D
Failed to get ip address., xrefs: 70A23804
Default Mac address: "%s", xrefs: 70A2326B
>", xrefs: 70A23797
Multiple Mac addresses: "<, xrefs: 70A2341E
Serial number of default harddisk: "%s", xrefs: 70A2320A
Failed to get domain name., xrefs: 70A23825
"%s", xrefs: 70A233AD, 70A233EC
Ip address: "%s", xrefs: 70A232CD
Serial number with disk name: , xrefs: 70A2338E
Hardware informations got by PyArmor:, xrefs: 70A231C6
Domain name: "%s", xrefs: 70A23310
Failed to get mac address., xrefs: 70A237E3

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Heap$fwrite$fprintf$Processfputc$Free$AdaptersAddressesstrchr$AllocNetworkParamsinet_ntoamallocstrlen
String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
API String ID: 558248371-3771683696
Opcode ID: 1e8a44467657bc775959a03dda607e35d1f7691b7c1005410de9e5ac89e2ca23
Instruction ID: ab2814ce4649bb32a0d5ad94461592e4eab04a3b78948e03f1eb92a38bb1a70f
Opcode Fuzzy Hash: 1e8a44467657bc775959a03dda607e35d1f7691b7c1005410de9e5ac89e2ca23
Instruction Fuzzy Hash: 3402DD72705B808ADB50CB26F54539E77A5EB8AB90F008229EF9E4B798DF3CD144C705

Uniqueness

Uniqueness Score: -1.00%

Function 70A114B0 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 225stringCOMMON

Download Yara Rule

APIs

Part of subcall function 70A0DA10: free.MSVCRT ref: 70A0DA6F

strstr.MSVCRT ref: 70A114E8
strlen.MSVCRT ref: 70A11518
atof.MSVCRT ref: 70A1154F
_time64.MSVCRT ref: 70A1155A
_errno.MSVCRT ref: 70A115B9
_errno.MSVCRT ref: 70A115F7
fprintf.MSVCRT ref: 70A11622
_errno.MSVCRT ref: 70A11627
strerror.MSVCRT ref: 70A1162B
fprintf.MSVCRT ref: 70A1163D
fputc.MSVCRT ref: 70A1164A
fclose.MSVCRT ref: 70A11652
_errno.MSVCRT ref: 70A1165E
strerror.MSVCRT ref: 70A11662
fprintf.MSVCRT ref: 70A11681
fputc.MSVCRT ref: 70A11695
_errno.MSVCRT ref: 70A116A6
strerror.MSVCRT ref: 70A116AA
fprintf.MSVCRT ref: 70A116F7
_errno.MSVCRT ref: 70A11746
strerror.MSVCRT ref: 70A1174A
fprintf.MSVCRT ref: 70A1175C
_errno.MSVCRT ref: 70A11785
_errno.MSVCRT ref: 70A1178D
strerror.MSVCRT ref: 70A11791
fprintf.MSVCRT ref: 70A117A3
fprintf.MSVCRT ref: 70A117C7
fprintf.MSVCRT ref: 70A117D6
fputc.MSVCRT ref: 70A117E3
fclose.MSVCRT ref: 70A117EB
fprintf.MSVCRT ref: 70A1180B
fputc.MSVCRT ref: 70A1181F
fprintf.MSVCRT ref: 70A11856

Strings

%s,%d,0x%x,, xrefs: 70A1160A, 70A116DF, 70A117AF, 70A1183E
pytransform.log, xrefs: 70A115D8, 70A1176D
*TIME:, xrefs: 70A114DE
license.c, xrefs: 70A11603, 70A116D8, 70A117A8, 70A11837
%s, xrefs: 70A1174F, 70A11796

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fprintf$_errno$strerror$fputc$fclose$_time64atoffreestrlenstrstr
String ID: %s$%s,%d,0x%x,$*TIME:$license.c$pytransform.log
API String ID: 3204063161-4277730492
Opcode ID: cb050303a69b0c0ede515df855fc2f32b7e6e906ea1da2ffe09435c3ab5b4562
Instruction ID: 2126cfc1af72039f5c50a19794cc0658df879707cefd90488eb4f3660fde2bba
Opcode Fuzzy Hash: cb050303a69b0c0ede515df855fc2f32b7e6e906ea1da2ffe09435c3ab5b4562
Instruction Fuzzy Hash: D181E360B19742D9EB069B21E91075D23B6BB89BD4F444226D90E5B3A8EF3CF546C306

Uniqueness

Uniqueness Score: -1.00%

Function 70A10310 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A1032E
_errno.MSVCRT ref: 70A10405

Strings

%s,%d,0x%x,, xrefs: 70A10493, 70A1059C, 70A10642, 70A106A2
pytransform.log, xrefs: 70A10451, 70A1055A
j > 0, xrefs: 70A103C7
protect.c, xrefs: 70A103C0, 70A1048C, 70A10595, 70A1063B, 70A1069B
%s, xrefs: 70A1047A, 70A10583

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errnomalloc
String ID: %s$%s,%d,0x%x,$j > 0$protect.c$pytransform.log
API String ID: 2517923351-3883256839
Opcode ID: 74597d4778650fb45c7ad77f82dc1cb29cd035386235f31c737a1272d734a6e3
Instruction ID: ff07d6d3b3f9b6b98854da9fc516575f118b90ff98d56f831fa1d945c1adf2f5
Opcode Fuzzy Hash: 74597d4778650fb45c7ad77f82dc1cb29cd035386235f31c737a1272d734a6e3
Instruction Fuzzy Hash: 6881F7607197129ADB059B22E950B5D3361BB89BC4F844139ED4D8B36CEF7CF542C316

Uniqueness

Uniqueness Score: -1.00%

Function 70A0A420 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 209COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A0A43D
free.MSVCRT ref: 70A0A493
_errno.MSVCRT ref: 70A0A4B8
_errno.MSVCRT ref: 70A0A4EA

Strings

%s,%d,0x%x,, xrefs: 70A0A526, 70A0A5F2, 70A0A705, 70A0A745
pytransform.log, xrefs: 70A0A4FB, 70A0A5C7
key != NULL, xrefs: 70A0A40B
protect.c, xrefs: 70A0A404, 70A0A51F, 70A0A5EB, 70A0A6FE, 70A0A73E
%s, xrefs: 70A0A770, 70A0A790

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$freemalloc
String ID: %s$%s,%d,0x%x,$key != NULL$protect.c$pytransform.log
API String ID: 1860011666-3885171557
Opcode ID: eafb6585828be7675963cb467d01f5e8ee2bb2b83d7b03cf039608616c6dddc1
Instruction ID: 509ea94fd3a3a3b0b0f5887046d1078b872c9f92159d09f6358ee19bded4a022
Opcode Fuzzy Hash: eafb6585828be7675963cb467d01f5e8ee2bb2b83d7b03cf039608616c6dddc1
Instruction Fuzzy Hash: 4371C060719705D9EB059B22FE1076D23A6BB99BC4F84413AAD0E5B36CEF3CF5058326

Uniqueness

Uniqueness Score: -1.00%

Function 70A13150 Relevance: 59.7, APIs: 5, Strings: 29, Instructions: 230stringCOMMON

Download Yara Rule

APIs

Part of subcall function 70A10310: malloc.MSVCRT ref: 70A1032E

free.MSVCRT ref: 70A13569
_errno.MSVCRT ref: 70A1364F
_errno.MSVCRT ref: 70A13657
strerror.MSVCRT ref: 70A1365B
_errno.MSVCRT ref: 70A13668

Strings

thDV3x4e, xrefs: 70A1328A
IoHvpCe3, xrefs: 70A132D2
oFj2UIkE, xrefs: 70A13294
+F7unNMN, xrefs: 70A132B0
Xa2Z/Fdw, xrefs: 70A13224
ZWxkIFBy, xrefs: 70A131EC
qNGCrKem, xrefs: 70A13240
S8tSMMR7, xrefs: 70A132F4
Wrap result failed, xrefs: 70A13624
HERhc2hp, xrefs: 70A131BB
aGQGvX/a, xrefs: 70A132EA
fSis3Gx0, xrefs: 70A132C8
b2plY3Ql, xrefs: 70A131FA
cDxn1XUJ, xrefs: 70A1324E
41qM08fu, xrefs: 70A13305
RbgIUXyw, xrefs: 70A1325C
nc/WZrlr, xrefs: 70A1326E
04U5w91r, xrefs: 70A13316
p5dyeOAr, xrefs: 70A132A2
UeQH2iY/, xrefs: 70A13338
oVCzhcbp, xrefs: 70A13236
3fvNMf9L, xrefs: 70A1321A
k6W630PQ, xrefs: 70A13208
4mLks8EO, xrefs: 70A13278
bmdzb2Z0, xrefs: 70A131C5
(OOO), xrefs: 70A135AE
IFB5c2hp, xrefs: 70A131E2
ej7tPRL6, xrefs: 70A1332E
Ew==, xrefs: 70A13355

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$freemallocstrerror
String ID: (OOO)$+F7unNMN$04U5w91r$3fvNMf9L$41qM08fu$4mLks8EO$Ew==$HERhc2hp$IFB5c2hp$IoHvpCe3$RbgIUXyw$S8tSMMR7$UeQH2iY/$Wrap result failed$Xa2Z/Fdw$ZWxkIFBy$aGQGvX/a$b2plY3Ql$bmdzb2Z0$cDxn1XUJ$ej7tPRL6$fSis3Gx0$k6W630PQ$nc/WZrlr$oFj2UIkE$oVCzhcbp$p5dyeOAr$qNGCrKem$thDV3x4e
API String ID: 2349789213-1418605665
Opcode ID: bb21aae9c6972c7c8a2fc6a20029789446c3a1c0a0f1b77e8aa5a6a2066ab423
Instruction ID: 78d8931315209e5107b875b6d3043ef45e632cbbc8eb1df4609bbf268d1bd2f7
Opcode Fuzzy Hash: bb21aae9c6972c7c8a2fc6a20029789446c3a1c0a0f1b77e8aa5a6a2066ab423
Instruction Fuzzy Hash: 9DB14976605B8889DBA4CF26B84074E77E9F788B84F54812ACF8D9BB18DF38D561C740

Uniqueness

Uniqueness Score: -1.00%

Function 70A16FB0 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 235COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A17095
_errno.MSVCRT ref: 70A170D2
fprintf.MSVCRT ref: 70A170FF
fprintf.MSVCRT ref: 70A1710E
fputc.MSVCRT ref: 70A1711B
fclose.MSVCRT ref: 70A17123
fprintf.MSVCRT ref: 70A17143
fputc.MSVCRT ref: 70A17157
_errno.MSVCRT ref: 70A171A9

Strings

%s,%d,0x%x,, xrefs: 70A170E7, 70A17225, 70A172A7, 70A17328, 70A1735C
pytransform.log, xrefs: 70A170BA, 70A171D8, 70A17257
_pytransform.c, xrefs: 70A170E0, 70A1721E, 70A172A0, 70A17321, 70A17355
%s, xrefs: 70A17280, 70A17387, 70A173A7

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errnofprintf$fputc$fclose
String ID: %s$%s,%d,0x%x,$_pytransform.c$pytransform.log
API String ID: 1597153534-2792274189
Opcode ID: 965f4bcb16246e92763e2d81b5dff386b5e097a7ed16ec24f2d3a33b0c55399c
Instruction ID: 1bb4ec97db281722209b1fc787afb349fad2dbd8202ebf2bd55b624b51c9fa52
Opcode Fuzzy Hash: 965f4bcb16246e92763e2d81b5dff386b5e097a7ed16ec24f2d3a33b0c55399c
Instruction Fuzzy Hash: 3E919B60B19712E6EA05DB12E910B5D2375BB88BC4F845229ED0E5B36CDF3CFA468306

Uniqueness

Uniqueness Score: -1.00%

Function 70A04590 Relevance: 57.9, APIs: 28, Strings: 5, Instructions: 194stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A04609
_errno.MSVCRT ref: 70A04645
fprintf.MSVCRT ref: 70A04670
fprintf.MSVCRT ref: 70A0467F
fputc.MSVCRT ref: 70A0468C
fclose.MSVCRT ref: 70A04694
fprintf.MSVCRT ref: 70A046B4
fputc.MSVCRT ref: 70A046C8
_errno.MSVCRT ref: 70A0472D
_errno.MSVCRT ref: 70A0476D
_errno.MSVCRT ref: 70A04775
strerror.MSVCRT ref: 70A04779
fprintf.MSVCRT ref: 70A0478B
fprintf.MSVCRT ref: 70A047AF
fprintf.MSVCRT ref: 70A047BE
fputc.MSVCRT ref: 70A047CB
fclose.MSVCRT ref: 70A047D3
fprintf.MSVCRT ref: 70A047F3
fputc.MSVCRT ref: 70A04807
fprintf.MSVCRT ref: 70A0483E

Strings

%s,%d,0x%x,, xrefs: 70A04666, 70A04797, 70A04826, 70A0485D, 70A04894
pytransform.log, xrefs: 70A0462D, 70A04715, 70A04755
wrapper.c, xrefs: 70A0465F, 70A04790, 70A0481F, 70A04856, 70A0488D
%s, xrefs: 70A0477E, 70A048BF, 70A048DF
(O), xrefs: 70A045A9

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fprintf$_errno$fputc$fclose$strerror
String ID: %s$%s,%d,0x%x,$(O)$pytransform.log$wrapper.c
API String ID: 1803879104-71371975
Opcode ID: 912dc521261d1d4f2b0080924e4c6082783260cfc3a337a1380329dcac03b09c
Instruction ID: 805acb5b26305301531e3a2d65506f471216a2fdce9a8898db0420f220212266
Opcode Fuzzy Hash: 912dc521261d1d4f2b0080924e4c6082783260cfc3a337a1380329dcac03b09c
Instruction Fuzzy Hash: B47192A0B19745E9EF049B22FA14B5D2362BB99BC5F40422ADD0E1B368EF7CF505C316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC8F947 Relevance: 52.9, APIs: 16, Strings: 14, Instructions: 446COMMON

Download Yara Rule

Strings

image file format "%s" is unknown, xrefs: 00007FFDFAC8FF3B
%s transparency set: coordinates out of range, xrefs: 00007FFDFAC8FB76
x y, xrefs: 00007FFDFAC8FBB9
unexpected fallthrough, xrefs: 00007FFDFAC8F9B3
PHOTO_FORMAT, xrefs: 00007FFDFAC8FF6C
image file format "%s" has no file writing capability, xrefs: 00007FFDFAC8FF4A
no available image file format has file writing capability, xrefs: 00007FFDFAC8FF2C
coordinates for -from option extend outside image, xrefs: 00007FFDFAC9000A
x y boolean, xrefs: 00007FFDFAC8F9CA
COORDINATES, xrefs: 00007FFDFAC8FBA0
%s transparency get: coordinates out of range, xrefs: 00007FFDFAC8FCF1
can't write image to a file in a safe interpreter, xrefs: 00007FFDFAC8FD1B
fileName ?-option value ...?, xrefs: 00007FFDFAC8F87D
option ?arg ...?, xrefs: 00007FFDFAC8F94F

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID:
String ID: %s transparency get: coordinates out of range$%s transparency set: coordinates out of range$COORDINATES$PHOTO_FORMAT$can't write image to a file in a safe interpreter$coordinates for -from option extend outside image$fileName ?-option value ...?$image file format "%s" has no file writing capability$image file format "%s" is unknown$no available image file format has file writing capability$option ?arg ...?$unexpected fallthrough$x y$x y boolean
API String ID: 0-1379397464
Opcode ID: 2529863ba047459a42e789075fbde15ee5686af9635404dfe46bf265a2024939
Instruction ID: f4017eef75837957525c07fb869b6e7537645ea3876908175bab87746ca24e25
Opcode Fuzzy Hash: 2529863ba047459a42e789075fbde15ee5686af9635404dfe46bf265a2024939
Instruction Fuzzy Hash: 2112A23AB0975686EB188B11D864ABD27A1FB49B94F0481B5CE6E0B7DCEF3CE545C340

Uniqueness

Uniqueness Score: -1.00%

Function 70A141A0 Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 188stringCOMMON

Download Yara Rule

APIs

Part of subcall function 70A024C0: strlen.MSVCRT ref: 70A024DA
Part of subcall function 70A024C0: strlen.MSVCRT ref: 70A024E5
Part of subcall function 70A024C0: malloc.MSVCRT ref: 70A024F1

free.MSVCRT ref: 70A141E9
_errno.MSVCRT ref: 70A1422B
_errno.MSVCRT ref: 70A14233
strerror.MSVCRT ref: 70A14237
_errno.MSVCRT ref: 70A14244
free.MSVCRT ref: 70A1424F
_errno.MSVCRT ref: 70A1428E
free.MSVCRT ref: 70A14299
_errno.MSVCRT ref: 70A142E7
_errno.MSVCRT ref: 70A142EF
strerror.MSVCRT ref: 70A142F3
_errno.MSVCRT ref: 70A14300

Part of subcall function 70A04900: fseek.MSVCRT ref: 70A04954
Part of subcall function 70A04900: malloc.MSVCRT ref: 70A0496E
Part of subcall function 70A04900: fclose.MSVCRT ref: 70A049A3

free.MSVCRT ref: 70A1435A

Strings

Invalid trial license file, size is %d != 256, xrefs: 70A14200
Format trial license file '%s', xrefs: 70A142BC
license.lic, xrefs: 70A141B2, 70A142B5
Read trial license file '%s', xrefs: 70A14260
Get current time failed, xrefs: 70A144B6
Decode trial license failed, xrefs: 70A14434

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$free$mallocstrerrorstrlen$fclosefseek
String ID: Decode trial license failed$Format trial license file '%s'$Get current time failed$Invalid trial license file, size is %d != 256$Read trial license file '%s'$license.lic
API String ID: 1618752535-3017380149
Opcode ID: 75cb3d662776e1ebf4ff81fe213aacc5d17e48e8fb3a14e3ba586cebeb979371
Instruction ID: 930a3c6776f156c1877515d5279a18ea7cf30e822b77bede63db8e56cd96778a
Opcode Fuzzy Hash: 75cb3d662776e1ebf4ff81fe213aacc5d17e48e8fb3a14e3ba586cebeb979371
Instruction Fuzzy Hash: 88711371708646DADB01CB24F9117AD63B2FB88784F944225EA4E43BACEF7CE585C711

Uniqueness

Uniqueness Score: -1.00%

Function 70A042E0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 155stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A04343
_errno.MSVCRT ref: 70A043A5
fprintf.MSVCRT ref: 70A043D0
fprintf.MSVCRT ref: 70A043DF
fprintf.MSVCRT ref: 70A04414
fputc.MSVCRT ref: 70A04428
_errno.MSVCRT ref: 70A04451
_errno.MSVCRT ref: 70A04459
strerror.MSVCRT ref: 70A0445D
fprintf.MSVCRT ref: 70A0446F
fprintf.MSVCRT ref: 70A04493
fprintf.MSVCRT ref: 70A044A2
fputc.MSVCRT ref: 70A044AF
fclose.MSVCRT ref: 70A044B7
fprintf.MSVCRT ref: 70A044D7
fputc.MSVCRT ref: 70A044EB
fprintf.MSVCRT ref: 70A04522

Strings

%s,%d,0x%x,, xrefs: 70A043B8, 70A0447B, 70A0450A, 70A04541
pytransform.log, xrefs: 70A0438D, 70A04439
wrapper.c, xrefs: 70A043B1, 70A04474, 70A04503, 70A0453A
%s, xrefs: 70A04462, 70A0456C
(O), xrefs: 70A042EB

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fprintf$_errno$fputc$fclosestrerror
String ID: %s$%s,%d,0x%x,$(O)$pytransform.log$wrapper.c
API String ID: 775964473-71371975
Opcode ID: e18e1272c58465955a0fb1316aa0f123a6dc247921916cb65b3e378ff617b6cb
Instruction ID: 443e8e53f564d145d799b1cf557eab261b3f419400f85a98dd2c72952ad08cc2
Opcode Fuzzy Hash: e18e1272c58465955a0fb1316aa0f123a6dc247921916cb65b3e378ff617b6cb
Instruction Fuzzy Hash: 4E5171A0719705E9EF049B52FA1476D23A6BB98BC5F40422ADD4D1B368EF7CF506C312

Uniqueness

Uniqueness Score: -1.00%

Function 70A13680 Relevance: 42.3, APIs: 14, Strings: 10, Instructions: 271stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A136AD
strlen.MSVCRT ref: 70A136C6
_errno.MSVCRT ref: 70A137BA
_errno.MSVCRT ref: 70A13998
_errno.MSVCRT ref: 70A139A4
_errno.MSVCRT ref: 70A139DE
_errno.MSVCRT ref: 70A139EC
strerror.MSVCRT ref: 70A139F0
_errno.MSVCRT ref: 70A139FD
_errno.MSVCRT ref: 70A13AC2
strerror.MSVCRT ref: 70A13AC6
_errno.MSVCRT ref: 70A13AD3

Strings

Import rsa key failed, xrefs: 70A1396D
Encode buffer failed, xrefs: 70A13B8A
Dashingsoft Pyshield Project, xrefs: 70A1382A, 70A13902
%s%s, xrefs: 70A1397B, 70A13B44
Could not generate license in trial version, xrefs: 70A139B3
The size of serial number %d > 2048, xrefs: 70A1378C
%c%s, xrefs: 70A13922
The total size of serial number %d > 2560, xrefs: 70A13957
%c%c%c%s, xrefs: 70A13A8A
Sign hash failed, xrefs: 70A13B3D

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$strerrorstrlen
String ID: %c%c%c%s$%c%s$%s%s$Could not generate license in trial version$Dashingsoft Pyshield Project$Encode buffer failed$Import rsa key failed$Sign hash failed$The size of serial number %d > 2048$The total size of serial number %d > 2560
API String ID: 427076510-1296519401
Opcode ID: c329fe3827fef54b7b123c9e03f55592b3520a4cbf69281bef8f24e96dc3b429
Instruction ID: 416187afce5d70c449ab116920cb23c18104a06d9d5715d4986e0b5d9e8f8a87
Opcode Fuzzy Hash: c329fe3827fef54b7b123c9e03f55592b3520a4cbf69281bef8f24e96dc3b429
Instruction Fuzzy Hash: 23C16F72608B8596D720DF11F95078EB3A5F788784F944126EA8E83B6CEF3CD545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 70A13BA0 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 168stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A13BC8
fread.MSVCRT ref: 70A13C3C
fclose.MSVCRT ref: 70A13C47
_errno.MSVCRT ref: 70A13C7F
_errno.MSVCRT ref: 70A13C87
strerror.MSVCRT ref: 70A13C8B
_errno.MSVCRT ref: 70A13C98

Strings

Wrap result failed, xrefs: 70A13D96
Write output %s failed, xrefs: 70A13DE6
Open public key %s failed, xrefs: 70A13CE0
Invalid public key %s, xrefs: 70A13C58
Encode moudle key failed, xrefs: 70A13D40

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$fclosefreadstrerror
String ID: Encode moudle key failed$Invalid public key %s$Open public key %s failed$Wrap result failed$Write output %s failed
API String ID: 1423157237-2416068227
Opcode ID: 55db8fb90700d6ff3c9b0e5344c78331ce39158535a9258064b489322013a972
Instruction ID: 33515db0b70ae701f86a07a38838bd38b59afe21dddc52d46ba282719d696971
Opcode Fuzzy Hash: 55db8fb90700d6ff3c9b0e5344c78331ce39158535a9258064b489322013a972
Instruction Fuzzy Hash: 0F51DF22B15746A5EA01DF52F91079E23A4FB89BC4F840126EE4E5776CEF3CE686C341

Uniqueness

Uniqueness Score: -1.00%

Function 70A0EC00 Relevance: 38.6, APIs: 18, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 70A04900: fseek.MSVCRT ref: 70A04954
Part of subcall function 70A04900: malloc.MSVCRT ref: 70A0496E
Part of subcall function 70A04900: fclose.MSVCRT ref: 70A049A3

_errno.MSVCRT ref: 70A0EC60

Strings

%s,%d,0x%x,, xrefs: 70A0ECBE, 70A0ED9C
pytransform.log, xrefs: 70A0EC7C
utils.c, xrefs: 70A0ECB7, 70A0ED95
%s, xrefs: 70A0ECA5

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errnofclosefseekmalloc
String ID: %s$%s,%d,0x%x,$pytransform.log$utils.c
API String ID: 882899668-4272501623
Opcode ID: 00ab74ad02e025a31693e3314fb5883291eceee1359ff899981b4beb1bdb1360
Instruction ID: 7ff95dd6d7ef1c57135f4a5d2a50e3532d06407c11647e499c4f9fe7a73093cc
Opcode Fuzzy Hash: 00ab74ad02e025a31693e3314fb5883291eceee1359ff899981b4beb1bdb1360
Instruction Fuzzy Hash: 6441C361715209E9FA01DB52FE50BAD23A1BF98BC4F84422A9D0D573A8EF3CF505C305

Uniqueness

Uniqueness Score: -1.00%

Function 70A18B90 Relevance: 36.9, APIs: 9, Strings: 12, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.MSVCRT ref: 70A18BE2
fprintf.MSVCRT ref: 70A18C72
fclose.MSVCRT ref: 70A18C7A
_strdup.MSVCRT ref: 70A18CA5

Strings

__armor_exit__, xrefs: 70A18D4B
__armor_wrap%s__, xrefs: 70A18D95
__armor__, xrefs: 70A18D66
pytransform.log, xrefs: 70A18C3C, 70A18DE8
__pyarmor__, xrefs: 70A18D11
__armor_enter__, xrefs: 70A18D30
__pyarmor%s__, xrefs: 70A18D0A
__armor_exit%s__, xrefs: 70A18D44
little, xrefs: 70A18BF0
__armor_wrap__, xrefs: 70A18D9C
__armor_enter%s__, xrefs: 70A18D29
__armor%s__, xrefs: 70A18D5F

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _strdup$fclosefprintf
String ID: __armor%s__$__armor__$__armor_enter%s__$__armor_enter__$__armor_exit%s__$__armor_exit__$__armor_wrap%s__$__armor_wrap__$__pyarmor%s__$__pyarmor__$little$pytransform.log
API String ID: 2840409039-221964360
Opcode ID: 8df971dc2556e92d7f00076b5f4740f1aa481678c7a4da0365175499cdd3e438
Instruction ID: f15c05001ba333f1b7e9291657e74d480686af157944bf12f0423a5bcc00a5cb
Opcode Fuzzy Hash: 8df971dc2556e92d7f00076b5f4740f1aa481678c7a4da0365175499cdd3e438
Instruction Fuzzy Hash: 8451E261B19702E9FB118B61ED907992365BB487D8F84413ADD0E873A8DB3CF986C352

Uniqueness

Uniqueness Score: -1.00%

Function 70A13E60 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 182stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A13E7F
fread.MSVCRT ref: 70A13EBB
fclose.MSVCRT ref: 70A13EC6

Part of subcall function 70A0A420: malloc.MSVCRT ref: 70A0A43D

free.MSVCRT ref: 70A13F1C
_errno.MSVCRT ref: 70A13FD4
_time64.MSVCRT ref: 70A14052
free.MSVCRT ref: 70A140FA
free.MSVCRT ref: 70A14127

Strings

key/iv size is %d, it must be 32., xrefs: 70A1402A
%s is not a legal public key, xrefs: 70A13ED2
Failed to encode trial license., xrefs: 70A14180
Fail to write trial license file %s, xrefs: 70A13FA1
%.0f, xrefs: 70A14090
This function is not included in trial version, xrefs: 70A13F2E

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: free$_errno_time64fclosefreadmallocstrlen
String ID: %.0f$%s is not a legal public key$Fail to write trial license file %s$Failed to encode trial license.$This function is not included in trial version$key/iv size is %d, it must be 32.
API String ID: 710462250-180510518
Opcode ID: 73e3db438a481b56c4e9731b84eb9e098af7a5017deba72e788a528791d53fe8
Instruction ID: 964df151b8e8e220bf49e089259e60b8dd644538b9e4ba386c7f9c7078909683
Opcode Fuzzy Hash: 73e3db438a481b56c4e9731b84eb9e098af7a5017deba72e788a528791d53fe8
Instruction Fuzzy Hash: EF612821B1574699DB11DB25E90179E63B4FB89B84F844222EE4E47B6CEF3CE586C300

Uniqueness

Uniqueness Score: -1.00%

Function 70A106D0 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 93stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A10722
fprintf.MSVCRT ref: 70A10744
fclose.MSVCRT ref: 70A1074C
_errno.MSVCRT ref: 70A10751
_errno.MSVCRT ref: 70A1075A
strerror.MSVCRT ref: 70A1075F
fprintf.MSVCRT ref: 70A1077F
_errno.MSVCRT ref: 70A10784

Strings

pytransform.log, xrefs: 70A10707
%s,%d,%s, xrefs: 70A1072F, 70A107E5
%s, xrefs: 70A10772, 70A107C3, 70A1080E

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno$fprintf$fclosestrerror
String ID: %s$%s,%d,%s$pytransform.log
API String ID: 190382524-2823618119
Opcode ID: 93a5a0c07d549ce71ee43f4bc77aef7159f97b429231196b3d5bb4582a56cfb0
Instruction ID: d19d642611ce647108502ef8c731c564c91e78096b704cae0a38ee823b592ef2
Opcode Fuzzy Hash: 93a5a0c07d549ce71ee43f4bc77aef7159f97b429231196b3d5bb4582a56cfb0
Instruction Fuzzy Hash: CC319F6171560299EA14AF12FD50F6C33A1BB89BC4F948139ED0D9B368DF6CF904C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC28B30 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC1EAF0: GetDC.USER32 ref: 00007FFDFAC1EB22
Part of subcall function 00007FFDFAC1EAF0: SelectPalette.GDI32 ref: 00007FFDFAC1EBB9
Part of subcall function 00007FFDFAC1EAF0: RealizePalette.GDI32 ref: 00007FFDFAC1EBC5
Part of subcall function 00007FFDFAC1EAF0: GetBkMode.GDI32(?,?,00000000,00007FFDFAC1F5D1), ref: 00007FFDFAC1EBD1

SetBkColor.GDI32 ref: 00007FFDFAC28B65
SetTextColor.GDI32 ref: 00007FFDFAC28B71
CreateCompatibleDC.GDI32 ref: 00007FFDFAC28B7A
LoadBitmapW.USER32 ref: 00007FFDFAC28B8D
SelectObject.GDI32 ref: 00007FFDFAC28B9C
GetMapMode.GDI32 ref: 00007FFDFAC28BA5
SetMapMode.GDI32 ref: 00007FFDFAC28BB0
GetObjectA.GDI32 ref: 00007FFDFAC28BC3
DPtoLP.GDI32 ref: 00007FFDFAC28BF0
DPtoLP.GDI32 ref: 00007FFDFAC28C0F
BitBlt.GDI32 ref: 00007FFDFAC28CBD
DeleteDC.GDI32 ref: 00007FFDFAC28CC6
DeleteObject.GDI32 ref: 00007FFDFAC28CCF
SetBkMode.GDI32 ref: 00007FFDFAC28CDC
SelectPalette.GDI32 ref: 00007FFDFAC28CF0
RealizePalette.GDI32 ref: 00007FFDFAC28CF9
ReleaseDC.USER32 ref: 00007FFDFAC28D0E
DeleteDC.GDI32 ref: 00007FFDFAC28D1E

Strings

, xrefs: 00007FFDFAC28C94

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: ModePalette$DeleteObjectSelect$ColorRealize$BitmapCompatibleCreateLoadReleaseText
String ID:
API String ID: 1475033899-3916222277
Opcode ID: 33306c416681d0770880daa52499e857684fb4a26a55eafa6f18e963fa911cde
Instruction ID: 8d69baa0cec30e36dccab7cd5315050c2047c351d9d536c4709f11cdfd2c294d
Opcode Fuzzy Hash: 33306c416681d0770880daa52499e857684fb4a26a55eafa6f18e963fa911cde
Instruction Fuzzy Hash: 5551813670868297EB589F25E864B6D77A5FB88B80F044178EE5947B9CDF3CE449C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACE8C30 Relevance: 33.3, APIs: 18, Strings: 1, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC1EAF0: GetDC.USER32 ref: 00007FFDFAC1EB22
Part of subcall function 00007FFDFAC1EAF0: SelectPalette.GDI32 ref: 00007FFDFAC1EBB9
Part of subcall function 00007FFDFAC1EAF0: RealizePalette.GDI32 ref: 00007FFDFAC1EBC5
Part of subcall function 00007FFDFAC1EAF0: GetBkMode.GDI32(?,?,00000000,00007FFDFAC1F5D1), ref: 00007FFDFAC1EBD1

GetSysColorBrush.USER32 ref: 00007FFDFACE8C6C
SelectObject.GDI32 ref: 00007FFDFACE8C78
GetSysColor.USER32 ref: 00007FFDFACE8C86
GetSysColor.USER32 ref: 00007FFDFACE8C93
SetTextColor.GDI32 ref: 00007FFDFACE8C9E
SetBkColor.GDI32 ref: 00007FFDFACE8CAC
GetSysColor.USER32 ref: 00007FFDFACE8CBA
GetSysColor.USER32 ref: 00007FFDFACE8CC4
SelectObject.GDI32 ref: 00007FFDFACE8CD4
PatBlt.GDI32 ref: 00007FFDFACE8CFE
SetBkColor.GDI32 ref: 00007FFDFACE8D0A
SetTextColor.GDI32 ref: 00007FFDFACE8D16
SelectObject.GDI32 ref: 00007FFDFACE8D22
SetBkMode.GDI32 ref: 00007FFDFACE8D2F
SelectPalette.GDI32 ref: 00007FFDFACE8D43
RealizePalette.GDI32 ref: 00007FFDFACE8D4C
ReleaseDC.USER32 ref: 00007FFDFACE8D60
DeleteDC.GDI32 ref: 00007FFDFACE8D70

Strings

!, xrefs: 00007FFDFACE8CE2

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Color$Select$Palette$Object$ModeRealizeText$BrushDeleteRelease
String ID: !
API String ID: 929154361-2657877971
Opcode ID: 74db29e47652b0ec1cae5c2bb3b31d901934d4b19b0445aebc86e2175192a1dd
Instruction ID: f7376b23a233dd4c9713edfbd71a7d36bdec61213cc84aadd0d83af225ea83d5
Opcode Fuzzy Hash: 74db29e47652b0ec1cae5c2bb3b31d901934d4b19b0445aebc86e2175192a1dd
Instruction Fuzzy Hash: 4141FE35B0874192EB189B12A96493DA3A5FF89FD0F104075EE5A47BA8DF3CE485C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A37790 Relevance: 30.2, APIs: 16, Strings: 4, Instructions: 243COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A37868
malloc.MSVCRT ref: 70A37875
malloc.MSVCRT ref: 70A37882
malloc.MSVCRT ref: 70A3788F
free.MSVCRT ref: 70A37911
free.MSVCRT ref: 70A3791B
free.MSVCRT ref: 70A37925
free.MSVCRT ref: 70A3792F
free.MSVCRT ref: 70A37946
free.MSVCRT ref: 70A37958
free.MSVCRT ref: 70A3796A
free.MSVCRT ref: 70A37986
memset.MSVCRT ref: 70A37A4C
memcpy.MSVCRT ref: 70A37A6A
memcpy.MSVCRT ref: 70A37B32
memcpy.MSVCRT ref: 70A37B4E

Strings

msghash != NULL, xrefs: 70A37AF2
outlen != NULL, xrefs: 70A37AC0
out != NULL, xrefs: 70A37AD9
src/pk/pkcs1/pkcs_1_pss_encode.c, xrefs: 70A37AB9, 70A37AD2, 70A37AEB

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: free$malloc$memcpy$memset
String ID: msghash != NULL$out != NULL$outlen != NULL$src/pk/pkcs1/pkcs_1_pss_encode.c
API String ID: 4204908464-4182795421
Opcode ID: 793346ffb8a766f300c6dfe722e163a9a6beeea80b95d464faaa077a152f0940
Instruction ID: bc8ee3992a74ba7107c35ab1353fcb23de458d038c3bba864d6b844b455ae4b1
Opcode Fuzzy Hash: 793346ffb8a766f300c6dfe722e163a9a6beeea80b95d464faaa077a152f0940
Instruction Fuzzy Hash: BB91C07231868486DB61CB56E85576EF7A4F78ABC4F80411AEE8B97B2CDF38D445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACD88B0 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 351stringCOMMON

Download Yara Rule

APIs

isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD88D7
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD88E8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD892F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD895E
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD8977
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD8993
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD89DD
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD8A32
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD8AB6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD8B07
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFACD6CA4), ref: 00007FFDFACD8C4E

Strings

any, xrefs: 00007FFDFACD89CC
wordstart, xrefs: 00007FFDFACD8C44
lineend, xrefs: 00007FFDFACD8A28
wordend, xrefs: 00007FFDFACD8AFD
display, xrefs: 00007FFDFACD891B
linestart, xrefs: 00007FFDFACD8AAC

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: strncmp$isspace$isalnum
String ID: any$display$lineend$linestart$wordend$wordstart
API String ID: 270981566-2289065215
Opcode ID: 43c3ca002127a0b781721a223f691616cd55894588506aa0169181a415b53017
Instruction ID: ea3ee61f260e835097af0e5ec66c48d16a40f481eb9b59ed879b4b1eeb12d97b
Opcode Fuzzy Hash: 43c3ca002127a0b781721a223f691616cd55894588506aa0169181a415b53017
Instruction Fuzzy Hash: EEE1A069B0868286EB588F26D8A0B7D77A1FB44B84F4444B5DA7D5BBC8EF7CF4508700

Uniqueness

Uniqueness Score: -1.00%

Function 70A21F40 Relevance: 29.8, APIs: 12, Strings: 5, Instructions: 80stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A21FA5
_errno.MSVCRT ref: 70A21FAD
strerror.MSVCRT ref: 70A21FB1
fprintf.MSVCRT ref: 70A21FC3
fprintf.MSVCRT ref: 70A21FE7
fprintf.MSVCRT ref: 70A21FF6
fputc.MSVCRT ref: 70A22003
fclose.MSVCRT ref: 70A2200B
fprintf.MSVCRT ref: 70A2202B
fputc.MSVCRT ref: 70A2203F
_errno.MSVCRT ref: 70A22044

Strings

%s,%d,0x%x,, xrefs: 70A21FCF, 70A2206B
pytransform.log, xrefs: 70A21F7C
_pytransform.c, xrefs: 70A21FC8, 70A22064
(iii), xrefs: 70A21F53
%s, xrefs: 70A21FB6

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fprintf$_errno$fputc$fclosestrerror
String ID: %s$%s,%d,0x%x,$(iii)$_pytransform.c$pytransform.log
API String ID: 775964473-1072082768
Opcode ID: 70661684ba1b26f9ab01d0a1dc81501ee04e80534cb4dd379aabe13916287f6b
Instruction ID: 5be3b13954aa4861e7396b24ac19b2420183732b2b47dc4903de0db726178dbc
Opcode Fuzzy Hash: 70661684ba1b26f9ab01d0a1dc81501ee04e80534cb4dd379aabe13916287f6b
Instruction Fuzzy Hash: 44316D60B29611A5EB049B25F911BA923A1BB98BC5F8442369D0D1B3A8DF3CF506C715

Uniqueness

Uniqueness Score: -1.00%

Function 70A173C0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 70A17454

Strings

%s,%d,0x%x,, xrefs: 70A174A2, 70A17555
pytransform.log, xrefs: 70A17477
_pytransform.c, xrefs: 70A1749B, 70A1754E
%s, xrefs: 70A17529

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _errno
String ID: %s$%s,%d,0x%x,$_pytransform.c$pytransform.log
API String ID: 2918714741-2792274189
Opcode ID: da910fc67629ffbd093e54d7988a5d23c43f9099cce52fa61df74b39babf3782
Instruction ID: d101ad0d357833b7a55e9eb0dd126358c979390e200278e919f04a2ee92782be
Opcode Fuzzy Hash: da910fc67629ffbd093e54d7988a5d23c43f9099cce52fa61df74b39babf3782
Instruction Fuzzy Hash: E7418A61B1875596EB01DB12F84075D6775FB98BC4F804226EE8D07768EF3CE946C702

Uniqueness

Uniqueness Score: -1.00%

Function 70A11350 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 85stringCOMMON

Download Yara Rule

APIs

Part of subcall function 70A0DA10: free.MSVCRT ref: 70A0DA6F

_errno.MSVCRT ref: 70A113A6
_errno.MSVCRT ref: 70A113CF
_errno.MSVCRT ref: 70A113D7
strerror.MSVCRT ref: 70A113DB
fprintf.MSVCRT ref: 70A113ED
fprintf.MSVCRT ref: 70A11411
fprintf.MSVCRT ref: 70A11420
fputc.MSVCRT ref: 70A1142D
fclose.MSVCRT ref: 70A11435
fprintf.MSVCRT ref: 70A11455
fputc.MSVCRT ref: 70A11469
fprintf.MSVCRT ref: 70A114A0

Strings

%s,%d,0x%x,, xrefs: 70A113F9, 70A11488
pytransform.log, xrefs: 70A113B7
license.c, xrefs: 70A113F2, 70A11481
%s, xrefs: 70A113E0

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fprintf$_errno$fputc$fclosefreestrerror
String ID: %s$%s,%d,0x%x,$license.c$pytransform.log
API String ID: 1153345444-4157288542
Opcode ID: ffc7b84cf68f5d6564801d4922fabe33b1b8921e3d97d9bc228ab911f2538b19
Instruction ID: 59b2ad19078fdce73386e30f8942dac979d3965d47049c73e007880d6cfea187
Opcode Fuzzy Hash: ffc7b84cf68f5d6564801d4922fabe33b1b8921e3d97d9bc228ab911f2538b19
Instruction Fuzzy Hash: 52319160719702DAEE059B22EA1175D2365BB88BC4F44422ADD0D4B7ACEF3CF545C312

Uniqueness

Uniqueness Score: -1.00%

Function 70A96810 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A9682B
GetModuleFileNameW.KERNEL32 ref: 70A96873
_snwprintf.MSVCRT ref: 70A9689E
MessageBoxW.USER32 ref: 70A968C2

Strings

Assertion failed!Program: %wsFile: %ws, Line %uExpression: %ws, xrefs: 70A9687D
<unknown>, xrefs: 70A96840, 70A968E0, 70A96900
j > 0, xrefs: 70A96812
%ws, xrefs: 70A9692F
MinGW Runtime Assertion, xrefs: 70A968B8
protect.c, xrefs: 70A96813

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: FileMessageModuleName_snwprintfmalloc
String ID: %ws$<unknown>$Assertion failed!Program: %wsFile: %ws, Line %uExpression: %ws$MinGW Runtime Assertion$j > 0$protect.c
API String ID: 2604804178-2804858100
Opcode ID: 0c98c8e727a6f753afaa3e636ce7d2923a9dbc9a68d3f2aed557cb5397344333
Instruction ID: 5787a52ffbc75a8637399529ff8c9b8e70a65f880686d386e60bd3ad021811dd
Opcode Fuzzy Hash: 0c98c8e727a6f753afaa3e636ce7d2923a9dbc9a68d3f2aed557cb5397344333
Instruction Fuzzy Hash: B721F13172961488EB019B11EA613AD22F9BF4CBC0F844139E94E573A8EF3CE641C388

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC2DB90 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 269windowCOMMON

Download Yara Rule

APIs

SetClassLongPtrW.USER32 ref: 00007FFDFAC2DCBF
SetClassLongPtrW.USER32 ref: 00007FFDFAC2DD2A
SetClassLongPtrW.USER32 ref: 00007FFDFAC2DD84
SendMessageW.USER32 ref: 00007FFDFAC2DE73

Part of subcall function 00007FFDFAC2D9B0: GetModuleHandleW.KERNEL32 ref: 00007FFDFAC2DA57
Part of subcall function 00007FFDFAC2D9B0: GetModuleHandleW.KERNEL32 ref: 00007FFDFAC2DA8D
Part of subcall function 00007FFDFAC2D9B0: LoadIconW.USER32 ref: 00007FFDFAC2DAA4
Part of subcall function 00007FFDFAC2D9B0: LoadCursorW.USER32 ref: 00007FFDFAC2DB12
Part of subcall function 00007FFDFAC2D9B0: RegisterClassW.USER32 ref: 00007FFDFAC2DB22

SendMessageW.USER32 ref: 00007FFDFAC2DEE1
SendMessageW.USER32 ref: 00007FFDFAC2DF39

Strings

window "%s" isn't a top-level window, xrefs: 00007FFDFAC2DBD7
FAILED, xrefs: 00007FFDFAC2DCA4
ICON, xrefs: 00007FFDFAC2DE2C
WRAPPER, xrefs: 00007FFDFAC2DE20
Can't set icon; window has no wrapper., xrefs: 00007FFDFAC2DE02
TOPLEVEL, xrefs: 00007FFDFAC2DBF8
LOOKUP, xrefs: 00007FFDFAC2DC06
Unable to set icon, xrefs: 00007FFDFAC2DC86

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Class$LongMessageSend$HandleLoadModule$CursorIconRegister
String ID: Can't set icon; window has no wrapper.$FAILED$ICON$LOOKUP$TOPLEVEL$Unable to set icon$WRAPPER$window "%s" isn't a top-level window
API String ID: 3636279047-342970489
Opcode ID: 854c596ea71265061a4489fc13cb56823549bd8b264f0f9e279564c418067a80
Instruction ID: 304448b090f7864b7affbf5cf59735c21f6efaef92e737995308f1faf6a9f544
Opcode Fuzzy Hash: 854c596ea71265061a4489fc13cb56823549bd8b264f0f9e279564c418067a80
Instruction Fuzzy Hash: 09B18F29B08A4681FB6D8F11E464ABD27A4FBA5B84F085176DE2E477D9DF3CE441C310

Uniqueness

Uniqueness Score: -1.00%

Function 70A34490 Relevance: 22.9, APIs: 15, Instructions: 378COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 70A3464D
calloc.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,70A338A4), ref: 70A34687
qsort.MSVCRT ref: 70A348A9
memcpy.MSVCRT ref: 70A348BC
memcpy.MSVCRT ref: 70A348FF
memcpy.MSVCRT ref: 70A34935
memcpy.MSVCRT ref: 70A34950
memcpy.MSVCRT ref: 70A3496B

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: memcpy$calloc$qsort
String ID:
API String ID: 3784193592-0
Opcode ID: eea4dcc1b1766315c20184de3c126d1b323d1820373a2326a198f5f8baf229de
Instruction ID: a8ec1e3f234de6d6990665c818d5027dc79e2da4feb304e1080aec3cd94cc6ec
Opcode Fuzzy Hash: eea4dcc1b1766315c20184de3c126d1b323d1820373a2326a198f5f8baf229de
Instruction Fuzzy Hash: 9AD134B2B152A08BC706CF11DC55A9EFBA6F74AB89FC64415EE470B308DB79E985C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A2F0D0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 319COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 70A2F310
calloc.MSVCRT ref: 70A2F327
free.MSVCRT ref: 70A2F368
free.MSVCRT ref: 70A2F370

Strings

A != NULL, xrefs: 70A2F827
B != NULL, xrefs: 70A2F80E
modulus != NULL, xrefs: 70A2F7AA
src/pk/ecc/ltc_ecc_mul2add.c, xrefs: 70A2F7A3, 70A2F7BC, 70A2F7D5, 70A2F7EE, 70A2F807, 70A2F820
kB != NULL, xrefs: 70A2F7C3
src/pk/ecc/ltc_ecc_map.c, xrefs: 70A2F27A
P != NULL, xrefs: 70A2F281
kA != NULL, xrefs: 70A2F7DC
C != NULL, xrefs: 70A2F7F5

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: callocfree
String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
API String ID: 306872129-190324370
Opcode ID: 27edf32e618178c68a0a8c805d55978fe828b4e89b600f518f0640cfbc82661e
Instruction ID: 9984e4fd40495c354f216ec38a63e9e0e38cfc1ee22220bd7bb7dd72a4154ef6
Opcode Fuzzy Hash: 27edf32e618178c68a0a8c805d55978fe828b4e89b600f518f0640cfbc82661e
Instruction Fuzzy Hash: 49C19932608A81CADB60DF62E91479EA765F7C8BD6F414036EE8E97718EF78D844C740

Uniqueness

Uniqueness Score: -1.00%

Function 70A30FC0 Relevance: 21.3, APIs: 9, Strings: 5, Instructions: 254COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A3109C
free.MSVCRT ref: 70A310F4
malloc.MSVCRT ref: 70A3112C
free.MSVCRT ref: 70A31181
free.MSVCRT ref: 70A3118B
memcmp.MSVCRT ref: 70A3127D
memcmp.MSVCRT ref: 70A31442
memcmp.MSVCRT ref: 70A3146B
free.MSVCRT ref: 70A31480

Strings

hash != NULL, xrefs: 70A31262
src/pk/rsa/rsa_verify_hash.c, xrefs: 70A31210, 70A31229, 70A31242, 70A3125B
key != NULL, xrefs: 70A31217
sig != NULL, xrefs: 70A31249
stat != NULL, xrefs: 70A31230

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: free$memcmp$malloc
String ID: hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
API String ID: 2896619906-237625700
Opcode ID: 1513067dbd231cfc08e0b63403cad73201954a3f75dd7e6908e7040c72d69427
Instruction ID: 9f772e92b6d4e25c7928f97a1c5bce61baa1eefe74c7ef371a86ec995fe98713
Opcode Fuzzy Hash: 1513067dbd231cfc08e0b63403cad73201954a3f75dd7e6908e7040c72d69427
Instruction Fuzzy Hash: DBB18C722086848AD720CF51E54479EF7A5F389BC8F904229EE8A5BB1CDB7DE945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC77B60 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 394stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,00000000,?,00000000,00007FFDFAC74488), ref: 00007FFDFAC77BC2
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,00000000,00007FFDFAC74488), ref: 00007FFDFAC77BD1

Strings

FONT, xrefs: 00007FFDFAC78114
FONT_STYLE, xrefs: 00007FFDFAC780B7
normal, xrefs: 00007FFDFAC77D82
unknown font style "%s", xrefs: 00007FFDFAC78089
font "%s" doesn't exist, xrefs: 00007FFDFAC780F1
underline, xrefs: 00007FFDFAC77F03
LOOKUP, xrefs: 00007FFDFAC780C7, 00007FFDFAC78124
overstrike, xrefs: 00007FFDFAC77FC2
roman, xrefs: 00007FFDFAC77E43

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: isspacestrchr
String ID: FONT$FONT_STYLE$LOOKUP$font "%s" doesn't exist$normal$overstrike$roman$underline$unknown font style "%s"
API String ID: 2446454806-3998826473
Opcode ID: 2c922afe8f19234197c38261dfecdb65bb56e7c30e1d089a20187d9484067c09
Instruction ID: 49c7e944c0e53e5147e76adb7486b8cca032634361401813874899a2683da616
Opcode Fuzzy Hash: 2c922afe8f19234197c38261dfecdb65bb56e7c30e1d089a20187d9484067c09
Instruction Fuzzy Hash: 7A026239B08B4695EB588B22E560ABD37B1FB45B84F4444B2DE2D43798EF3CE595C340

Uniqueness

Uniqueness Score: -1.00%

Function 70A30310 Relevance: 18.5, APIs: 2, Strings: 10, Instructions: 483COMMON

Download Yara Rule

Strings

ltc_mp.name != NULL, xrefs: 70A307D1
size > 0, xrefs: 70A30A25
in != NULL, xrefs: 70A30803
src/pk/rsa/rsa_import.c, xrefs: 70A307CA, 70A307E3, 70A307FC
src/pk/rsa/rsa_free.c, xrefs: 70A30364
ltc_mp.name != NULL, xrefs: 70A30A0C
key != NULL, xrefs: 70A3036B
key != NULL, xrefs: 70A309F3
key != NULL, xrefs: 70A307EA
src/pk/rsa/rsa_make_key.c, xrefs: 70A309EC, 70A30A05, 70A30A1E

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID: in != NULL$key != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_free.c$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
API String ID: 0-606996012
Opcode ID: 619baa5842662c6f1f3f82f69ff1c91a137a83eed2446d5362273241b09cf924
Instruction ID: 286936b4738a7848b0615287925369aca64c1aa5b2c3a288379e50c106d8443a
Opcode Fuzzy Hash: 619baa5842662c6f1f3f82f69ff1c91a137a83eed2446d5362273241b09cf924
Instruction Fuzzy Hash: B1221972208B85C6E760CF22E45478EB7A4F788B98F504126EE8E87B5CDF79D585CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACC3C50 Relevance: 18.3, APIs: 7, Strings: 5, Instructions: 342stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACC3CFE
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFACC3D26
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFACC3D42
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACC3D8A
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFACC3DEF
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACC3F4D
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFACC3FB2

Part of subcall function 00007FFDFACD68E0: strrchr.VCRUNTIME140 ref: 00007FFDFACD69D4
Part of subcall function 00007FFDFACD68E0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACD6A01
Part of subcall function 00007FFDFACD68E0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACD6A68

Strings

forwbytes, xrefs: 00007FFDFACC3D80
insert, xrefs: 00007FFDFACC40EF
byteindex, xrefs: 00007FFDFACC3CF4
backbytes, xrefs: 00007FFDFACC3F43
%s %d, xrefs: 00007FFDFACC411A

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: strncmp$atoi$strrchr
String ID: %s %d$backbytes$byteindex$forwbytes$insert
API String ID: 834745059-3026567289
Opcode ID: bd93bea2065a910beb9891c9f9ca063c13a2c081c23be5a75d2308c6e3bfffcd
Instruction ID: b5a3db9af0e30f0183052809e000862107acd7c19534e841665e668ddb426ffa
Opcode Fuzzy Hash: bd93bea2065a910beb9891c9f9ca063c13a2c081c23be5a75d2308c6e3bfffcd
Instruction Fuzzy Hash: 3CE17F2AB05B8285EB18CB25D564ABD77B1FB84F88F1580B5CE2D47798DF39E451C340

Uniqueness

Uniqueness Score: -1.00%

Function 70A95760 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,70A01278), ref: 70A9588D

Strings

Unknown pseudo relocation protocol version %d., xrefs: 70A95A0E
Unknown pseudo relocation bit size %d., xrefs: 70A959FA

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 67276921af4edec6daa396d0bc490a36be5ef5f29907ee46fc5e4460ccf124c5
Instruction ID: c83cbbca61abc0343ffc357c7b21320b78f2b36ac401b92930a9324d27570f9a
Opcode Fuzzy Hash: 67276921af4edec6daa396d0bc490a36be5ef5f29907ee46fc5e4460ccf124c5
Instruction Fuzzy Hash: 1B91F631B302548AEF158775D98274D63E2BB4D7A4F948619CE1E877ACEA3DD981C30C

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC23AE0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FFDFAC23B2B
SelectObject.GDI32 ref: 00007FFDFAC23B3A
GetTextMetricsW.GDI32 ref: 00007FFDFAC23B4E
GetTextFaceW.GDI32 ref: 00007FFDFAC23B64
GetCharWidthW.GDI32 ref: 00007FFDFAC23D35
GetCharWidthA.GDI32 ref: 00007FFDFAC23D3D
SelectObject.GDI32 ref: 00007FFDFAC23D5B
ReleaseDC.USER32 ref: 00007FFDFAC23D67

Strings

utf-16, xrefs: 00007FFDFAC23CE8
unicode, xrefs: 00007FFDFAC23D0A

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: CharObjectSelectTextWidth$FaceMetricsRelease
String ID: unicode$utf-16
API String ID: 1149465119-3317161374
Opcode ID: 961de23ea4c5f2ecaef7b85a45c49f30771c95694528759ce66e49853ab82aec
Instruction ID: 155f7c752b182c092d458d9ea6b741665b3372b0094652f49d0df6d62f74310e
Opcode Fuzzy Hash: 961de23ea4c5f2ecaef7b85a45c49f30771c95694528759ce66e49853ab82aec
Instruction Fuzzy Hash: CB718176B08A8686EB25CF26E8606AD77A4FB48F84F044276DE6D47798EF3CD045C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACE48F0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137stringCOMMON

Download Yara Rule

APIs

isdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00007FFDFACE4969
isdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00007FFDFACE497F
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00007FFDFACE49A4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00007FFDFACE49CA
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACE4AB8

Strings

DISPLAY, xrefs: 00007FFDFACE4A2C
couldn't connect to display "%s", xrefs: 00007FFDFACE4A02
SCREEN_NUMBER, xrefs: 00007FFDFACE4AF3
CONNECT, xrefs: 00007FFDFACE4A1E
bad screen number "%d", xrefs: 00007FFDFACE4AD8

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: isdigit$strncmpstrncpystrtoul
String ID: CONNECT$DISPLAY$SCREEN_NUMBER$bad screen number "%d"$couldn't connect to display "%s"
API String ID: 686723514-808091287
Opcode ID: 1befb55b73b5d02b4dea64e71ef93cd18b5f45140a9165e1b5287a42c7e0a581
Instruction ID: 9412391b46117530ffda5a4bf3bdf69f9cc0b2a4696e82025323492f6b634e94
Opcode Fuzzy Hash: 1befb55b73b5d02b4dea64e71ef93cd18b5f45140a9165e1b5287a42c7e0a581
Instruction Fuzzy Hash: 69519625B08B8691EB489F21E96066D77A4FB44F98F488075DE6D07398EF3DE995C300

Uniqueness

Uniqueness Score: -1.00%

Function 70A2D5C0 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 70A2D5EB
strcmp.MSVCRT ref: 70A2D615
strcmp.MSVCRT ref: 70A2D634
strcmp.MSVCRT ref: 70A2D653
strcmp.MSVCRT ref: 70A2D672
strcmp.MSVCRT ref: 70A2D68D
strcmp.MSVCRT ref: 70A2D6A8
strcmp.MSVCRT ref: 70A2D6C3

Strings

3des, xrefs: 70A2D5C3
src/misc/crypt/crypt_find_hash.c, xrefs: 70A2D6F1
name != NULL, xrefs: 70A2D6F8

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strcmp
String ID: 3des$name != NULL$src/misc/crypt/crypt_find_hash.c
API String ID: 1004003707-2898822856
Opcode ID: 17bda9a5e38040ede557d212e29a991edcc59bbe9c69e27a0e2e80992a905be9
Instruction ID: 1479c84d9f0e53a92b50dbddb3bc64bdaab9f095d159dea93e6e426f8b3a5c1d
Opcode Fuzzy Hash: 17bda9a5e38040ede557d212e29a991edcc59bbe9c69e27a0e2e80992a905be9
Instruction Fuzzy Hash: 6731666335228649DF15DA62A7A47BD6361FF88BC6F004139ED1F8F959EF18E509C310

Uniqueness

Uniqueness Score: -1.00%

Function 70A226B0 Relevance: 16.6, APIs: 11, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI ref: 70A226E4
inet_ntoa.WS2_32 ref: 70A22725
GetProcessHeap.KERNEL32 ref: 70A22740
HeapFree.KERNEL32 ref: 70A2274A
GetProcessHeap.KERNEL32 ref: 70A22767
HeapFree.KERNEL32 ref: 70A22778
GetProcessHeap.KERNEL32 ref: 70A2277E
HeapAlloc.KERNEL32 ref: 70A22788
GetAdaptersAddresses.IPHLPAPI ref: 70A227AB

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesFree$Allocinet_ntoa
String ID:
API String ID: 1708681428-0
Opcode ID: b98aee25327f76b748025f518f80e528aeb961a8c75e6496a976b9377e69ce13
Instruction ID: c3daa0c0a45f5abd77befb96f94072ea2ede413f78865f5b60c1b89ef6072f75
Opcode Fuzzy Hash: b98aee25327f76b748025f518f80e528aeb961a8c75e6496a976b9377e69ce13
Instruction Fuzzy Hash: 1021D3217186509AD7049BA6FD11B1E62A6BBCDB95F088235AD0D577A8DF38E5418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC7CBF0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC7D1F0: GetCursorPos.USER32 ref: 00007FFDFAC7D29C

GetCursorPos.USER32 ref: 00007FFDFAC7CC76
ReleaseCapture.USER32 ref: 00007FFDFAC7CD8B
SetCapture.USER32 ref: 00007FFDFAC7CDF6
LoadCursorW.USER32 ref: 00007FFDFAC7CEA3
SetCursor.USER32 ref: 00007FFDFAC7CEB1
GetCursorPos.USER32 ref: 00007FFDFAC7CF70

Strings

grab failed: another application has grab, xrefs: 00007FFDFAC7CC9C
GRABBED, xrefs: 00007FFDFAC7CCC1
GRAB, xrefs: 00007FFDFAC7CCCA

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Cursor$Capture$LoadRelease
String ID: GRAB$GRABBED$grab failed: another application has grab
API String ID: 209116553-3878467564
Opcode ID: acb7bee412237a80310ae0f2a5e4a33bf95e42c4bb0994947d6ec757e8847094
Instruction ID: 0aab0475de4bb0637cda1e2e57e2173505581117d8400cba3373ff9d44382d37
Opcode Fuzzy Hash: acb7bee412237a80310ae0f2a5e4a33bf95e42c4bb0994947d6ec757e8847094
Instruction Fuzzy Hash: AAC1493A709A4286EB68CF15E460ABD77A0FB88B84F4445B6DB6D47798EF3CE4548700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC2CB30 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 190COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32 ref: 00007FFDFAC2CBCB

Strings

(scrollbar command), xrefs: 00007FFDFAC2CE26
ScrollbarProc called on an invalid HWND, xrefs: 00007FFDFAC2CB6F
scroll, xrefs: 00007FFDFAC2CD52, 00007FFDFAC2CD9B
moveto, xrefs: 00007FFDFAC2CD2C
units, xrefs: 00007FFDFAC2CDD3
pages, xrefs: 00007FFDFAC2CD8B

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: CallProcWindow
String ID: (scrollbar command)$ScrollbarProc called on an invalid HWND$moveto$pages$scroll$units
API String ID: 2714655100-2948507982
Opcode ID: 3627fdd6183671aed720f68ce8f2394935fb6ebbde061c6333592c1f14c098e2
Instruction ID: 95add96e294b122ee8e663249fac78a76d089181a363266dfea0a59c32d20701
Opcode Fuzzy Hash: 3627fdd6183671aed720f68ce8f2394935fb6ebbde061c6333592c1f14c098e2
Instruction Fuzzy Hash: 8A919036B08A5681EB588B15E864ABD27B1FB85B80F4440B6DE2D477E8EF7DE415C340

Uniqueness

Uniqueness Score: -1.00%

Function 70A14CF0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 189stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 70A14D29
strrchr.MSVCRT ref: 70A14D70
strrchr.MSVCRT ref: 70A14DF8
strrchr.MSVCRT ref: 70A14E6D
strrchr.MSVCRT ref: 70A14E8C
strrchr.MSVCRT ref: 70A14F02

Strings

__init__.py, xrefs: 70A14D43, 70A14E0E, 70A14E7A
<frozen %s, xrefs: 70A14EE2

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strrchr
String ID: <frozen %s$__init__.py
API String ID: 3418686817-1237021342
Opcode ID: bbc7994d83aee2c31e706521893ec7228d2d1d535aed39df0037f7a74b32eceb
Instruction ID: 872b417d666911d851596a35b7c82b46761c69ce0f78d2813fb695a20d09c74e
Opcode Fuzzy Hash: bbc7994d83aee2c31e706521893ec7228d2d1d535aed39df0037f7a74b32eceb
Instruction Fuzzy Hash: E0512A123056955AEF118F26E5007AD6771B789FC8F884425EE4E1778CFB7CD686C314

Uniqueness

Uniqueness Score: -1.00%

Function 70A95CB0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 70A95D09
signal.MSVCRT ref: 70A95D62
signal.MSVCRT ref: 70A95DBE
signal.MSVCRT ref: 70A95E73

Strings

CCG , xrefs: 70A95CC5

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 1d0cb62066153b77727612b7b50d8dcb26671ddbe4a430b0e696f3b5fff60354
Instruction ID: 47fed1c9436f48ea1437853e556a1def360e88535748a9ef0533c580238d3028
Opcode Fuzzy Hash: 1d0cb62066153b77727612b7b50d8dcb26671ddbe4a430b0e696f3b5fff60354
Instruction Fuzzy Hash: 12314F307315044AFF5992B9456632D11E69B8E338F258629DA2BCB3FCED199DC0031E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC36BC0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 78registryCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FFDFAC36BF4
memset.VCRUNTIME140 ref: 00007FFDFAC36C40
RegOpenKeyExW.ADVAPI32 ref: 00007FFDFAC36C66
RegQueryValueExW.ADVAPI32 ref: 00007FFDFAC36C99
RegCloseKey.ADVAPI32 ref: 00007FFDFAC36CA4

Strings

Control Panel\Appearance, xrefs: 00007FFDFAC36C58
Current, xrefs: 00007FFDFAC36C7F
Windows Standard, xrefs: 00007FFDFAC36CB9
Windows NT is the only supported platform, xrefs: 00007FFDFAC36C08

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: CloseOpenQueryValueVersionmemset
String ID: Control Panel\Appearance$Current$Windows NT is the only supported platform$Windows Standard
API String ID: 4230551253-4106789390
Opcode ID: 32895b9195ccff5c3f303fae0a74719c3b72cf119b0fa215543f19509577a4dd
Instruction ID: 493330728c74302bfe536ba75ed3a0cf69c2e91a9197bfa1e14e03571066e40b
Opcode Fuzzy Hash: 32895b9195ccff5c3f303fae0a74719c3b72cf119b0fa215543f19509577a4dd
Instruction Fuzzy Hash: F5415E35B0868282FB688B14E875BBA73A4FB94754F800175E6AD077E9EF7DD145CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A2DA40 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 70A2DA73
memcmp.MSVCRT ref: 70A2DA93
memcmp.MSVCRT ref: 70A2DAB5
memcmp.MSVCRT ref: 70A2DAD5
memcmp.MSVCRT ref: 70A2DAF5
memcmp.MSVCRT ref: 70A2DB15
memcmp.MSVCRT ref: 70A2DB35
memcmp.MSVCRT ref: 70A2DB55

Strings

src/misc/crypt/crypt_register_hash.c, xrefs: 70A2DCA7
hash != NULL, xrefs: 70A2DCAE

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: memcmp
String ID: hash != NULL$src/misc/crypt/crypt_register_hash.c
API String ID: 1475443563-1465673959
Opcode ID: 260e42ce48444bb2bd22005100616deab472049bb68104e6cd1f3f5cbce349f2
Instruction ID: 7cc980dc135ddb0b3a46b706f71e90c7739df354b158d60b3276b08ce6fafcc0
Opcode Fuzzy Hash: 260e42ce48444bb2bd22005100616deab472049bb68104e6cd1f3f5cbce349f2
Instruction Fuzzy Hash: 4061AE3330075486D714CB26E994B9E73A8F748BD8F118029DF8A87B68DF39E95AC354

Uniqueness

Uniqueness Score: -1.00%

Function 70A2DCD0 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 70A2DD03
memcmp.MSVCRT ref: 70A2DD20
memcmp.MSVCRT ref: 70A2DD42
memcmp.MSVCRT ref: 70A2DD62
memcmp.MSVCRT ref: 70A2DD82
memcmp.MSVCRT ref: 70A2DDA2
memcmp.MSVCRT ref: 70A2DDC2
memcmp.MSVCRT ref: 70A2DDE2

Strings

prng != NULL, xrefs: 70A2DF06
src/misc/crypt/crypt_register_prng.c, xrefs: 70A2DEFF

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: memcmp
String ID: prng != NULL$src/misc/crypt/crypt_register_prng.c
API String ID: 1475443563-58737364
Opcode ID: 459dcdc2fa02f87d4296b62e1ea01cad54d5515d110e42ce3730b2095f469880
Instruction ID: ec431e3f3a1f1c50b9758e5dda9c6ae3d57e5d08c281df82ef9f5edcf64f1df5
Opcode Fuzzy Hash: 459dcdc2fa02f87d4296b62e1ea01cad54d5515d110e42ce3730b2095f469880
Instruction Fuzzy Hash: 9D518D33340A949AD710CF12EA84B9E7369FB98BC5F424039DF5A8B654EB38E549C710

Uniqueness

Uniqueness Score: -1.00%

Function 70A2D710 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 70A2D73B
strcmp.MSVCRT ref: 70A2D75F
strcmp.MSVCRT ref: 70A2D77B
strcmp.MSVCRT ref: 70A2D79A
strcmp.MSVCRT ref: 70A2D7B9
strcmp.MSVCRT ref: 70A2D7D4
strcmp.MSVCRT ref: 70A2D7EF
strcmp.MSVCRT ref: 70A2D80A

Strings

src/misc/crypt/crypt_find_prng.c, xrefs: 70A2D838
name != NULL, xrefs: 70A2D83F

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strcmp
String ID: name != NULL$src/misc/crypt/crypt_find_prng.c
API String ID: 1004003707-2030105502
Opcode ID: b2abfc6059d250dcdbdd5cb5cf3954ec282682f8af4ef2a9d8e4da86dc26cfe8
Instruction ID: d0371638aeb6a0958fd36a2c3fb3ab8718aea3d798e29509e3ec2371ee7f08c4
Opcode Fuzzy Hash: b2abfc6059d250dcdbdd5cb5cf3954ec282682f8af4ef2a9d8e4da86dc26cfe8
Instruction Fuzzy Hash: 3E31956734268689DE15DB62A7E43BD6361EF89BC6F0041389E0B8F94DEB18E506C350

Uniqueness

Uniqueness Score: -1.00%

Function 70A2D470 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 70A2D49B
strcmp.MSVCRT ref: 70A2D4C5
strcmp.MSVCRT ref: 70A2D4E4
strcmp.MSVCRT ref: 70A2D503
strcmp.MSVCRT ref: 70A2D522
strcmp.MSVCRT ref: 70A2D53D
strcmp.MSVCRT ref: 70A2D558
strcmp.MSVCRT ref: 70A2D573

Strings

name != NULL, xrefs: 70A2D5A8
src/misc/crypt/crypt_find_cipher.c, xrefs: 70A2D5A1

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strcmp
String ID: name != NULL$src/misc/crypt/crypt_find_cipher.c
API String ID: 1004003707-679692990
Opcode ID: 38309888a37da56a2906ed14cd3bc46d000e856524f8997045342d775a3ee526
Instruction ID: 57d97bd02e617bb078ea4ea57e64aa04c7a6596b90a23db098b8c4c37301e0e3
Opcode Fuzzy Hash: 38309888a37da56a2906ed14cd3bc46d000e856524f8997045342d775a3ee526
Instruction Fuzzy Hash: 1131B76334218649EF14DA52ABE07FD6361EFC87CAF0045389E0B8F94DEB24E905C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC6FAE6 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 74stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC6FB63

Strings

TCL, xrefs: 00007FFDFAC6FC05
scan option, xrefs: 00007FFDFAC6FBDA
mark|dragto x, xrefs: 00007FFDFAC6FAF6
dragto, xrefs: 00007FFDFAC6FB93
INDEX, xrefs: 00007FFDFAC6FBEB
LOOKUP, xrefs: 00007FFDFAC6FBF7
bad scan option "%s": must be mark or dragto, xrefs: 00007FFDFAC6FBBE
mark, xrefs: 00007FFDFAC6FB59

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: strncmp
String ID: INDEX$LOOKUP$TCL$bad scan option "%s": must be mark or dragto$dragto$mark$mark|dragto x$scan option
API String ID: 1114863663-1778636316
Opcode ID: 8129b89911cf1e014397200d6aad25a4c43d7c66f181e0dee386c3388b073f5e
Instruction ID: 9cf7d7c602881da882ff4d0d0b2b209690d6766380442006e65ab4420b21dedf
Opcode Fuzzy Hash: 8129b89911cf1e014397200d6aad25a4c43d7c66f181e0dee386c3388b073f5e
Instruction Fuzzy Hash: F2318F69B08A4691E718CB21E860ABC27A0FB44B94F0481B2CD7E433D8EF7DE155C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC53AF0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 178stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FFDFAC53BA9
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC53BFA
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC53DAA

Strings

FONTMAP, xrefs: 00007FFDFAC53C88
Symbol, xrefs: 00007FFDFAC53BF0, 00007FFDFAC53D9A
/%s findfont %d scalefont%s setfont, xrefs: 00007FFDFAC53C2D, 00007FFDFAC53DCF
ISOEncode, xrefs: 00007FFDFAC53C08, 00007FFDFAC53DBA
CANVAS, xrefs: 00007FFDFAC53CAB
bad font map entry for "%s": "%s", xrefs: 00007FFDFAC53C6F

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: _strnicmp$strchr
String ID: ISOEncode$/%s findfont %d scalefont%s setfont$CANVAS$FONTMAP$Symbol$bad font map entry for "%s": "%s"
API String ID: 1737111242-3406053624
Opcode ID: db29e8f8edaacdf31afc2b49bfcbc427a55fc21ddd54826393cd905d9ffec45b
Instruction ID: 73d86495091a5ee84060b9dd6402356f431ee3c4dcc9495d0ce4496aa25f6a78
Opcode Fuzzy Hash: db29e8f8edaacdf31afc2b49bfcbc427a55fc21ddd54826393cd905d9ffec45b
Instruction Fuzzy Hash: 29919135708B8695EB098B11E864AAA6360FF89FC4F458172DE2E13799FF7CE155C300

Uniqueness

Uniqueness Score: -1.00%

Function 70A3CCC0 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A3CD33
malloc.MSVCRT ref: 70A3CD3D

Strings

mask != NULL, xrefs: 70A3CF09
src/pk/pkcs1/pkcs_1_mgf1.c, xrefs: 70A3CEE9, 70A3CF02
seed != NULL, xrefs: 70A3CEF0

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: malloc
String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
API String ID: 2803490479-2931318352
Opcode ID: 2d6f0b5ace908e6c7d30c0f094871fcd9b21c935f8e860460c789a04730c1863
Instruction ID: 62f09c8fb4ba796de6f823f5abf0b2a5c0274718124e9232830b081ee4fba419
Opcode Fuzzy Hash: 2d6f0b5ace908e6c7d30c0f094871fcd9b21c935f8e860460c789a04730c1863
Instruction Fuzzy Hash: 065136337092944ADB26CB32AD0476EEF62EB49BC4F984118DE574BA0CEB39E905C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC26C40 Relevance: 13.7, APIs: 9, Instructions: 156keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32 ref: 00007FFDFAC26C77
MapVirtualKeyW.USER32 ref: 00007FFDFAC26CA5
memset.VCRUNTIME140 ref: 00007FFDFAC26CC3
ToUnicode.USER32 ref: 00007FFDFAC26D4D
ToUnicode.USER32 ref: 00007FFDFAC26D76
VkKeyScanW.USER32 ref: 00007FFDFAC26D90
MapVirtualKeyW.USER32 ref: 00007FFDFAC26DA5
memset.VCRUNTIME140 ref: 00007FFDFAC26DBA
GetKeyState.USER32 ref: 00007FFDFAC26E4F

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Virtual$Unicodememset$ScanState
String ID:
API String ID: 988457538-0
Opcode ID: 84393eed155a1d4e998c1026bfed084c0454a11fbd3677f47a6cee7c557f1de7
Instruction ID: 373fefbd1f5bb401df67b41656b1cadea18efb32b6553bd8cf2ce2ebd00da004
Opcode Fuzzy Hash: 84393eed155a1d4e998c1026bfed084c0454a11fbd3677f47a6cee7c557f1de7
Instruction Fuzzy Hash: 0E51C226B0C6928AF7188B15D420B7DB7E1FF85754F4800B6FAE9476C9CE7DD8458720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC5EAF0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 408COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FFDFAC5EDDF

Part of subcall function 00007FFDFAC2B7D0: CreateBitmap.GDI32 ref: 00007FFDFAC2B888
Part of subcall function 00007FFDFAC2B7D0: GetDC.USER32 ref: 00007FFDFAC2B8D0
Part of subcall function 00007FFDFAC2B7D0: CreateDIBSection.GDI32 ref: 00007FFDFAC2B8F2
Part of subcall function 00007FFDFAC2B7D0: ReleaseDC.USER32 ref: 00007FFDFAC2B901
Part of subcall function 00007FFDFAC2B7D0: GetLastError.KERNEL32 ref: 00007FFDFAC2B91F
Part of subcall function 00007FFDFAC2B7D0: FormatMessageW.KERNEL32 ref: 00007FFDFAC2B948
Part of subcall function 00007FFDFAC2B7D0: MessageBoxW.USER32 ref: 00007FFDFAC2B964
Part of subcall function 00007FFDFAC2B7D0: LocalFree.KERNEL32 ref: 00007FFDFAC2B96F

Strings

", xrefs: 00007FFDFAC5F143
GC already registered in Tk_GetGC, xrefs: 00007FFDFAC5EDBA
bad scrollRegion "%s", xrefs: 00007FFDFAC5EFBB
CANVAS, xrefs: 00007FFDFAC5EFF0
called GCInit after GCCleanup, xrefs: 00007FFDFAC5EBBE
SCROLL_REGION, xrefs: 00007FFDFAC5EFE4

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: CreateMessage$BitmapDeleteErrorFormatFreeLastLocalObjectReleaseSection
String ID: "$CANVAS$GC already registered in Tk_GetGC$SCROLL_REGION$bad scrollRegion "%s"$called GCInit after GCCleanup
API String ID: 1892380217-3500747879
Opcode ID: a224852b7291a93833fdbdbcc73af4b1a0d1e4603b5c23f1a8318e97c88c59f1
Instruction ID: 582598e921e87ff383965a55860ef888dc4e8677046766e715b118154c244f01
Opcode Fuzzy Hash: a224852b7291a93833fdbdbcc73af4b1a0d1e4603b5c23f1a8318e97c88c59f1
Instruction Fuzzy Hash: DE226ABAB04B868AE718CF25E850AAD37B1FB48B88F044176DE6D57798DF38E454C740

Uniqueness

Uniqueness Score: -1.00%

Function 70A06D50 Relevance: 12.5, APIs: 3, Strings: 5, Instructions: 485COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 70A06EF9
memcpy.MSVCRT ref: 70A07035

Strings

obfmode.c, xrefs: 70A07450
<lambda>, xrefs: 70A06DF0
code, xrefs: 70A07457
The function '%s' could not be obufscated with advanced mode 2, insert one redundant line '[None, None]' at the beginning of this function to fix it, xrefs: 70A072FA
lambda_, xrefs: 70A06E13

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: memcpy
String ID: <lambda>$The function '%s' could not be obufscated with advanced mode 2, insert one redundant line '[None, None]' at the beginning of this function to fix it$code$lambda_$obfmode.c
API String ID: 3510742995-709486575
Opcode ID: 503032d764b40375dc8c4a7543e0c4219453fae51b0f939bca72a95dd7092d79
Instruction ID: 944573f31036e29d6e57291945717955bfa8a8e2e84d8052f6551d7903a13771
Opcode Fuzzy Hash: 503032d764b40375dc8c4a7543e0c4219453fae51b0f939bca72a95dd7092d79
Instruction Fuzzy Hash: F812C372F08A84C6EB11CB25F94476E77A1F789B94F508216EE4A47B6CEB3CD545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A07980 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 275stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 70A07A25
strlen.MSVCRT ref: 70A07A35

Strings

obfmode.c, xrefs: 70A07DC0, 70A07DE0
<lambda>, xrefs: 70A079D5
code, xrefs: 70A07DC7
lambda_, xrefs: 70A079F8
co_names, xrefs: 70A07DE7

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strlenstrstr
String ID: <lambda>$co_names$code$lambda_$obfmode.c
API String ID: 2393776628-2864150894
Opcode ID: 4298df55d908ae6b00c1bc4abce4757f28cf3a7f0bca63ceb2e4e976d9f295b4
Instruction ID: 5174a9ef9fe5e4dc51255108baa1c244eab3fc32d16ef77fe7032d1365121389
Opcode Fuzzy Hash: 4298df55d908ae6b00c1bc4abce4757f28cf3a7f0bca63ceb2e4e976d9f295b4
Instruction Fuzzy Hash: 9CB1BC62B19B88D5EB11CB22F94076D67A1FB49BC4F444216DE8E87B68EF3CE645C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A30BE0 Relevance: 12.2, APIs: 3, Strings: 5, Instructions: 196COMMON

Download Yara Rule

Strings

out != NULL, xrefs: 70A30FAD
in != NULL, xrefs: 70A30F94
outlen != NULL, xrefs: 70A30F7B
src/pk/rsa/rsa_sign_hash.c, xrefs: 70A30F5B, 70A30F74, 70A30F8D, 70A30FA6
key != NULL, xrefs: 70A30F62

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID: in != NULL$key != NULL$out != NULL$outlen != NULL$src/pk/rsa/rsa_sign_hash.c
API String ID: 0-3034240082
Opcode ID: 45570e4ae22f66940c7348c420c7c94138e889c65236d1f12c4a3a6eed4092d3
Instruction ID: 4456b59188f1691b94ac0d6f82a27fa2ea331e733a37cc94e0ce282ede889d3f
Opcode Fuzzy Hash: 45570e4ae22f66940c7348c420c7c94138e889c65236d1f12c4a3a6eed4092d3
Instruction Fuzzy Hash: 8F8148726086C48AD734CF11E594B9EB7A4F388784F90422AEE8A97B5CDB3DE544CF40

Uniqueness

Uniqueness Score: -1.00%

Function 70A334C0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 70A33531
free.MSVCRT ref: 70A3362F

Strings

public_key_len != NULL, xrefs: 70A336C0
src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c, xrefs: 70A336B9, 70A336D2, 70A336EB
inlen != 0, xrefs: 70A336D9
in != NULL, xrefs: 70A336F2

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
API String ID: 306872129-3913984646
Opcode ID: 186b2dc5410d6226bc7dd81e21015910bff1a069d77905cba36ac49a889fa2c2
Instruction ID: 715d0dec13e00e256bb0e4845aad1ddc1f0027f22fdbd89583179ed8a96c80d9
Opcode Fuzzy Hash: 186b2dc5410d6226bc7dd81e21015910bff1a069d77905cba36ac49a889fa2c2
Instruction Fuzzy Hash: 1D417672B092C0DAE7318F12F9917CBB7A5F798384F80411A9A8987B9CDB7DD549CB40

Uniqueness

Uniqueness Score: -1.00%

Function 70A03940 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 70A039A1
sprintf.MSVCRT ref: 70A03A02
sprintf.MSVCRT ref: 70A03A1D

Strings

__pyarmor__, xrefs: 70A03953, 70A039B5
', %d), xrefs: 70A03A10
%s%s, xrefs: 70A039BC
(__name__, __file__, b', xrefs: 70A039AE
\x%02x, xrefs: 70A039D6

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: sprintf$malloc
String ID: %s%s$', %d)$(__name__, __file__, b'$\x%02x$__pyarmor__
API String ID: 1197820334-965320081
Opcode ID: e658fb96e59b2df53869f410621bb053eae9d2dfa1ce9c5a368bddbb9554b61e
Instruction ID: 17f8eabeeaebb658e161cbccb45316386a7e11430fe04fbbceef8e12ced14e52
Opcode Fuzzy Hash: e658fb96e59b2df53869f410621bb053eae9d2dfa1ce9c5a368bddbb9554b61e
Instruction Fuzzy Hash: 8721F327B65619A6DB04CB16AE1079D2355FB4CBD8F848221DE4E93328EA3CF44BC300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC55C10 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

GC already registered in Tk_GetGC, xrefs: 00007FFDFAC56059
called GCInit after GCCleanup, xrefs: 00007FFDFAC55E3A

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID:
String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup
API String ID: 0-2292843906
Opcode ID: 444a8ce9472df13be2cfb54a1060bb30f96c22e03de8a4b11dfd15f2623f6e7a
Instruction ID: 0e77c7cd1e8e04d3b49a3f0afdd1f607e4ce7e874445f146296b295b0ebbd2aa
Opcode Fuzzy Hash: 444a8ce9472df13be2cfb54a1060bb30f96c22e03de8a4b11dfd15f2623f6e7a
Instruction Fuzzy Hash: 94027776B04B858AE754CF24E854BAD73A5FB48B88F144176DEAD47798EF38E490C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A95560 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 70A9560B

Strings

VirtualProtect failed with code 0x%x, xrefs: 70A956EA
Address %p has no image-section, xrefs: 70A95749
VirtualQuery failed for %d bytes at address %p, xrefs: 70A95738

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-2123141913
Opcode ID: 4f020e01b341bace898f75bec590f55d9cc10b1bef5ba748662d257ba5edb19b
Instruction ID: 9274b2413f9a278cc1776aaad984eec909cb725b4ad131abdde4dcc0b6736b09
Opcode Fuzzy Hash: 4f020e01b341bace898f75bec590f55d9cc10b1bef5ba748662d257ba5edb19b
Instruction Fuzzy Hash: 3551BF76B21B40C6DB118F36E94279D77F1B748BA4F888225DE1E073A8DB38DA41C708

Uniqueness

Uniqueness Score: -1.00%

Function 70A96950 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A9696D
_stat64.MSVCRT ref: 70A969BB
malloc.MSVCRT ref: 70A96AD3
_stat64.MSVCRT ref: 70A96AFB
free.MSVCRT ref: 70A96B10

Strings

<unknown>, xrefs: 70A96955

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: _stat64$freemallocstrlen
String ID: <unknown>
API String ID: 2817875163-1574992787
Opcode ID: debb15bdf632e113f2cd644e7ae1ce8b25df67f3bf693bd74081b1d8aebc9f68
Instruction ID: cda43fdfdc26301d64b1cddae84ea05d977de089e3a0e5af88a0318a5aa49d91
Opcode Fuzzy Hash: debb15bdf632e113f2cd644e7ae1ce8b25df67f3bf693bd74081b1d8aebc9f68
Instruction Fuzzy Hash: C751CE6232969088DB11CF21915032E7BF6EF89BD4F54C016EAC607B5CE73EC849D749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC58B60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC58BF5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC58C1A

Strings

smoothMethod, xrefs: 00007FFDFAC58BC2
ambiguous smooth method "%s", xrefs: 00007FFDFAC58C71
SMOOTH, xrefs: 00007FFDFAC58C94
bezier, xrefs: 00007FFDFAC58BEB
LOOKUP, xrefs: 00007FFDFAC58CA0

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: strncmp
String ID: LOOKUP$SMOOTH$ambiguous smooth method "%s"$bezier$smoothMethod
API String ID: 1114863663-1216440562
Opcode ID: 0e19764866daa2702ed14f13722d941757b3c121b2be37f1c9f151b50428c1c2
Instruction ID: 568fef9e2a6c0179c7e8558a1e5469f6a0b03a0dd151f3eb6893c67638491b8f
Opcode Fuzzy Hash: 0e19764866daa2702ed14f13722d941757b3c121b2be37f1c9f151b50428c1c2
Instruction Fuzzy Hash: 9741A766B09B8685EB548F11AC20AAA73A4FB45B94F4840B5EE6D477DCEF3CF095C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC168F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFAC1694E
CreateWindowExW.USER32 ref: 00007FFDFAC1699D
SetWindowPos.USER32 ref: 00007FFDFAC169C7
SetWindowLongPtrW.USER32 ref: 00007FFDFAC169DF

Strings

BUTTON, xrefs: 00007FFDFAC1690E
STATIC, xrefs: 00007FFDFAC16919

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Window$CreateHandleLongModule
String ID: BUTTON$STATIC
API String ID: 4115577067-3385952364
Opcode ID: 857e6716b15ef4890199d9618cffe4b0cb858dea5ec010925580daf5bbc2fd1a
Instruction ID: 9b7d7c6d47cc5fb49a89adbbd565dda762b849bf6a339c116cf56d31104f333e
Opcode Fuzzy Hash: 857e6716b15ef4890199d9618cffe4b0cb858dea5ec010925580daf5bbc2fd1a
Instruction Fuzzy Hash: F031F936708B82CBE754CF25E850A5AB7E4FB48B94F144179EA9D93B68DF3CD4518B00

Uniqueness

Uniqueness Score: -1.00%

Function 70A0EE30 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 220COMMON

Download Yara Rule

Strings

This function could not be called from the plain script, xrefs: 70A0F167
obfmode.c, xrefs: 70A0F180
code, xrefs: 70A0F187
Internal buffer error, xrefs: 70A0F1F8

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID: Internal buffer error$This function could not be called from the plain script$code$obfmode.c
API String ID: 0-1583419685
Opcode ID: 6fbaed465aca04e74330eabee2dd240c55de23c56023c7a14980b930b84c0666
Instruction ID: bc497ab70437a1493618343c93e776d5b38f465a72e4a48d32615412fa8b1d3a
Opcode Fuzzy Hash: 6fbaed465aca04e74330eabee2dd240c55de23c56023c7a14980b930b84c0666
Instruction Fuzzy Hash: CDA17C32A19A09E5EB15CF15F98436A3360F749B85F804216DE4E87B28EF3CDA85C700

Uniqueness

Uniqueness Score: -1.00%

Function 70A22F50 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 70A22FF4
strlen.MSVCRT ref: 70A23006
sprintf.MSVCRT ref: 70A23030

Strings

platforms/windows/hdinfo.c, xrefs: 70A2307C
/%d:, xrefs: 70A22FDB, 70A22FED
No any serial number of harddisk got, xrefs: 70A23075

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: sprintf$strlen
String ID: /%d:$No any serial number of harddisk got$platforms/windows/hdinfo.c
API String ID: 3793847852-3769243694
Opcode ID: 3a2ba334b1e53a30d99cff912c5635a5ae08b3b93a1053080f0b52ae43f6180b
Instruction ID: d5e8c916c6d8f894e49bf41f13f21fa1e6242f8206bd0003e7c0705a5ee6266d
Opcode Fuzzy Hash: 3a2ba334b1e53a30d99cff912c5635a5ae08b3b93a1053080f0b52ae43f6180b
Instruction Fuzzy Hash: 1031A263F190506DE7018A39FE103AD6722A7CABE2F588231DD26477DCD53D89D6C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACE8A90 Relevance: 9.1, APIs: 6, Instructions: 86windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC1EAF0: GetDC.USER32 ref: 00007FFDFAC1EB22
Part of subcall function 00007FFDFAC1EAF0: SelectPalette.GDI32 ref: 00007FFDFAC1EBB9
Part of subcall function 00007FFDFAC1EAF0: RealizePalette.GDI32 ref: 00007FFDFAC1EBC5
Part of subcall function 00007FFDFAC1EAF0: GetBkMode.GDI32(?,?,00000000,00007FFDFAC1F5D1), ref: 00007FFDFAC1EBD1

DrawFocusRect.USER32 ref: 00007FFDFACE8B8D
SetBkMode.GDI32 ref: 00007FFDFACE8B9A
SelectPalette.GDI32 ref: 00007FFDFACE8BAE
RealizePalette.GDI32 ref: 00007FFDFACE8BB7
ReleaseDC.USER32 ref: 00007FFDFACE8BCB
DeleteDC.GDI32 ref: 00007FFDFACE8BDB

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$ModeRealizeSelect$DeleteDrawFocusRectRelease
String ID:
API String ID: 3871974525-0
Opcode ID: fcd740503da37f46fc30cb85a02c9fd5c60acea4150deef6258b165ca1ff1cc1
Instruction ID: e3f5832a32586ca56db9ce4ddd03ef0308998cb68f095da19dc754ccaf6e5e6b
Opcode Fuzzy Hash: fcd740503da37f46fc30cb85a02c9fd5c60acea4150deef6258b165ca1ff1cc1
Instruction Fuzzy Hash: 5F315E6671868586EB54CB16E89156EB360FF99B80F105035FE9E43B9CEF3CE480CB00

Uniqueness

Uniqueness Score: -1.00%

Function 70A04900 Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

fseek.MSVCRT ref: 70A04954
malloc.MSVCRT ref: 70A0496E
fclose.MSVCRT ref: 70A049A3
fclose.MSVCRT ref: 70A049C3
fclose.MSVCRT ref: 70A049E0
free.MSVCRT ref: 70A049EA

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: fclose$freefseekmalloc
String ID:
API String ID: 1339445139-0
Opcode ID: bdde35ee8796addad0175677f85182633c053b95d2ff1f0f9c2c269a999da576
Instruction ID: ebf56b3dd9eb5082c7addbd7c0d0b507daa696bf7fff19d89a5f318a4546b021
Opcode Fuzzy Hash: bdde35ee8796addad0175677f85182633c053b95d2ff1f0f9c2c269a999da576
Instruction Fuzzy Hash: 9B11A7527222150CEA69AB6B7F0236E42929F89BE1F0C4635BE5E4775CFC78A5818344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC1EAF0 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FFDFAC1EB22
SelectPalette.GDI32 ref: 00007FFDFAC1EBB9
RealizePalette.GDI32 ref: 00007FFDFAC1EBC5
GetBkMode.GDI32(?,?,00000000,00007FFDFAC1F5D1), ref: 00007FFDFAC1EBD1

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$ModeRealizeSelect
String ID:
API String ID: 3073415821-0
Opcode ID: 8faf9f438d025fe2bd8a4773709f3ddb629765b6099fa91ef73b37f93b971014
Instruction ID: 4147cc22820549a547746e2f619f07e9973b2cb4e302f3189664b371d20a1feb
Opcode Fuzzy Hash: 8faf9f438d025fe2bd8a4773709f3ddb629765b6099fa91ef73b37f93b971014
Instruction Fuzzy Hash: C831486AB04B8191EB58CB12E8A466DA364FB49FC0F185076DE2E43798DF3CD4918300

Uniqueness

Uniqueness Score: -1.00%

Function 70A024C0 Relevance: 9.0, APIs: 3, Strings: 3, Instructions: 40stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A024DA
strlen.MSVCRT ref: 70A024E5
malloc.MSVCRT ref: 70A024F1

Strings

license.lic, xrefs: 70A024C1, 70B2B6D5
\, xrefs: 70A0250A
%s%c%s, xrefs: 70A024FE

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strlen$malloc
String ID: %s%c%s$\$license.lic
API String ID: 3157260142-3068191871
Opcode ID: fedfa1928038d3d6c2651c61c0037678d7da86a14c0fbf6ad4b4bc5f6088cf00
Instruction ID: 81c669a5276c4021c51a3705f84525ec7244f4d5615107f6c1cab23a112e2202
Opcode Fuzzy Hash: fedfa1928038d3d6c2651c61c0037678d7da86a14c0fbf6ad4b4bc5f6088cf00
Instruction Fuzzy Hash: C8F0242275634888ED12CB06FE0029DA7986F89BE4F8C41309E0E0776CFA3CE6868304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACA9BB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121stringCOMMON

Download Yara Rule

APIs

strtod.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,00007FFDFACA99ED), ref: 00007FFDFACA9CB2
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FFDFACA99ED), ref: 00007FFDFACA9CD3

Strings

DISTANCE, xrefs: 00007FFDFACA9D6A
VALUE, xrefs: 00007FFDFACA9D71
bad screen distance "%s", xrefs: 00007FFDFACA9D47

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: isspacestrtod
String ID: DISTANCE$VALUE$bad screen distance "%s"
API String ID: 858613365-734856420
Opcode ID: 9608efa178057eb0e039078f2c0cea755728ddd1bdf66e081a630d6b1312a190
Instruction ID: 9f852081681c2449ad26959ecabf3e0a260d5e8a8a4ec7044679a504efe82181
Opcode Fuzzy Hash: 9608efa178057eb0e039078f2c0cea755728ddd1bdf66e081a630d6b1312a190
Instruction Fuzzy Hash: 8E51A37AB08B8581EB188F15E87067E67A1EB85B94F048172D96D4B3E8DF7CD485C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC7BAF0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 135stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC7BC6A

Strings

ANCHOR, xrefs: 00007FFDFAC7BCB4
VALUE, xrefs: 00007FFDFAC7BCBB
bad anchor position "%s": must be n, ne, e, se, s, sw, w, nw, or center, xrefs: 00007FFDFAC7BC91
center, xrefs: 00007FFDFAC7BC60

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: strncmp
String ID: ANCHOR$VALUE$bad anchor position "%s": must be n, ne, e, se, s, sw, w, nw, or center$center
API String ID: 1114863663-721106602
Opcode ID: 8a4b7aa398e730576e94f7e79a9aeb929ffe7e71e4cc73c2a58456585924f421
Instruction ID: a72c586406f53609b5b8612091db80da444afabf66e588908b3fce8ac761912f
Opcode Fuzzy Hash: 8a4b7aa398e730576e94f7e79a9aeb929ffe7e71e4cc73c2a58456585924f421
Instruction Fuzzy Hash: 6451AF7AF0C68185EB448B29F02076DB7A0E745B98F4881B2DBAC433DDDE2DD4D68B04

Uniqueness

Uniqueness Score: -1.00%

Function 70A326E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

N != NULL, xrefs: 70A3282D
src/math/rand_prime.c, xrefs: 70A32826

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID: N != NULL$src/math/rand_prime.c
API String ID: 0-3192267683
Opcode ID: 451d90f03c2737fbaac7a9971a0d27de19ebab07170825ba31841a2fedaa90ad
Instruction ID: 998ee52b6b36e58258165d10d2910a950db4739e62d88d72547ad8ff1f22cf79
Opcode Fuzzy Hash: 451d90f03c2737fbaac7a9971a0d27de19ebab07170825ba31841a2fedaa90ad
Instruction Fuzzy Hash: 8631F4327042448AE7259B16F80075EAA65BB49BD8F844135EE4B4BBACEB3CE946C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC14A80 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC1EAF0: GetDC.USER32 ref: 00007FFDFAC1EB22
Part of subcall function 00007FFDFAC1EAF0: SelectPalette.GDI32 ref: 00007FFDFAC1EBB9
Part of subcall function 00007FFDFAC1EAF0: RealizePalette.GDI32 ref: 00007FFDFAC1EBC5
Part of subcall function 00007FFDFAC1EAF0: GetBkMode.GDI32(?,?,00000000,00007FFDFAC1F5D1), ref: 00007FFDFAC1EBD1

SetBkMode.GDI32 ref: 00007FFDFAC14BD3
SelectPalette.GDI32 ref: 00007FFDFAC14BE7
RealizePalette.GDI32 ref: 00007FFDFAC14BF0
ReleaseDC.USER32 ref: 00007FFDFAC14C06

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$ModeRealizeSelect$Release
String ID:
API String ID: 4052958442-0
Opcode ID: 8336bacaa9944d7a7674e165133fa120a74d13be9d5ed11c290d11bbd86bc30e
Instruction ID: 2afa003204b236d359ab0bb0c66b06596b30ae28b6c9923d15873f129ca1afdd
Opcode Fuzzy Hash: 8336bacaa9944d7a7674e165133fa120a74d13be9d5ed11c290d11bbd86bc30e
Instruction Fuzzy Hash: 8341A37A70C68196D7288F16A460A6EB7A1FB88BD4F144075EE9E4378CDF3CE441CB44

Uniqueness

Uniqueness Score: -1.00%

Function 70A024D6 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 26stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A024DA
strlen.MSVCRT ref: 70A024E5
malloc.MSVCRT ref: 70A024F1

Strings

\, xrefs: 70A0250A
%s%c%s, xrefs: 70A024FE

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: strlen$malloc
String ID: %s%c%s$\
API String ID: 3157260142-3534329225
Opcode ID: c75083ccf2fc9e9ed90fe062a2d8aec638cde238e072ff17e398c91c295b6986
Instruction ID: a56ef2efd9655e9b67b9bd2a96483f142d409bec9570657dd2bbfcfe82ef5816
Opcode Fuzzy Hash: c75083ccf2fc9e9ed90fe062a2d8aec638cde238e072ff17e398c91c295b6986
Instruction Fuzzy Hash: A8E092217513444DDD15DB06BA0025DB6845B89BD8F884134AD4E13B68EE3CF2898704

Uniqueness

Uniqueness Score: -1.00%

Function 70A73CB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 70A73F64
abort.MSVCRT ref: 70A73F69

Strings

', xrefs: 70A73FCE
illegal index register, xrefs: 70A73F4F

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: abortfwrite
String ID: '$illegal index register
API String ID: 1067672060-451399654
Opcode ID: 9e072f5a76ee76b5e23c663f7146494ba32bc955bd6e66b7ddc4fd7bd7db62ef
Instruction ID: c4c73163ca4511ecd9f23133aeb0b8fcb6c52a755dee99f73e836344a7d0caa2
Opcode Fuzzy Hash: 9e072f5a76ee76b5e23c663f7146494ba32bc955bd6e66b7ddc4fd7bd7db62ef
Instruction Fuzzy Hash: 54918D73A19B85C4DB128F3DE89064C3BA5E399F88B9AD112CA4D47718CB7ED856C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC308E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FFDFAC30918

Strings

Container does not support overrideredirect, xrefs: 00007FFDFAC3092E
window ?boolean?, xrefs: 00007FFDFAC308F2

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: MessageSend
String ID: Container does not support overrideredirect$window ?boolean?
API String ID: 3850602802-2537947287
Opcode ID: 2b2f7af84eb83fd37934ceae820c7583b913c2b2622ecb245c6ebf19f8a45b88
Instruction ID: 56e1700b903cc95baa823e9250890f605ed731d55c4a5018c9abbaafeef0f93d
Opcode Fuzzy Hash: 2b2f7af84eb83fd37934ceae820c7583b913c2b2622ecb245c6ebf19f8a45b88
Instruction Fuzzy Hash: FD318236B0869682F7598B219564BBD2354FF44BA4F5541B2CE3E076C8DF38A891C310

Uniqueness

Uniqueness Score: -1.00%

Function 70A224D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 70A224D4
FormatMessageA.KERNEL32 ref: 70A22505
LocalFree.KERNEL32 ref: 70A22526

Strings

platforms/windows/hdinfo.c, xrefs: 70A22510

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: platforms/windows/hdinfo.c
API String ID: 1365068426-3843089204
Opcode ID: aa1f72af1f9256f694d27d04d8c1611766f73c4bae97df4e40b23cc10d957754
Instruction ID: 9c98c81a8e37215b12f25d9795779afe9e028b7157acaca63fb4e2ee4a39468b
Opcode Fuzzy Hash: aa1f72af1f9256f694d27d04d8c1611766f73c4bae97df4e40b23cc10d957754
Instruction Fuzzy Hash: C0F06D31608A41C2E710AB11E854B4A7771F3DDB85F604226EA8E43B68CF7DC24A8B40

Uniqueness

Uniqueness Score: -1.00%

Function 70A96730 Relevance: 6.3, APIs: 5, Instructions: 65stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A96743
malloc.MSVCRT(?,?,?,?,?,?,70A037BC), ref: 70A9674D
strlen.MSVCRT ref: 70A96758
malloc.MSVCRT(?,?,?,?,?,?,70A037BC), ref: 70A96762
free.MSVCRT(?,?,?,?,?,?,70A037BC), ref: 70A967D9

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: mallocstrlen$free
String ID:
API String ID: 2585366504-0
Opcode ID: 4d20a22b3b3b0fd839a90c43a6f50e9a081c8b6bcc691126ba0d7c2950fd406a
Instruction ID: 0638851f4a224caca41d9b8ee29da46d08603ffe5ff52579ef66635da8357622
Opcode Fuzzy Hash: 4d20a22b3b3b0fd839a90c43a6f50e9a081c8b6bcc691126ba0d7c2950fd406a
Instruction Fuzzy Hash: 5E1108127342A446D7199F36A5725AD7BE0DF9EFC8F488025FE8B47718EA2C9612C708

Uniqueness

Uniqueness Score: -1.00%

Function 70A01010 Relevance: 6.1, APIs: 4, Instructions: 131sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 70A01057
_amsg_exit.MSVCRT ref: 70A01081

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 7b7cd71a9208fb0481e2650ffc94a4d9b5aff767e2cfab8c3033c9da52f077ad
Instruction ID: bc99b7e14b24fe4152f6a649d2fd9e99b7a5e05c75762759f3db96024c1b6c0b
Opcode Fuzzy Hash: 7b7cd71a9208fb0481e2650ffc94a4d9b5aff767e2cfab8c3033c9da52f077ad
Instruction Fuzzy Hash: F6417E32B05548CAE7078F1AF96179962A5A78C7D4F44422AEE1D47358FF7CE981D340

Uniqueness

Uniqueness Score: -1.00%

Function 70A33350 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 70A334A2
in != NULL, xrefs: 70A334A9

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID:
String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
API String ID: 0-85593093
Opcode ID: 5a5ae222d0c708fe682b6bedc4c28eaa9ae9b6ed09ced27da110b8f1bca7b3a3
Instruction ID: c5c50bafb057d4c98f9029b9be243138ffdb16b6aadcdf3a3944475a03c1ba32
Opcode Fuzzy Hash: 5a5ae222d0c708fe682b6bedc4c28eaa9ae9b6ed09ced27da110b8f1bca7b3a3
Instruction Fuzzy Hash: 7F312933B196808ADB168F1AE410B4DB265E748BD9FD48028EE4E4BB5CDF3DD555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC14AF8 Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32 ref: 00007FFDFAC14BD3
SelectPalette.GDI32 ref: 00007FFDFAC14BE7
RealizePalette.GDI32 ref: 00007FFDFAC14BF0
ReleaseDC.USER32 ref: 00007FFDFAC14C06

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$ModeRealizeReleaseSelect
String ID:
API String ID: 878934721-0
Opcode ID: 4ac453b6dfa54a3d69ae6e1daf731f3f851a39312a7dfa9003470df0e14c8d3b
Instruction ID: 5a79a5b62ecf8d5f0b631e308a63fe5b0cde1eb7047e015a0df655dba8edbd91
Opcode Fuzzy Hash: 4ac453b6dfa54a3d69ae6e1daf731f3f851a39312a7dfa9003470df0e14c8d3b
Instruction Fuzzy Hash: 1421603A718685C6D7288F16E450A2E77A1FB88BD4F148165EE994379CDF3CE881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC14B0C Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32 ref: 00007FFDFAC14BD3
SelectPalette.GDI32 ref: 00007FFDFAC14BE7
RealizePalette.GDI32 ref: 00007FFDFAC14BF0
ReleaseDC.USER32 ref: 00007FFDFAC14C06

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$ModeRealizeReleaseSelect
String ID:
API String ID: 878934721-0
Opcode ID: 09a761b403e5297f368eaa5c905483bedfcce3834f44042ed326f2f7e137be84
Instruction ID: e8088054d35f80622ea665bb96710d552e949e6ea89f78a2c04846c5903856a8
Opcode Fuzzy Hash: 09a761b403e5297f368eaa5c905483bedfcce3834f44042ed326f2f7e137be84
Instruction Fuzzy Hash: 5E21607A718685C6D7288F16E050A2E77A1FB88BD4F148165EE9A4379CDF3CE881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC14B2F Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32 ref: 00007FFDFAC14BD3
SelectPalette.GDI32 ref: 00007FFDFAC14BE7
RealizePalette.GDI32 ref: 00007FFDFAC14BF0
ReleaseDC.USER32 ref: 00007FFDFAC14C06
DeleteDC.GDI32 ref: 00007FFDFAC14C16

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$DeleteModeRealizeReleaseSelect
String ID:
API String ID: 306815563-0
Opcode ID: 567e4705a7ecc40e7012704c38f4990e1b4f6d9c6ae75183c3239212846cab92
Instruction ID: 8281ac7632a4dc44d143cb3ab7462b7827c968a5f21d24972c03a3c147e53746
Opcode Fuzzy Hash: 567e4705a7ecc40e7012704c38f4990e1b4f6d9c6ae75183c3239212846cab92
Instruction Fuzzy Hash: 3C21923A71868587D728CF16E450A2EB7A0FB88BD4F148525EE994379CDF3CE881CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC14B3F Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32 ref: 00007FFDFAC14BD3
SelectPalette.GDI32 ref: 00007FFDFAC14BE7
RealizePalette.GDI32 ref: 00007FFDFAC14BF0
ReleaseDC.USER32 ref: 00007FFDFAC14C06
DeleteDC.GDI32 ref: 00007FFDFAC14C16

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$DeleteModeRealizeReleaseSelect
String ID:
API String ID: 306815563-0
Opcode ID: 53abd98dfdd8c8775870644d9f24b58088fffb65545a3662eaccb54acc178954
Instruction ID: 73c1364be9b8218a9a0f8b54497471f858101ee9bed0bcdd57233a47221e2c79
Opcode Fuzzy Hash: 53abd98dfdd8c8775870644d9f24b58088fffb65545a3662eaccb54acc178954
Instruction Fuzzy Hash: 2721923A71868587D728CF16E450A2EB7A0FB88BD4F148525EE994379CDF3CE881CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC86900 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC8695D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAC86977

Strings

GIF87a, xrefs: 00007FFDFAC8693C
GIF89a, xrefs: 00007FFDFAC8696D

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: strncmp
String ID: GIF87a$GIF89a
API String ID: 1114863663-2918331024
Opcode ID: e9dccb956e286ad6d3c42c6c4bac353f9817c0b8cc23d1b5f43fc16d6c42ce40
Instruction ID: 04cf7bf56769d4c7c4c27bb81dfd45da998a2bd55e429e2cdebad24c12b6305b
Opcode Fuzzy Hash: e9dccb956e286ad6d3c42c6c4bac353f9817c0b8cc23d1b5f43fc16d6c42ce40
Instruction Fuzzy Hash: 1C2106767087818AE760CF15E840B9AB7A5F788B90F548175EA9C87B58EF3DD444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC1EC00 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32 ref: 00007FFDFAC1EC1F
SelectPalette.GDI32 ref: 00007FFDFAC1EC31
RealizePalette.GDI32 ref: 00007FFDFAC1EC3A
DeleteDC.GDI32 ref: 00007FFDFAC1EC6C

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: Palette$DeleteModeRealizeSelect
String ID:
API String ID: 4235896006-0
Opcode ID: 611794a7a062c66783fe9fb1f7eea5246391ab836f1a27848840bcd5dcb31063
Instruction ID: eaddf4340b6bcf17062ccda87f7e492dbddebd9f8270583464011111e325ab08
Opcode Fuzzy Hash: 611794a7a062c66783fe9fb1f7eea5246391ab836f1a27848840bcd5dcb31063
Instruction Fuzzy Hash: 1B01FF35B18A8192EB588B12EAA443EA325FB49FD0F049075EE5A47B98DF3CD4868700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC34AC0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00007FFDFAC34ADD
GetSystemMetrics.USER32 ref: 00007FFDFAC34AEA
GetSystemMetrics.USER32 ref: 00007FFDFAC34AF7
GetSystemMetrics.USER32 ref: 00007FFDFAC34B04

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 7e3483952597167de68bf9b5338a8a6e2862c78601633ddb6a571209eec93a46
Instruction ID: e0b6e0c0e18a5b4392e78374fe89ec26fd55081173d947292f7d31df13e7e6f8
Opcode Fuzzy Hash: 7e3483952597167de68bf9b5338a8a6e2862c78601633ddb6a571209eec93a46
Instruction Fuzzy Hash: ACF03A75A04785C2EB094F62F85462977A1FB98BC0F449474EB9A07B98DE3CC895CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC79950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 355COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FFDFAC79C86

Strings

GC already registered in Tk_GetGC, xrefs: 00007FFDFAC79C57
called GCInit after GCCleanup, xrefs: 00007FFDFAC79A0E

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: DeleteObject
String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup
API String ID: 1531683806-2292843906
Opcode ID: 13909223018b84d4f041c7884bb543d34b1ffba9c4583de835d6884d5ecd2c28
Instruction ID: 5314f56ea93ed45fe3ea62d72ea54907c1306e1d719eedd133b5a276402f6f4e
Opcode Fuzzy Hash: 13909223018b84d4f041c7884bb543d34b1ffba9c4583de835d6884d5ecd2c28
Instruction Fuzzy Hash: 76026B7A704B8286E7A8CF15E490BAD77A4F784B88F114176CA6D47B98EF79E440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFAC388F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

GC already registered in Tk_GetGC, xrefs: 00007FFDFAC38C86
called GCInit after GCCleanup, xrefs: 00007FFDFAC38A7E

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID:
String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup
API String ID: 0-2292843906
Opcode ID: 51df327d5b33ae35e74dc2d44c122d86327f480884141681094bace4d8e4c9d6
Instruction ID: 6a8d4098212e9fb194d01a7cfc0944cc0310b9bf1396e53b00f8bedfc914197e
Opcode Fuzzy Hash: 51df327d5b33ae35e74dc2d44c122d86327f480884141681094bace4d8e4c9d6
Instruction Fuzzy Hash: EAC186B6B00B418AE754CF25E8907AD77B4FB48B88F44406ACB9D47798DF39E4A4C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFACAB8E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACAB9E8
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFACABA7C

Strings

Menu, xrefs: 00007FFDFACAB8E6, 00007FFDFACAB8EE

Memory Dump Source

Source File: 00000003.00000002.1939148138.00007FFDFAC11000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000003.00000002.1939063204.00007FFDFAC10000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939300622.00007FFDFAD11000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939350846.00007FFDFAD58000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939382918.00007FFDFAD59000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000003.00000002.1939477645.00007FFDFAD62000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffdfac10000_pythoninzoo.jbxd

Similarity

API ID: isupperstrncpy
String ID: Menu
API String ID: 3785496964-3711407533
Opcode ID: 5ad39b4f0e17036b216307a3963c01da0e41fdea62c303651fa93f52b6a972d6
Instruction ID: c7a584d6274d85e8e46bc07cdd834e0e4acacc7b595b2d05fceff78aa8b704c3
Opcode Fuzzy Hash: 5ad39b4f0e17036b216307a3963c01da0e41fdea62c303651fa93f52b6a972d6
Instruction Fuzzy Hash: 2EB1D136A08B868AE7548F15E4A0B7D37B0FB88B88F548176DBAD07799DF78D855C300

Uniqueness

Uniqueness Score: -1.00%

Function 70A145F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 70A14651
free.MSVCRT ref: 70A14680

Strings

.pye, xrefs: 70A1464A

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: freestrrchr
String ID: .pye
API String ID: 4178315289-4135401513
Opcode ID: cf44e6dce4ec51beb06a8958d358648d48a14e478d3eee6fa9c0852e4a09c931
Instruction ID: c5cc54c390dd5510e514ba72ec433e583bf89fb7729368c3f054879e7df4961a
Opcode Fuzzy Hash: cf44e6dce4ec51beb06a8958d358648d48a14e478d3eee6fa9c0852e4a09c931
Instruction Fuzzy Hash: A911081271520499FE069B66FD1136D53A0AB89FD5F4845309E1E47768FE3CD8C6C304

Uniqueness

Uniqueness Score: -1.00%

Function 70A05440 Relevance: 5.3, APIs: 4, Instructions: 286COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 70A05553

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8887bcf00b9c5a0df90894ad054ff675871eafbc232aec6a5375fde6386eee60
Instruction ID: 65fbc0bdf165173fd5fd41a4600feb4c3e846906f83a60a123f1867dfd944da4
Opcode Fuzzy Hash: 8887bcf00b9c5a0df90894ad054ff675871eafbc232aec6a5375fde6386eee60
Instruction Fuzzy Hash: E5B105B26187C886CB42CB35E804A4F7FADEB05790F89C615EE5A4B39CE739C955D301

Uniqueness

Uniqueness Score: -1.00%

Function 70A2D400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 70A2D410
abort.MSVCRT(?,?,?,?,CA4587E7,70A2E01F,?,?,?,?,70A02A6C), ref: 70A2D431

Strings

LTC_ARGCHK '%s' failure on line %d of file %s, xrefs: 70A2D416

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: __iob_funcabort
String ID: LTC_ARGCHK '%s' failure on line %d of file %s
API String ID: 1307436159-2823265812
Opcode ID: 5d103e923e5a7a9d09fda6a27a1b82defeced1008c67a37ebcf131cac65a500b
Instruction ID: cfd18097ad85927e3dac0dd476ad99f17a2c337413abb698c3df0880dc0f49d1
Opcode Fuzzy Hash: 5d103e923e5a7a9d09fda6a27a1b82defeced1008c67a37ebcf131cac65a500b
Instruction Fuzzy Hash: 3BD0A77172469991DA106B26AE40B9D9BA0FF9DFD4F888210FD8C93F249F18D206C340

Uniqueness

Uniqueness Score: -1.00%

Function 70A02410 Relevance: 5.0, APIs: 4, Instructions: 48stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 70A02422
MultiByteToWideChar.KERNEL32 ref: 70A0244D
MultiByteToWideChar.KERNEL32 ref: 70A02479
free.MSVCRT ref: 70A02495

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: ByteCharMultiWide$freestrlen
String ID:
API String ID: 1041141762-0
Opcode ID: 035a3046e230203d413df0f017a9d4564071b71b6db848b35f852c71b72fbd80
Instruction ID: 8a1f0eaab414182a10af46e19658e632a64742d618426c4e4557ceb8789737f3
Opcode Fuzzy Hash: 035a3046e230203d413df0f017a9d4564071b71b6db848b35f852c71b72fbd80
Instruction Fuzzy Hash: 4DF0FF2270175449E728DB27BD41B1FAAD5BB8CBD8F484138AE8D43B68EF3CC5468304

Uniqueness

Uniqueness Score: -1.00%

Function 70A95F90 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 70A95FB7
free.MSVCRT ref: 70A96008
LeaveCriticalSection.KERNEL32 ref: 70A96014

Memory Dump Source

Source File: 00000003.00000002.1928549627.0000000070A01000.00000020.00000001.01000000.00000011.sdmp, Offset: 70A00000, based on PE: true

Associated: 00000003.00000002.1928517639.0000000070A00000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928615008.0000000070A98000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928651358.0000000070A99000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928701796.0000000070AF9000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928741206.0000000070B22000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928772817.0000000070B28000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928802026.0000000070B2A000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928833338.0000000070B2B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928864227.0000000070B2C000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000003.00000002.1928896984.0000000070B2F000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70a00000_pythoninzoo.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 3c165ef6203b743bb8c6a4ac386ed484bd97f147fbf0b1de031a27829ed4fc76
Instruction ID: b8446c81e60ffb0577f0fc747a7d4a9b78ac1307dbeaf98736c5b9a10c5a5464
Opcode Fuzzy Hash: 3c165ef6203b743bb8c6a4ac386ed484bd97f147fbf0b1de031a27829ed4fc76
Instruction Fuzzy Hash: 0B015A71B29600C2EF0ACB75E8D131923E5FB98B90F548625C90E87328EB3CEA85C304

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pythoninzoo.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI69562\1337

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\AES.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_EKSBlowfish.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\__init__.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_cbc.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ccm.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_cfb.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ctr.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_eax.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ecb.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_gcm.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ocb.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_ofb.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_openpgp.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_mode_siv.pyc

Windows Analysis Report
pythoninzoo.exe

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\init.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\init.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\init.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Random\init.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\init.pyc

C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\init.pyc

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre