quest | cbc0460c7a660f5678e0f6a0586b3e2deed83bc15481ce2c0017ab7217dbe9a3

Sharing

Copy URL Twitter E-mail

General

Target
launcher.exe
Size 67.3MB
Sample261105-2gkhdatxev
SHA256 cbc0460c7a660f5678e0f6a0586b3e2deed83bc15481ce2c0017ab7217dbe9a3
MD5 5df8b3b9975bcad67f2ccd120d6447eb
SHA1 5c8849613caaec3fb8bcf05adf1a2225b9d1115f
SHA512 593a37bb68a3a95a2eb7a150b53d0fd2c1c15995189ee507c05b59aa9091bc97690897b1e5a2512019ab18d8c2f270f939836abbb20ced0e527b2f4a0874a043
SSDEEP 1572864:1ejOYfxhXQD5WSecEldBRzZhNSKb85sqSUDV8oQ1TrP33:14XAecElrRzQKbFNUDV8oQ1ff3
TLSH
T140F733ECAEBCCE35F4C055B5E21667792EAEE98316AF284D7FFD4C0432A1445C648E18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_siv.cpython-310.pyc

Ransom Note

o ��j�4��@��s��d�Z�ddlmZ�ddlmZ�ddlmZmZmZm Z �dgZ ddlmZ�ddl mZ�ddlmZ�dd lmZ�dd lmZ�erCddlmZ�eeeef�ZG�dd��d�Zd d��ZdS�)z- Synthetic Initialization Vector (SIV) mode. ��)�annotations)�compare_digest)� TYPE_CHECKING�Optional�Union�overload�SivMode)� unhexlify)�Method)�_S2V)� is_buffer)� bytes_to_long)� ModuleTypec��@��s��e�Zd�ZdZd5dd�Zd d��Zd6dd�Zd7dd�Zd8dd�Zd9dd�Z d:dd�Z d;dd �Zd<d"d#�Ze d=d%d&��Ze d>d*d&��Z +[email protected]&�Ze dAd0d1��Ze dBd2d1��Z +d?dCd4d1�Zd+S�)Dr��a��Synthetic Initialization Vector (SIV). This is an Authenticated Encryption with Associated Data (`AEAD`_) mode. It provides both confidentiality and authenticity. The header of the message may be left in the clear, if needed, and it will still be subject to authentication. The decryption step tells the receiver if the message comes from a source that really knows the secret key. Additionally, decryption detects if any part of the message - including the header - has been modified or corrupted. Unlike other AEAD modes such as CCM, EAX or GCM, accidental reuse of a nonce is not catastrophic for the confidentiality of the message. The only effect is that an attacker can tell when the same plaintext (and same associated data) is protected with the same key. The length of the MAC is fixed to the block size of the underlying cipher. The key size is twice the length of the key of the underlying cipher. This mode is only available for AES ciphers. +--------------------+---------------+-------------------+ | Cipher | SIV MAC size | SIV key length | | | (bytes) | (bytes) | +====================+===============+===================+ | AES-128 | 16 | 32 | +--------------------+---------------+-------------------+ | AES-192 | 16 | 48 | +--------------------+---------------+-------------------+ | AES-256 | 16 | 64 | +--------------------+---------------+-------------------+ See `RFC5297`_ and the `original paper`__. .. _RFC5297: https://tools.ietf.org/html/rfc5297 .. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html .. __: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf �factoryr��key�Buffer�nonce�kwargs�dict�return�Nonec��C��s��|j�|�_� �||�_||�_t|�dvrtdt|��|d�ur5t|�s%td��t|�dkr/td��t|�|�_ �t|�d�}d�|�_ t |d�|��||�jd�|�_||d��|�_|j |d�|��|jfi�|��tjtjtjtjtjg|�_d�S�)N)� ��0��@��zIncorrect key length (%d bytes)z?When provided, the nonce must be bytes, bytearray or memoryviewr��z*When provided, the nonce must be non-empty��)Z ciphermodZ cipher_params)� block_size�_factory�_cipher_params�len� ValueErrorr�� TypeError�bytesr��_mac_tagr��_kdf�_subkey_cipher�newZMODE_ECBr ��UPDATE�ENCRYPT�DECRYPT�DIGEST�VERIFY�_next)�selfr��r��r��r��Zsubkey_size��r-��dC:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\Lib\site-packages\Crypto/Cipher/_mode_siv.py�__init__D��s&�� zSivMode.__init__c��C��s4��t�|�}|d@�}|�jj|�j|�jjf|dd�|�j��S�)z*Create a new CTR cipher from V in SIV model ��)� initial_valuer��N)r ��r��r%��r$��ZMODE_CTRr��)r,��vZv_int�qr-��r-��r.��_create_ctr_cipherf��s�� zSivMode._create_ctr_cipher� componentc��C��s>��t�j|�jvr td��t�jt�jt�jt�jt�jg|�_|�j� |��|�S�)a��Protect one associated data component For SIV, the associated data is a sequence (*vector*) of non-empty byte strings (*components*). This method consumes the next component. It must be called once for each of the components that constitue the associated data. Note that the components have clear boundaries, so that: >>> cipher.update(b"builtin") >>> cipher.update(b"securely") is not equivalent to: >>> cipher.update(b"built") >>> cipher.update(b"insecurely") If there is no associated data, this method must not be called. Args: component (bytes/bytearray/memoryview): The next associated data component. z<update() can only be called immediately after initializationN) r ��r&��r+��r ��r'��r(��r)��r*��r#��update)r,��r5��r-��r-��r.��r6��o��s ��zSivMode.update� plaintextr!��c��C��t�d��)z� For SIV, encryption and MAC authentication must take place at the same point. This method shall not be used. Use `encrypt_and_digest` instead. zEencrypt() not allowed for SIV mode. Use encrypt_and_digest() instead.N�r ��r,��r7��r-��r-��r.��encrypt��zSivMode.encrypt� ciphertextc��C��r8��)z� For SIV, decryption and verification must take place at the same point. This method shall not be used. Use `decrypt_and_verify` instead. zEdecrypt() not allowed for SIV mode. Use decrypt_and_verify() instead.Nr9��)r,��r=��r-��r-��r.��decrypt��r<��zSivMode.decryptc��C��s:��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_|�jS�)a ��Compute the *binary* MAC tag. The caller invokes this function at the very end. This method returns the MAC that shall be sent to the receiver, together with the ciphertext. Returns: the MAC, as a byte string. zAdigest() cannot be called when decrypting or validating a messageN)r ��r)��r+��r ��r"��r#��derive�r,��r-��r-��r.��digest��s�� zSivMode.digest�strc��C��s��|��S�)z�Compute the *printable* MAC tag. This method is like `digest`. Returns: the MAC, as a hexadecimal string. N)rA��hexr@��r-��r-��r.�� hexdigest��s��zSivMode.hexdigest�received_mac_tagc��C��sL��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_t|�j|�s$td��dS�)a<��Validate the *binary* MAC tag. The caller invokes this function at the very end. This method checks if the decrypted message is indeed valid (that is, if the key is correct) and it has not been tampered with while in transit. Args: received_mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z3verify() cannot be called when encrypting a messageNzMAC check failed) r ��r*��r+��r ��r"��r#��r?��r��r��)r,��rE��r-��r-��r.��verify��s�� zSivMode.verify�hex_mac_tagc��C��s��|��t|��dS�)ak��Validate the *printable* MAC tag. This method is like `verify`. Args: hex_mac_tag (string): This is the *printable* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. N)rF��r ��)r,��rG��r-��r-��r.�� hexverify��s��zSivMode.hexverify�tuple[bytes, bytes]c��C��d�S��Nr-��r:��r-��r-��r.��encrypt_and_digest��zSivMode.encrypt_and_digest�output�Union[bytearray, memoryview]�tuple[None, bytes]c��C��rJ��rK��r-��)r,��r7��rN��r-��r-��r.��rL��N�&Optional[Union[bytearray, memoryview]]�tuple[Optional[bytes], bytes]c��C��sn��t�j|�jvr td��t�jg|�_t|�d�r|�j�|�j��|�j�|��|�j� ��|�_ |��|�j �}|j||d�|�j fS�)a)��Perform encrypt() and digest() in one step. Args: plaintext (bytes/bytearray/memoryview): The piece of data to encrypt. Keyword Args: output (bytearray/memoryview): The location where the ciphertext must be written to. If ``None``, the ciphertext is returned. Returns: The tuple ``(ciphertext, tag)``, both ``bytes``. The ciphertext is ``None`` when the ``output`` parameter specified a location for the result. z@encrypt() can only be called after initialization or an update()r��rN��N) r ��r'��r+��r ��r)��hasattrr#��r6��r��r?��r"��r4��r;��)r,��r7��rN��cipherr-��r-��r.��rL��s�� mac_tagc��C��rJ��rK��r-��)r,��r=��rW��r-��r-��r.��decrypt_and_verify��rM��zSivMode.decrypt_and_verifyc��C��rJ��rK��r-��)r,��r=��rW��rN��r-��r-��r.��rX��rQ��Optional[bytes]c��C��sx��t�j|�jvr td��t�jg|�_|��|�|�_|�jj||d�}t|�d�r)|�j � |�j��|�j � |du�r2|n|��|��|��|S�)a��Perform decryption and verification in one step. A cipher object is stateful: once you have decrypted a message you cannot decrypt (or encrypt) another message with the same object. You cannot reuse an object for encrypting or decrypting other data with the same key. This function does not remove any padding from the plaintext. Args: ciphertext (bytes/bytearray/memoryview): The piece of data to decrypt. It can be of any length. mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Keyword Args: output (bytearray/memoryview): The location where the plaintext must be written to. If ``None``, the plaintext is returned. Returns: the plaintext as ``bytes`` or ``None`` when the ``output`` parameter specified a location for the result. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z@decrypt() can only be called after initialization or an update()rT��r��N) r ��r(��r+��r ��r*��r4��Z_cipherr>��rU��r#��r6��r��rF��)r,��r=��rW��rN��r7��r-��r-��r.��rX��s��! ) r��r��r��r��r��r��r��r��r��r��)r5��r��r��r��)r7��r��r��r!��)r=��r��r��r!��)r��r!��)r��rB��)rE��r��r��r��)rG��rB��r��r��)r7��r��r��rI��)r7��r��rN��rO��r��rP��rK��)r7��r��rN��rR��r��rS��)r=��r��rW��r��r��r!��)r=��r��rW��r��rN��rO��r��r��)r=��r��rW��r��rN��rR��r��rY��)�__name__� __module__�__qualname__�__doc__r/��r4��r6��r;��r>��rA��rD��rF��rH��r��rL��rX��r-��r-��r-��r.��r��s.�� '" " �!�c�� K��sR��z|��d�}W�n�ty�}�ztdt|��d}~ww�|��dd�}t|�|||�S�)a^��Create a new block cipher, configured in Synthetic Initializaton Vector (SIV) mode. Args: factory (object): A symmetric cipher module from `Crypto.Cipher` (like `Crypto.Cipher.AES`). Keyword Args: key (bytes/bytearray/memoryview): The secret key to use in the symmetric cipher. It must be 32, 48 or 64 bytes long. If AES is the chosen cipher, the variants *AES-128*, *AES-192* and or *AES-256* will be used internally. nonce (bytes/bytearray/memoryview): For deterministic encryption, it is not present. Otherwise, it is a value that must never be reused for encrypting message under this key. There are no restrictions on its length, but it is recommended to use at least 16 bytes. r��zMissing parameter: Nr��)�pop�KeyErrorr ��rB��r��)r��r��r��er��r-��r-��r.��_create_siv_cipherQ��s��ra��N)r]�� __future__r��hmacr��typingr��r��r��r��__all__�binasciir ��ZCrypto.Cipher._state_machiner ��ZCrypto.Protocol.KDFr��ZCrypto.Util._raw_apir��ZCrypto.Util.numberr ��typesr��r!�� bytearray� memoryviewr��r��ra��r-��r-��r-��r.��<module>��s"��7

Emails

+[email protected]&�Ze

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_siv.cpython-310.pyc

Ransom Note

o ��J�j�4��@��s��d�Z�ddlmZ�ddlmZ�ddlmZmZmZm Z �dgZ ddlmZ�ddl mZ�ddlmZ�dd lmZ�dd lmZ�erCddlmZ�eeeef�ZG�dd��d�Zd d��ZdS�)z- Synthetic Initialization Vector (SIV) mode. ��)�annotations)�compare_digest)� TYPE_CHECKING�Optional�Union�overload�SivMode)� unhexlify)�Method)�_S2V)� is_buffer)� bytes_to_long)� ModuleTypec��@��s��e�Zd�ZdZd5dd�Zd d��Zd6dd�Zd7dd�Zd8dd�Zd9dd�Z d:dd�Z d;dd �Zd<d"d#�Ze d=d%d&��Ze d>d*d&��Z +[email protected]&�Ze dAd0d1��Ze dBd2d1��Z +d?dCd4d1�Zd+S�)Dr��a��Synthetic Initialization Vector (SIV). This is an Authenticated Encryption with Associated Data (`AEAD`_) mode. It provides both confidentiality and authenticity. The header of the message may be left in the clear, if needed, and it will still be subject to authentication. The decryption step tells the receiver if the message comes from a source that really knows the secret key. Additionally, decryption detects if any part of the message - including the header - has been modified or corrupted. Unlike other AEAD modes such as CCM, EAX or GCM, accidental reuse of a nonce is not catastrophic for the confidentiality of the message. The only effect is that an attacker can tell when the same plaintext (and same associated data) is protected with the same key. The length of the MAC is fixed to the block size of the underlying cipher. The key size is twice the length of the key of the underlying cipher. This mode is only available for AES ciphers. +--------------------+---------------+-------------------+ | Cipher | SIV MAC size | SIV key length | | | (bytes) | (bytes) | +====================+===============+===================+ | AES-128 | 16 | 32 | +--------------------+---------------+-------------------+ | AES-192 | 16 | 48 | +--------------------+---------------+-------------------+ | AES-256 | 16 | 64 | +--------------------+---------------+-------------------+ See `RFC5297`_ and the `original paper`__. .. _RFC5297: https://tools.ietf.org/html/rfc5297 .. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html .. __: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf �factoryr��key�Buffer�nonce�kwargs�dict�return�Nonec��C��s��|j�|�_� �||�_||�_t|�dvrtdt|��|d�ur5t|�s%td��t|�dkr/td��t|�|�_ �t|�d�}d�|�_ t |d�|��||�jd�|�_||d��|�_|j |d�|��|jfi�|��tjtjtjtjtjg|�_d�S�)N)� ��0��@��zIncorrect key length (%d bytes)z?When provided, the nonce must be bytes, bytearray or memoryviewr��z*When provided, the nonce must be non-empty��)Z ciphermodZ cipher_params)� block_size�_factory�_cipher_params�len� ValueErrorr�� TypeError�bytesr��_mac_tagr��_kdf�_subkey_cipher�newZMODE_ECBr ��UPDATE�ENCRYPT�DECRYPT�DIGEST�VERIFY�_next)�selfr��r��r��r��Zsubkey_size��r-��dC:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\Lib\site-packages\Crypto/Cipher/_mode_siv.py�__init__D��s&�� zSivMode.__init__c��C��s4��t�|�}|d@�}|�jj|�j|�jjf|dd�|�j��S�)z*Create a new CTR cipher from V in SIV model ��)� initial_valuer��N)r ��r��r%��r$��ZMODE_CTRr��)r,��vZv_int�qr-��r-��r.��_create_ctr_cipherf��s�� zSivMode._create_ctr_cipher� componentc��C��s>��t�j|�jvr td��t�jt�jt�jt�jt�jg|�_|�j� |��|�S�)a��Protect one associated data component For SIV, the associated data is a sequence (*vector*) of non-empty byte strings (*components*). This method consumes the next component. It must be called once for each of the components that constitue the associated data. Note that the components have clear boundaries, so that: >>> cipher.update(b"builtin") >>> cipher.update(b"securely") is not equivalent to: >>> cipher.update(b"built") >>> cipher.update(b"insecurely") If there is no associated data, this method must not be called. Args: component (bytes/bytearray/memoryview): The next associated data component. z<update() can only be called immediately after initializationN) r ��r&��r+��r ��r'��r(��r)��r*��r#��update)r,��r5��r-��r-��r.��r6��o��s ��zSivMode.update� plaintextr!��c��C��t�d��)z� For SIV, encryption and MAC authentication must take place at the same point. This method shall not be used. Use `encrypt_and_digest` instead. zEencrypt() not allowed for SIV mode. Use encrypt_and_digest() instead.N�r ��r,��r7��r-��r-��r.��encrypt��zSivMode.encrypt� ciphertextc��C��r8��)z� For SIV, decryption and verification must take place at the same point. This method shall not be used. Use `decrypt_and_verify` instead. zEdecrypt() not allowed for SIV mode. Use decrypt_and_verify() instead.Nr9��)r,��r=��r-��r-��r.��decrypt��r<��zSivMode.decryptc��C��s:��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_|�jS�)a ��Compute the *binary* MAC tag. The caller invokes this function at the very end. This method returns the MAC that shall be sent to the receiver, together with the ciphertext. Returns: the MAC, as a byte string. zAdigest() cannot be called when decrypting or validating a messageN)r ��r)��r+��r ��r"��r#��derive�r,��r-��r-��r.��digest��s�� zSivMode.digest�strc��C��s��|��S�)z�Compute the *printable* MAC tag. This method is like `digest`. Returns: the MAC, as a hexadecimal string. N)rA��hexr@��r-��r-��r.�� hexdigest��s��zSivMode.hexdigest�received_mac_tagc��C��sL��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_t|�j|�s$td��dS�)a<��Validate the *binary* MAC tag. The caller invokes this function at the very end. This method checks if the decrypted message is indeed valid (that is, if the key is correct) and it has not been tampered with while in transit. Args: received_mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z3verify() cannot be called when encrypting a messageNzMAC check failed) r ��r*��r+��r ��r"��r#��r?��r��r��)r,��rE��r-��r-��r.��verify��s�� zSivMode.verify�hex_mac_tagc��C��s��|��t|��dS�)ak��Validate the *printable* MAC tag. This method is like `verify`. Args: hex_mac_tag (string): This is the *printable* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. N)rF��r ��)r,��rG��r-��r-��r.�� hexverify��s��zSivMode.hexverify�tuple[bytes, bytes]c��C��d�S��Nr-��r:��r-��r-��r.��encrypt_and_digest��zSivMode.encrypt_and_digest�output�Union[bytearray, memoryview]�tuple[None, bytes]c��C��rJ��rK��r-��)r,��r7��rN��r-��r-��r.��rL��N�&Optional[Union[bytearray, memoryview]]�tuple[Optional[bytes], bytes]c��C��sn��t�j|�jvr td��t�jg|�_t|�d�r|�j�|�j��|�j�|��|�j� ��|�_ |��|�j �}|j||d�|�j fS�)a)��Perform encrypt() and digest() in one step. Args: plaintext (bytes/bytearray/memoryview): The piece of data to encrypt. Keyword Args: output (bytearray/memoryview): The location where the ciphertext must be written to. If ``None``, the ciphertext is returned. Returns: The tuple ``(ciphertext, tag)``, both ``bytes``. The ciphertext is ``None`` when the ``output`` parameter specified a location for the result. z@encrypt() can only be called after initialization or an update()r��rN��N) r ��r'��r+��r ��r)��hasattrr#��r6��r��r?��r"��r4��r;��)r,��r7��rN��cipherr-��r-��r.��rL��s�� mac_tagc��C��rJ��rK��r-��)r,��r=��rW��r-��r-��r.��decrypt_and_verify��rM��zSivMode.decrypt_and_verifyc��C��rJ��rK��r-��)r,��r=��rW��rN��r-��r-��r.��rX��rQ��Optional[bytes]c��C��sx��t�j|�jvr td��t�jg|�_|��|�|�_|�jj||d�}t|�d�r)|�j � |�j��|�j � |du�r2|n|��|��|��|S�)a��Perform decryption and verification in one step. A cipher object is stateful: once you have decrypted a message you cannot decrypt (or encrypt) another message with the same object. You cannot reuse an object for encrypting or decrypting other data with the same key. This function does not remove any padding from the plaintext. Args: ciphertext (bytes/bytearray/memoryview): The piece of data to decrypt. It can be of any length. mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Keyword Args: output (bytearray/memoryview): The location where the plaintext must be written to. If ``None``, the plaintext is returned. Returns: the plaintext as ``bytes`` or ``None`` when the ``output`` parameter specified a location for the result. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z@decrypt() can only be called after initialization or an update()rT��r��N) r ��r(��r+��r ��r*��r4��Z_cipherr>��rU��r#��r6��r��rF��)r,��r=��rW��rN��r7��r-��r-��r.��rX��s��! ) r��r��r��r��r��r��r��r��r��r��)r5��r��r��r��)r7��r��r��r!��)r=��r��r��r!��)r��r!��)r��rB��)rE��r��r��r��)rG��rB��r��r��)r7��r��r��rI��)r7��r��rN��rO��r��rP��rK��)r7��r��rN��rR��r��rS��)r=��r��rW��r��r��r!��)r=��r��rW��r��rN��rO��r��r��)r=��r��rW��r��rN��rR��r��rY��)�__name__� __module__�__qualname__�__doc__r/��r4��r6��r;��r>��rA��rD��rF��rH��r��rL��rX��r-��r-��r-��r.��r��s.�� '" " �!�c�� K��sR��z|��d�}W�n�ty�}�ztdt|��d}~ww�|��dd�}t|�|||�S�)a^��Create a new block cipher, configured in Synthetic Initializaton Vector (SIV) mode. Args: factory (object): A symmetric cipher module from `Crypto.Cipher` (like `Crypto.Cipher.AES`). Keyword Args: key (bytes/bytearray/memoryview): The secret key to use in the symmetric cipher. It must be 32, 48 or 64 bytes long. If AES is the chosen cipher, the variants *AES-128*, *AES-192* and or *AES-256* will be used internally. nonce (bytes/bytearray/memoryview): For deterministic encryption, it is not present. Otherwise, it is a value that must never be reused for encrypting message under this key. There are no restrictions on its length, but it is recommended to use at least 16 bytes. r��zMissing parameter: Nr��)�pop�KeyErrorr ��rB��r��)r��r��r��er��r-��r-��r.��_create_siv_cipherQ��s��ra��N)r]�� __future__r��hmacr��typingr��r��r��r��__all__�binasciir ��ZCrypto.Cipher._state_machiner ��ZCrypto.Protocol.KDFr��ZCrypto.Util._raw_apir��ZCrypto.Util.numberr ��typesr��r!�� bytearray� memoryviewr��r��ra��r-��r-��r-��r.��<module>��s"��7

Emails

+[email protected]&�Ze

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_siv.cpython-310.pyc

Ransom Note

o ��H�j�4��@��s��d�Z�ddlmZ�ddlmZ�ddlmZmZmZm Z �dgZ ddlmZ�ddl mZ�ddlmZ�dd lmZ�dd lmZ�erCddlmZ�eeeef�ZG�dd��d�Zd d��ZdS�)z- Synthetic Initialization Vector (SIV) mode. ��)�annotations)�compare_digest)� TYPE_CHECKING�Optional�Union�overload�SivMode)� unhexlify)�Method)�_S2V)� is_buffer)� bytes_to_long)� ModuleTypec��@��s��e�Zd�ZdZd5dd�Zd d��Zd6dd�Zd7dd�Zd8dd�Zd9dd�Z d:dd�Z d;dd �Zd<d"d#�Ze d=d%d&��Ze d>d*d&��Z +[email protected]&�Ze dAd0d1��Ze dBd2d1��Z +d?dCd4d1�Zd+S�)Dr��a��Synthetic Initialization Vector (SIV). This is an Authenticated Encryption with Associated Data (`AEAD`_) mode. It provides both confidentiality and authenticity. The header of the message may be left in the clear, if needed, and it will still be subject to authentication. The decryption step tells the receiver if the message comes from a source that really knows the secret key. Additionally, decryption detects if any part of the message - including the header - has been modified or corrupted. Unlike other AEAD modes such as CCM, EAX or GCM, accidental reuse of a nonce is not catastrophic for the confidentiality of the message. The only effect is that an attacker can tell when the same plaintext (and same associated data) is protected with the same key. The length of the MAC is fixed to the block size of the underlying cipher. The key size is twice the length of the key of the underlying cipher. This mode is only available for AES ciphers. +--------------------+---------------+-------------------+ | Cipher | SIV MAC size | SIV key length | | | (bytes) | (bytes) | +====================+===============+===================+ | AES-128 | 16 | 32 | +--------------------+---------------+-------------------+ | AES-192 | 16 | 48 | +--------------------+---------------+-------------------+ | AES-256 | 16 | 64 | +--------------------+---------------+-------------------+ See `RFC5297`_ and the `original paper`__. .. _RFC5297: https://tools.ietf.org/html/rfc5297 .. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html .. __: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf �factoryr��key�Buffer�nonce�kwargs�dict�return�Nonec��C��s��|j�|�_� �||�_||�_t|�dvrtdt|��|d�ur5t|�s%td��t|�dkr/td��t|�|�_ �t|�d�}d�|�_ t |d�|��||�jd�|�_||d��|�_|j |d�|��|jfi�|��tjtjtjtjtjg|�_d�S�)N)� ��0��@��zIncorrect key length (%d bytes)z?When provided, the nonce must be bytes, bytearray or memoryviewr��z*When provided, the nonce must be non-empty��)Z ciphermodZ cipher_params)� block_size�_factory�_cipher_params�len� ValueErrorr�� TypeError�bytesr��_mac_tagr��_kdf�_subkey_cipher�newZMODE_ECBr ��UPDATE�ENCRYPT�DECRYPT�DIGEST�VERIFY�_next)�selfr��r��r��r��Zsubkey_size��r-��dC:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\Lib\site-packages\Crypto/Cipher/_mode_siv.py�__init__D��s&�� zSivMode.__init__c��C��s4��t�|�}|d@�}|�jj|�j|�jjf|dd�|�j��S�)z*Create a new CTR cipher from V in SIV model ��)� initial_valuer��N)r ��r��r%��r$��ZMODE_CTRr��)r,��vZv_int�qr-��r-��r.��_create_ctr_cipherf��s�� zSivMode._create_ctr_cipher� componentc��C��s>��t�j|�jvr td��t�jt�jt�jt�jt�jg|�_|�j� |��|�S�)a��Protect one associated data component For SIV, the associated data is a sequence (*vector*) of non-empty byte strings (*components*). This method consumes the next component. It must be called once for each of the components that constitue the associated data. Note that the components have clear boundaries, so that: >>> cipher.update(b"builtin") >>> cipher.update(b"securely") is not equivalent to: >>> cipher.update(b"built") >>> cipher.update(b"insecurely") If there is no associated data, this method must not be called. Args: component (bytes/bytearray/memoryview): The next associated data component. z<update() can only be called immediately after initializationN) r ��r&��r+��r ��r'��r(��r)��r*��r#��update)r,��r5��r-��r-��r.��r6��o��s ��zSivMode.update� plaintextr!��c��C��t�d��)z� For SIV, encryption and MAC authentication must take place at the same point. This method shall not be used. Use `encrypt_and_digest` instead. zEencrypt() not allowed for SIV mode. Use encrypt_and_digest() instead.N�r ��r,��r7��r-��r-��r.��encrypt��zSivMode.encrypt� ciphertextc��C��r8��)z� For SIV, decryption and verification must take place at the same point. This method shall not be used. Use `decrypt_and_verify` instead. zEdecrypt() not allowed for SIV mode. Use decrypt_and_verify() instead.Nr9��)r,��r=��r-��r-��r.��decrypt��r<��zSivMode.decryptc��C��s:��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_|�jS�)a ��Compute the *binary* MAC tag. The caller invokes this function at the very end. This method returns the MAC that shall be sent to the receiver, together with the ciphertext. Returns: the MAC, as a byte string. zAdigest() cannot be called when decrypting or validating a messageN)r ��r)��r+��r ��r"��r#��derive�r,��r-��r-��r.��digest��s�� zSivMode.digest�strc��C��s��|��S�)z�Compute the *printable* MAC tag. This method is like `digest`. Returns: the MAC, as a hexadecimal string. N)rA��hexr@��r-��r-��r.�� hexdigest��s��zSivMode.hexdigest�received_mac_tagc��C��sL��t�j|�jvr td��t�jg|�_|�jdu�r|�j��|�_t|�j|�s$td��dS�)a<��Validate the *binary* MAC tag. The caller invokes this function at the very end. This method checks if the decrypted message is indeed valid (that is, if the key is correct) and it has not been tampered with while in transit. Args: received_mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z3verify() cannot be called when encrypting a messageNzMAC check failed) r ��r*��r+��r ��r"��r#��r?��r��r��)r,��rE��r-��r-��r.��verify��s�� zSivMode.verify�hex_mac_tagc��C��s��|��t|��dS�)ak��Validate the *printable* MAC tag. This method is like `verify`. Args: hex_mac_tag (string): This is the *printable* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. N)rF��r ��)r,��rG��r-��r-��r.�� hexverify��s��zSivMode.hexverify�tuple[bytes, bytes]c��C��d�S��Nr-��r:��r-��r-��r.��encrypt_and_digest��zSivMode.encrypt_and_digest�output�Union[bytearray, memoryview]�tuple[None, bytes]c��C��rJ��rK��r-��)r,��r7��rN��r-��r-��r.��rL��N�&Optional[Union[bytearray, memoryview]]�tuple[Optional[bytes], bytes]c��C��sn��t�j|�jvr td��t�jg|�_t|�d�r|�j�|�j��|�j�|��|�j� ��|�_ |��|�j �}|j||d�|�j fS�)a)��Perform encrypt() and digest() in one step. Args: plaintext (bytes/bytearray/memoryview): The piece of data to encrypt. Keyword Args: output (bytearray/memoryview): The location where the ciphertext must be written to. If ``None``, the ciphertext is returned. Returns: The tuple ``(ciphertext, tag)``, both ``bytes``. The ciphertext is ``None`` when the ``output`` parameter specified a location for the result. z@encrypt() can only be called after initialization or an update()r��rN��N) r ��r'��r+��r ��r)��hasattrr#��r6��r��r?��r"��r4��r;��)r,��r7��rN��cipherr-��r-��r.��rL��s�� mac_tagc��C��rJ��rK��r-��)r,��r=��rW��r-��r-��r.��decrypt_and_verify��rM��zSivMode.decrypt_and_verifyc��C��rJ��rK��r-��)r,��r=��rW��rN��r-��r-��r.��rX��rQ��Optional[bytes]c��C��sx��t�j|�jvr td��t�jg|�_|��|�|�_|�jj||d�}t|�d�r)|�j � |�j��|�j � |du�r2|n|��|��|��|S�)a��Perform decryption and verification in one step. A cipher object is stateful: once you have decrypted a message you cannot decrypt (or encrypt) another message with the same object. You cannot reuse an object for encrypting or decrypting other data with the same key. This function does not remove any padding from the plaintext. Args: ciphertext (bytes/bytearray/memoryview): The piece of data to decrypt. It can be of any length. mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Keyword Args: output (bytearray/memoryview): The location where the plaintext must be written to. If ``None``, the plaintext is returned. Returns: the plaintext as ``bytes`` or ``None`` when the ``output`` parameter specified a location for the result. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z@decrypt() can only be called after initialization or an update()rT��r��N) r ��r(��r+��r ��r*��r4��Z_cipherr>��rU��r#��r6��r��rF��)r,��r=��rW��rN��r7��r-��r-��r.��rX��s��! ) r��r��r��r��r��r��r��r��r��r��)r5��r��r��r��)r7��r��r��r!��)r=��r��r��r!��)r��r!��)r��rB��)rE��r��r��r��)rG��rB��r��r��)r7��r��r��rI��)r7��r��rN��rO��r��rP��rK��)r7��r��rN��rR��r��rS��)r=��r��rW��r��r��r!��)r=��r��rW��r��rN��rO��r��r��)r=��r��rW��r��rN��rR��r��rY��)�__name__� __module__�__qualname__�__doc__r/��r4��r6��r;��r>��rA��rD��rF��rH��r��rL��rX��r-��r-��r-��r.��r��s.�� '" " �!�c�� K��sR��z|��d�}W�n�ty�}�ztdt|��d}~ww�|��dd�}t|�|||�S�)a^��Create a new block cipher, configured in Synthetic Initializaton Vector (SIV) mode. Args: factory (object): A symmetric cipher module from `Crypto.Cipher` (like `Crypto.Cipher.AES`). Keyword Args: key (bytes/bytearray/memoryview): The secret key to use in the symmetric cipher. It must be 32, 48 or 64 bytes long. If AES is the chosen cipher, the variants *AES-128*, *AES-192* and or *AES-256* will be used internally. nonce (bytes/bytearray/memoryview): For deterministic encryption, it is not present. Otherwise, it is a value that must never be reused for encrypting message under this key. There are no restrictions on its length, but it is recommended to use at least 16 bytes. r��zMissing parameter: Nr��)�pop�KeyErrorr ��rB��r��)r��r��r��er��r-��r-��r.��_create_siv_cipherQ��s��ra��N)r]�� __future__r��hmacr��typingr��r��r��r��__all__�binasciir ��ZCrypto.Cipher._state_machiner ��ZCrypto.Protocol.KDFr��ZCrypto.Util._raw_apir��ZCrypto.Util.numberr ��typesr��r!�� bytearray� memoryviewr��r��ra��r-��r-��r-��r.��<module>��s"��7

Emails

+[email protected]&�Ze

Targets

- Target
  launcher.exe
- Size 67.3MB
- SHA256 cbc0460c7a660f5678e0f6a0586b3e2deed83bc15481ce2c0017ab7217dbe9a3
- MD5 5df8b3b9975bcad67f2ccd120d6447eb
- SHA1 5c8849613caaec3fb8bcf05adf1a2225b9d1115f
- SHA512 593a37bb68a3a95a2eb7a150b53d0fd2c1c15995189ee507c05b59aa9091bc97690897b1e5a2512019ab18d8c2f270f939836abbb20ced0e527b2f4a0874a043
- SSDEEP 1572864:1ejOYfxhXQD5WSecEldBRzZhNSKb85sqSUDV8oQ1TrP33:14XAecElrRzQKbFNUDV8oQ1ff3
- TLSH
  T140F733ECAEBCCE35F4C055B5E21667792EAEE98316AF284D7FFD4C0432A1445C648E18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution quest ransomware rat spyware stealer
- Family: Quest,Voog,Frost
  Quest aka VoogStealer and FrostStealer is a Windows stealer based on ElectronJS.
  stealer rat quest
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
- MD5 1ca87d8ee3ce9e9682547c4d9c9cb581
- SHA1 d25b5b82c0b225719cc4ee318f776169b7f9af7a
- SHA512 ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
- SSDEEP 24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
- TLSH
  T1D296A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
- MD5 fa145097e0274da929aacd68c31338ab
- SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
- SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
- SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
- TLSH
  T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  launcher Assistant.exe
- Size 168.6MB
- SHA256 67dc2a7036860a68e5312c212c31b8772ac463ed0289fcc44897867f55075e89
- MD5 fbe2635ee2c0e774247127b54371b343
- SHA1 e1b2434bc210206da2e8f6f442c11de19b87a11d
- SHA512 2832fd5f238aa5d2b7c4ce3bfc81c71a3ea764ca596cc360fbd08270e1a885a9b5a2c6d21912d902997f70c675e6212cb0c755ddd6890becf22959205d9c06c6
- SSDEEP 1572864:vOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:DgmeNxNNZxqV
- TLSH
  T1E2887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution quest ransomware rat spyware stealer
- Family: Quest,Voog,Frost
  Quest aka VoogStealer and FrostStealer is a Windows stealer based on ElectronJS.
  stealer rat quest
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 467KB
- SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
- MD5 5db499ae909083620e47eeea1623b2af
- SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
- SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
- SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
- TLSH
  T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.4MB
- SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
- MD5 57c23aa2c39f11528e56a48ea1824036
- SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
- SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
- SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
- TLSH
  T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
- MD5 583b1d71cd7b847ba02d734c508cd92f
- SHA1 d63966aeafa951d51967620c606e9b97399699c4
- SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
- SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
- TLSH
  T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  vulkan-1.dll
- Size 925KB
- SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
- MD5 47af18d68dc7cf271f0a92707f783f64
- SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
- SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
- SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
- TLSH
  T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23